Google Git
Sign in
fuchsia / third_party / github.com / GNOME / glib / refs/heads/upstream/wip/smcv/2.74-cve-2024-34397
commitee9d71940867e8831403811112952739b6fc3685[log] [tgz]
authorSimon McVittie <smcv@collabora.com>Wed May 08 14:46:08 2024 +0000
committerSimon McVittie <smcv@debian.org>Wed May 08 15:59:56 2024 +0100
tree37979c28237a029c139ccce7d67226d62575e602
parentba8e2c69fa97b17107b2097e404c18a997e747e6 [diff]
gdbusconnection: Allow name owners to have the syntax of a well-known name

In a D-Bus-Specification-compliant message bus, the owner of a well-known
name is a unique name. However, ibus has its own small implementation
of a message bus (src/ibusbus.c) in which org.freedesktop.IBus is
special-cased to also have itself as its owner (like org.freedesktop.DBus
on a standard message bus), and connects to that bus with the
G_DBUS_CONNECTION_FLAGS_MESSAGE_BUS_CONNECTION flag. The ability to do
this regressed when CVE-2024-34397 was fixed.

Relax the checks to allow the owner of a well-known name to be any valid
D-Bus name, even if it is not syntactically a unique name.

Fixes: 683b14b9 "gdbus: Track name owners for signal subscriptions"
Resolves: https://gitlab.gnome.org/GNOME/glib/-/issues/3353
Bug-Debian: https://bugs.debian.org/1070730
Bug-Debian: https://bugs.debian.org/1070736
Bug-Debian: https://bugs.debian.org/1070743
Bug-Debian: https://bugs.debian.org/1070745
Signed-off-by: Simon McVittie <smcv@debian.org>
(cherry picked from commit 7d65f6c5a20f67aa9a857d0f7b0bf5de4d75be9b)
1 file changed
tree: 37979c28237a029c139ccce7d67226d62575e602
  1. .gitlab-ci/
  2. .reuse/
  3. docs/
  4. fuzzing/
  5. gio/
  6. glib/
  7. gmodule/
  8. gobject/
  9. gthread/
  10. LICENSES/
  11. m4macros/
  12. po/
  13. subprojects/
  14. tests/
  15. tools/
  16. COPYING ⇨ LICENSES/LGPL-2.1-or-later.txt
  17. .clang-format
  18. .dir-locals.el
  19. .editorconfig
  20. .gitignore
  21. .gitlab-ci.yml
  22. .gitmodules
  23. .lcovrc
  24. CODE_OF_CONDUCT.md
  25. CONTRIBUTING.md
  26. glib.doap
  27. HACKING
  28. INSTALL.md
  29. meson.build
  30. meson_options.txt
  31. msvc_recommended_pragmas.h
  32. NEWS
  33. README.md
  34. README.win32.md
  35. SECURITY.md
README.md

GLib

GLib is the low-level core library that forms the basis for projects such as GTK and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system.

The official download locations are: https://download.gnome.org/sources/glib

The official web site is: https://www.gtk.org/

Installation

See the file ‘INSTALL.md’

Supported versions

Only the most recent unstable and stable release series are supported. All older versions are not supported upstream and may contain bugs, some of which may be exploitable security vulnerabilities.

See SECURITY.md for more details.

Documentation

API documentation is available online for GLib for the:

Discussion

If you have a question about how to use GLib, seek help on GNOME’s Discourse instance. Alternatively, ask a question on StackOverflow and tag it glib.

Reporting bugs

Bugs should be reported to the GNOME issue tracking system. You will need to create an account for yourself. You may also submit bugs by e-mail (without an account) by e-mailing incoming+gnome-glib-658-issue-@gitlab.gnome.org, but this will give you a degraded experience.

Bugs are for reporting problems in GLib itself, not for asking questions about how to use it. To ask questions, use one of our discussion forums.

In bug reports please include:

  • Information about your system. For instance:
    • What operating system and version
    • For Linux, what version of the C library
    • And anything else you think is relevant.
  • How to reproduce the bug.
    • If you can reproduce it with one of the test programs that are built in the tests/ subdirectory, that will be most convenient. Otherwise, please include a short test program that exhibits the behavior. As a last resort, you can also provide a pointer to a larger piece of software that can be downloaded.
  • If the bug was a crash, the exact text that was printed out when the crash occurred.
  • Further information such as stack traces may be useful, but is not necessary.

Contributing to GLib

Please follow the contribution guide to know how to start contributing to GLib.

Patches should be submitted as merge requests to gitlab.gnome.org. If the patch fixes an existing issue, please refer to the issue in your commit message with the following notation (for issue 123):

Closes: #123

Otherwise, create a new merge request that introduces the change. Filing a separate issue is not required.

Default branch renamed to main

The default development branch of GLib has been renamed to main. To update your local checkout, use:

git checkout master
git branch -m master main
git fetch
git branch --unset-upstream
git branch -u origin/main
git symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main