Files
packages/libs/glib2/patches/107-CVE-2024-34397-gdbusconnection-Move-SignalData-SignalSubscriber-higher-u.patch
Petr Štetiar 3932357ffb glib2: update to 2.74.7 to fix several CVEs
Bump glib2 to 2.74.7 which fixes CVE-2023-29499, CVE-2023-32611,
CVE-2023-32636, CVE-2023-32643, CVE-2023-32665 and on top of that
backport CVE-2024-34397 fix from Debian Bookworm glib2 package
2.74.6-2+deb12u2. While at it refresh the patches so they apply cleanly.

References: https://security-tracker.debian.org/tracker/source-package/glib2.0
Fixes: CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665, CVE-2024-34397
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2024-09-05 13:27:51 +02:00

159 lines
4.8 KiB
Diff
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
From: Simon McVittie <smcv@collabora.com>
Date: Thu, 14 Mar 2024 19:24:24 +0000
Subject: gdbusconnection: Move SignalData, SignalSubscriber higher up
Subsequent changes will need to access these data structures from
on_worker_message_received(). No functional change here, only moving
code around.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Origin: upstream, https://gitlab.gnome.org/GNOME/glib/-/issues/3268
---
gio/gdbusconnection.c | 128 +++++++++++++++++++++++++-------------------------
1 file changed, 65 insertions(+), 63 deletions(-)
--- a/gio/gdbusconnection.c
+++ b/gio/gdbusconnection.c
@@ -285,6 +285,71 @@ call_destroy_notify (GMainContext *cont
/* ---------------------------------------------------------------------------------------------------- */
+typedef struct
+{
+ /* All fields are immutable after construction. */
+ gatomicrefcount ref_count;
+ GDBusSignalCallback callback;
+ gpointer user_data;
+ GDestroyNotify user_data_free_func;
+ guint id;
+ GMainContext *context;
+} SignalSubscriber;
+
+static SignalSubscriber *
+signal_subscriber_ref (SignalSubscriber *subscriber)
+{
+ g_atomic_ref_count_inc (&subscriber->ref_count);
+ return subscriber;
+}
+
+static void
+signal_subscriber_unref (SignalSubscriber *subscriber)
+{
+ if (g_atomic_ref_count_dec (&subscriber->ref_count))
+ {
+ /* Destroy the user data. It doesnt matter which thread
+ * signal_subscriber_unref() is called in (or whether its called with a
+ * lock held), as call_destroy_notify() always defers to the next
+ * #GMainContext iteration. */
+ call_destroy_notify (subscriber->context,
+ subscriber->user_data_free_func,
+ subscriber->user_data);
+
+ g_main_context_unref (subscriber->context);
+ g_free (subscriber);
+ }
+}
+
+typedef struct
+{
+ gchar *rule;
+ gchar *sender;
+ gchar *sender_unique_name; /* if sender is unique or org.freedesktop.DBus, then that name... otherwise blank */
+ gchar *interface_name;
+ gchar *member;
+ gchar *object_path;
+ gchar *arg0;
+ GDBusSignalFlags flags;
+ GPtrArray *subscribers; /* (owned) (element-type SignalSubscriber) */
+} SignalData;
+
+static void
+signal_data_free (SignalData *signal_data)
+{
+ g_free (signal_data->rule);
+ g_free (signal_data->sender);
+ g_free (signal_data->sender_unique_name);
+ g_free (signal_data->interface_name);
+ g_free (signal_data->member);
+ g_free (signal_data->object_path);
+ g_free (signal_data->arg0);
+ g_ptr_array_unref (signal_data->subscribers);
+ g_free (signal_data);
+}
+
+/* ---------------------------------------------------------------------------------------------------- */
+
#ifdef G_OS_WIN32
#define CONNECTION_ENSURE_LOCK(obj) do { ; } while (FALSE)
#else
@@ -3241,69 +3306,6 @@ g_dbus_connection_remove_filter (GDBusCo
/* ---------------------------------------------------------------------------------------------------- */
-typedef struct
-{
- gchar *rule;
- gchar *sender;
- gchar *sender_unique_name; /* if sender is unique or org.freedesktop.DBus, then that name... otherwise blank */
- gchar *interface_name;
- gchar *member;
- gchar *object_path;
- gchar *arg0;
- GDBusSignalFlags flags;
- GPtrArray *subscribers; /* (owned) (element-type SignalSubscriber) */
-} SignalData;
-
-static void
-signal_data_free (SignalData *signal_data)
-{
- g_free (signal_data->rule);
- g_free (signal_data->sender);
- g_free (signal_data->sender_unique_name);
- g_free (signal_data->interface_name);
- g_free (signal_data->member);
- g_free (signal_data->object_path);
- g_free (signal_data->arg0);
- g_ptr_array_unref (signal_data->subscribers);
- g_free (signal_data);
-}
-
-typedef struct
-{
- /* All fields are immutable after construction. */
- gatomicrefcount ref_count;
- GDBusSignalCallback callback;
- gpointer user_data;
- GDestroyNotify user_data_free_func;
- guint id;
- GMainContext *context;
-} SignalSubscriber;
-
-static SignalSubscriber *
-signal_subscriber_ref (SignalSubscriber *subscriber)
-{
- g_atomic_ref_count_inc (&subscriber->ref_count);
- return subscriber;
-}
-
-static void
-signal_subscriber_unref (SignalSubscriber *subscriber)
-{
- if (g_atomic_ref_count_dec (&subscriber->ref_count))
- {
- /* Destroy the user data. It doesnt matter which thread
- * signal_subscriber_unref() is called in (or whether its called with a
- * lock held), as call_destroy_notify() always defers to the next
- * #GMainContext iteration. */
- call_destroy_notify (subscriber->context,
- subscriber->user_data_free_func,
- subscriber->user_data);
-
- g_main_context_unref (subscriber->context);
- g_free (subscriber);
- }
-}
-
static gchar *
args_to_rule (const gchar *sender,
const gchar *interface_name,