diff mbox series

[wrynose,2/7] glib-2.0-initial,glib-2.0: upgrade 2.88.2 -> 2.88.4

Message ID 20261020082611.3115623-3-daniel.turull@ericsson.com
State Changes Requested, archived
Delegated to: Yoann Congal
Headers show
Series stable updates for wrynose | expand

Commit Message

Daniel Turull Oct. 20, 2026, 8:26 a.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

Changes in 2.88.3-2.88.4 (per NEWS):
- CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
  SASL line buffering
- Security hardening backport: overflow/bounds checks in
  GSocketAddress, Unicode normalization, GResource, GVariant,
  logging, and GMarkup error paths
- Fix miscompilation with GCC 17 caused by G_GNUC_CONST on
  get_type() functions
- Fix handling of long filenames when moving files to trash

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 .../{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb}  | 0
 .../glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb}         | 0
 meta/recipes-core/glib-2.0/glib.inc                             | 2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb} (100%)
 rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} (100%)

Comments

Yoann Congal Oct. 20, 2026, 9:21 a.m. UTC | #1 
On Tue Oct 20, 2026 at 10:26 AM CEST, Daniel Turull via lists.openembedded.org wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Changes in 2.88.3-2.88.4 (per NEWS):
> - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
>   SASL line buffering
> - Security hardening backport: overflow/bounds checks in
>   GSocketAddress, Unicode normalization, GResource, GVariant,
>   logging, and GMarkup error paths
> - Fix miscompilation with GCC 17 caused by G_GNUC_CONST on
>   get_type() functions
> - Fix handling of long filenames when moving files to trash
>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  .../{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb}  | 0
>  .../glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb}         | 0
>  meta/recipes-core/glib-2.0/glib.inc                             | 2 +-
>  3 files changed, 1 insertion(+), 1 deletion(-)
>  rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb} (100%)
>  rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} (100%)

Hello,

I already reviewed Peter's upgrade to .3.
Can you rebase on top of it[0]? Only this single patch, I took the others
of the series into my review branch.

[0]: https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review

Thanks,
Daniel Turull Oct. 20, 2026, 9:33 a.m. UTC | #2 
On Tue, 2026-10-20 at 11:21 +0200, Yoann Congal via lists.openembedded.org
wrote:
> On Tue Oct 20, 2026 at 10:26 AM CEST, Daniel Turull via lists.openembedded.org wrote:
> > From: Daniel Turull <daniel.turull@ericsson.com>
> >
> > Changes in 2.88.3-2.88.4 (per NEWS):
> > - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
> >   SASL line buffering
> > - Security hardening backport: overflow/bounds checks in
> >   GSocketAddress, Unicode normalization, GResource, GVariant,
> >   logging, and GMarkup error paths
> > - Fix miscompilation with GCC 17 caused by G_GNUC_CONST on
> >   get_type() functions
> > - Fix handling of long filenames when moving files to trash
> >
> > Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> > ---
> >  .../{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb}  | 0
> >  .../glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb}         | 0
> >  meta/recipes-core/glib-2.0/glib.inc                             | 2 +-
> >  3 files changed, 1 insertion(+), 1 deletion(-)
> >  rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb} (100%)
> >  rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} (100%)
>
> Hello,
>
> I already reviewed Peter's upgrade to .3.
> Can you rebase on top of it[0]? Only this single patch, I took the others
> of the series into my review branch.
>
> [0]: https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review
>

Yes, I'll send a single patch with the rebase for glib

Daniel
> Thanks,
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#248256): https://lists.openembedded.org/g/openembedded-core/message/248256
> Mute This Topic: https://lists.openembedded.org/mt/121845917/6330526
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [daniel.turull@ericsson.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
diff mbox series

Patch

diff --git a/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb b/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.4.bb
similarity index 100%
rename from meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb
rename to meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.4.bb
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.88.4.bb
similarity index 100%
rename from meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb
rename to meta/recipes-core/glib-2.0/glib-2.0_2.88.4.bb
diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc
index cad74f53f7..7e7725f9bd 100644
--- a/meta/recipes-core/glib-2.0/glib.inc
+++ b/meta/recipes-core/glib-2.0/glib.inc
@@ -242,7 +242,7 @@  SRC_URI:append:class-native = " file://relocate-modules.patch \
                                 file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
                               "
 
-SRC_URI[archive.sha256sum] = "cf3f215a640c8a4257f14317586b8f1fdd25a10a93cb4bdda147c0f9ad88e74f"
+SRC_URI[archive.sha256sum] = "25fd169f3b2f91fe2391ad297883ce0fcf30c69fc789ffd1c9672d1332b1c5a8"
 
 # Find any meson cross files in FILESPATH that are relevant for the current
 # build (using siteinfo) and add them to EXTRA_OEMESON.