new file mode 100644
@@ -0,0 +1,120 @@
+From cc647f9e46d55509a93498af19659baf9c80f2e3 Mon Sep 17 00:00:00 2001
+From: Michael Catanzaro <mcatanzaro@redhat.com>
+Date: Thu, 10 Apr 2025 10:57:20 -0500
+Subject: [PATCH 1/2] gstring: carefully handle gssize parameters
+
+Wherever we use gssize to allow passing -1, we need to ensure we don't
+overflow the value by assigning a gsize to it without checking if the
+size exceeds the maximum gssize. The safest way to do this is to just
+use normal gsize everywhere instead and use gssize only for the
+parameter.
+
+Our computers don't have enough RAM to write tests for this. I tried
+forcing string->len to high values for test purposes, but this isn't
+valid and will just cause out of bounds reads/writes due to
+string->allocated_len being unexpectedly small, so I don't think we can
+test this easily.
+
+CVE: CVE-2025-4373
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/cc647f9e46d55509a93498af19659baf9c80f2e3]
+
+Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
+---
+ glib/gstring.c | 36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/glib/gstring.c b/glib/gstring.c
+index 9f04144..d016b65 100644
+--- a/glib/gstring.c
++++ b/glib/gstring.c
+@@ -490,8 +490,9 @@ g_string_insert_len (GString *string,
+ return string;
+
+ if (len < 0)
+- len = strlen (val);
+- len_unsigned = len;
++ len_unsigned = strlen (val);
++ else
++ len_unsigned = len;
+
+ if (pos < 0)
+ pos_unsigned = string->len;
+@@ -788,10 +789,12 @@ g_string_insert_c (GString *string,
+ g_string_maybe_expand (string, 1);
+
+ if (pos < 0)
+- pos = string->len;
++ pos_unsigned = string->len;
+ else
+- g_return_val_if_fail ((gsize) pos <= string->len, string);
+- pos_unsigned = pos;
++ {
++ pos_unsigned = pos;
++ g_return_val_if_fail (pos_unsigned <= string->len, string);
++ }
+
+ /* If not just an append, move the old stuff */
+ if (pos_unsigned < string->len)
+@@ -824,6 +827,7 @@ g_string_insert_unichar (GString *string,
+ gssize pos,
+ gunichar wc)
+ {
++ gsize pos_unsigned;
+ gint charlen, first, i;
+ gchar *dest;
+
+@@ -865,15 +869,18 @@ g_string_insert_unichar (GString *string,
+ g_string_maybe_expand (string, charlen);
+
+ if (pos < 0)
+- pos = string->len;
++ pos_unsigned = string->len;
+ else
+- g_return_val_if_fail ((gsize) pos <= string->len, string);
++ {
++ pos_unsigned = pos;
++ g_return_val_if_fail (pos_unsigned <= string->len, string);
++ }
+
+ /* If not just an append, move the old stuff */
+- if ((gsize) pos < string->len)
+- memmove (string->str + pos + charlen, string->str + pos, string->len - pos);
++ if (pos_unsigned < string->len)
++ memmove (string->str + pos_unsigned + charlen, string->str + pos_unsigned, string->len - pos_unsigned);
+
+- dest = string->str + pos;
++ dest = string->str + pos_unsigned;
+ /* Code copied from g_unichar_to_utf() */
+ for (i = charlen - 1; i > 0; --i)
+ {
+@@ -931,6 +938,7 @@ g_string_overwrite_len (GString *string,
+ const gchar *val,
+ gssize len)
+ {
++ gssize len_unsigned;
+ gsize end;
+
+ g_return_val_if_fail (string != NULL, NULL);
+@@ -942,14 +950,16 @@ g_string_overwrite_len (GString *string,
+ g_return_val_if_fail (pos <= string->len, string);
+
+ if (len < 0)
+- len = strlen (val);
++ len_unsigned = strlen (val);
++ else
++ len_unsigned = len;
+
+- end = pos + len;
++ end = pos + len_unsigned;
+
+ if (end > string->len)
+ g_string_maybe_expand (string, end - string->len);
+
+- memcpy (string->str + pos, val, len);
++ memcpy (string->str + pos, val, len_unsigned);
+
+ if (end > string->len)
+ {
+--
+2.40.0
new file mode 100644
@@ -0,0 +1,29 @@
+From 4d435bb4809793c445846db8fb87e3c9184c4703 Mon Sep 17 00:00:00 2001
+From: Peter Bloomfield <peterbloomfield@bellsouth.net>
+Date: Fri, 11 Apr 2025 05:52:33 +0000
+Subject: [PATCH 2/2] gstring: Make len_unsigned unsigned
+
+CVE: CVE-2025-4373
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/4d435bb4809793c445846db8fb87e3c9184c4703]
+
+Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
+---
+ glib/gstring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/glib/gstring.c b/glib/gstring.c
+index d016b65..d9ad0c3 100644
+--- a/glib/gstring.c
++++ b/glib/gstring.c
+@@ -938,7 +938,7 @@ g_string_overwrite_len (GString *string,
+ const gchar *val,
+ gssize len)
+ {
+- gssize len_unsigned;
++ gsize len_unsigned;
+ gsize end;
+
+ g_return_val_if_fail (string != NULL, NULL);
+--
+2.40.0
@@ -27,6 +27,8 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
file://CVE-2025-3360-04.patch \
file://CVE-2025-3360-05.patch \
file://CVE-2025-3360-06.patch \
+ file://CVE-2025-4373-01.patch \
+ file://CVE-2025-4373-02.patch \
"
SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite. References: https://nvd.nist.gov/vuln/detail/CVE-2025-4373 https://security-tracker.debian.org/tracker/CVE-2025-4373 Upstream-patches: https://gitlab.gnome.org/GNOME/glib/-/commit/cc647f9e46d55509a93498af19659baf9c80f2e3 https://gitlab.gnome.org/GNOME/glib/-/commit/4d435bb4809793c445846db8fb87e3c9184c4703 Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> --- .../glib-2.0/glib-2.0/CVE-2025-4373-01.patch | 120 ++++++++++++++++++ .../glib-2.0/glib-2.0/CVE-2025-4373-02.patch | 29 +++++ meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 + 3 files changed, 151 insertions(+) create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-4373-01.patch create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-4373-02.patch