Repository navigation
glib: 2.88.4 + backport CVE-2026-16118 fix (xdgmime heap overflow), declare GithubRepo provenance - #918
Merged
Conversation
_xdg_mime_magic_parse_magic_line in the bundled xdgmime (gio/xdgmime/xdgmimemagic.c) byte-swaps `~2`/`~4` magic values on little-endian hosts. The write side applied the cast before adding the byte offset, so a 4-byte value with word size 2 wrote 2 bytes past the end of matchlet->value. A MIME magic file in a user-writable XDG data dir is enough to reach it, for example through g_content_type_guess(). The fix is GNOME/glib ca75aff83af9 (MR !5286, merged 2026-08-07), which came after 2.88.3. Debian carries the same commit as 2.88.3-3. - Carry the upstream commit verbatim and apply it fail-closed with `patch -Np1`. - Add a build-time regression test using the installed `gio`. A magic rule `>0=ABCD~2` must classify a file that starts with "BADC". Without the patch the second word is never swapped (it is written out of bounds instead), so the file comes back as application/octet-stream and the build fails. Verified as a negative control. - Declare source_provenance GithubRepo GNOME/glib, GNOME's own read-only mirror. This follows the libxml2/libxslt precedent, and it keeps the curated gnome:glib CPE identity in use (pkgmgr-rs#848). Refs gominimal/pkgmgr-rs#848 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reached
This review includes 3 billable files and costs up to $0.75.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 14 minutes for your next included review. View limit details
Comment |
Member
There was a problem hiding this comment.
The patch is identical to upstream ca75aff83af9 and applies cleanly to 2.88.3, and the post-install gio info probe is fine. Two things:
- 2.88.4 is out (tagged 2026-10-08, before this PR was opened) with a batch of security backports (!5394: unicode normalization overflows, gmarkup error paths, gvariant, socketaddress, giochannel strncmp overread, gresource underflow, logging stack overflow). It does not contain the xdgmime fix:
xdgmimemagic.c:486is still unparenthesized there. So please bump to 2.88.4 and keep this patch. The note that "2.88.4 or 2.90" will fix it is wrong for 2.88.4. - Provenance (
build.ncl:64-73) deliberately declares the GitHub mirror, which AGENTS.md forbids. The canonical source is gitlab.gnome.org, and'Gitlabwithhostcan express that (seepackages/psmisc,packages/tree). I understand the CPE-identity argument (libxml2/libxslt precedent), but that's a policy exception that needs an explicit decision, and if accepted it should be written into AGENTS.md. Holding approval until that's settled.
Generated by Claude Code
2.88.4 (2026-10-08) brings the !5394 security backports but leaves gio/xdgmime/ byte-identical to 2.88.3, so ca75aff83af9 is still needed and applies unchanged. Tarball sha256 matches download.gnome.org's sha256sum; mirrored to minimal-staging-archives. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
Author
|
Thanks @norrietaylor.
🤖 Generated with Claude Code |
norrietaylor
approved these changes
Oct 22, 2026
Member
There was a problem hiding this comment.
Approving. Both technical points from my last review are addressed:
- It's on 2.88.4, and the xdgmime patch is kept. 2.88.4's
gio/xdgmime/is byte-identical to 2.88.3's, so the patch is still needed. - The patch applies cleanly, before meson and under
set -e, and the negative control is meaningful. - The incorrect "2.88.4 will fix it" note is gone.
I'm deferring to your judgement on provenance and accepting the GNOME GitHub mirror as declared. Please follow up with an AGENTS.md entry for official upstream mirrors (glib, libxml2, libxslt), so the three are covered by policy rather than precedent. The build.ncl:70 comment cites pkgmgr-rs#848, which is the audit, not a policy, so that entry would be the right reference.
Nits:
- I could only verify the 2.88.4 sha256 against the staging copy; GNOME's own sha256sum couldn't be checked from my environment.
- The
build.sh:35-36comment says "on big-endian hosts no swap happens", but upstream tests#if LITTLE_ENDIAN, which is always defined with glibc's<endian.h>. That's moot on our arches; just soften the wording.
Generated by Claude Code
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
CVE-2026-16118 is a heap overflow in GLib's bundled xdgmime, in
_xdg_mime_magic_parse_magic_line()(gio/xdgmime/xdgmimemagic.c).~2/~4magic value is byte-swapped in place. The write side does*((xdg_uint16_t *) matchlet->value + i): the cast is applied before the byte offset is added, so the write lands ati * word_sizebytes. Withvalue_length = 4andword_size = 2, it writes 2 bytes past the end of the allocation.$XDG_DATA_HOME/mime/magic) is enough. Any process that guesses a content type then parses it, for example throughg_content_type_guess().GNOME/glib@ca75aff8, from MR !5286 "Update xdgmime", merged 2026-08-07. It closes glib#3992 and is on main only. It is not in 2.88.4 (2026-10-08): that release's security backports (!5394) leavegio/xdgmime/byte-identical to 2.88.3, andxdgmimemagic.c:486is still unparenthesized.2.88.3-3with the same change. The security tracker also lists trixie2.84.4-3~deb13u5.Changes
25fd169f…c5a8matches download.gnome.org'sglib-2.88.4.sha256sum; it is mirrored togs://minimal-staging-archives(GCS md5 matches the download). The patch below still applies unchanged.CVE-2026-16118.patch. This is upstream's.patchfor ca75aff8, unmodified: 4 lines, adding parentheses only.build.shapplies it withpatch -Np1underset -e, using the same pattern as wget and python, andpatchis added tobuild_deps. The second commit in !5286,4ef012af("Check if caches are set before dumping them"), only touches debug-dump code and is not a security fix, so it is not carried.gio. The bug changes behaviour, not only memory safety. With the cast in the wrong place, the second word is written out of bounds and never swapped in place.>0=ABCD~2into a privateXDG_DATA_HOME.BADC, andgio info -a standard::content-typeon a file starting withBADCreturnsapplication/x-cve-2026-16118.'application/octet-stream', and the build fails.source_provenance = GithubRepo GNOME/glib. glib had no provenance, so the advisory pipeline never asked about it by identity (pkgmgr-rs#848). The canonical home is gitlab.gnome.org, and github.com/GNOME/glib is GNOME's own read-only mirror, with the same tags (2.88.3) and the same SHAs. I choseGithubRepoover'Gitlabdeliberately:libxml2andlibxsltalready declare their GNOME GitHub mirrors.gnome:glibCPE identity (37 advisories in prodadvisory_cpe). TheGitlabarm uses that identity only when the provenance purl has zero rows.pkg:generic/gitlab.gnome.org/gnome/glibhas 46, soGitlabwould drop NVD-CPE coverage in exchange for records it cannot place by version (scscan.rs:4334-4363).pkg:github/gnome/glibholds 31 records. All 31 carry an enumeratedversions[]of bare tags, and none of them list2.88.3, so none should newly flag at our version.Verification
All runs were in a
min sessionwith thepkgbuildloadout, on arm64, re-run on 2.88.4 (Project version: 2.88.4):min package build --rebuild --verbose glibprintedpatching file gio/xdgmime/xdgmimemagic.candCVE-2026-16118 probe content type: 'application/x-cve-2026-16118', thenbuild finished.min check --packages glibpasses everything.Reviewer notes
advisoriesholds it only as an NVD record, with no CPE configuration and no purl rows. Once NVD addsgnome:glibCPEs, the curated identity will pick it up and report it as affected even though this patch is carried. That will need a VEXnot_affected / inline_mitigations_already_existuntil a release carries ca75aff8 (2.90, or a later 2.88.x backport; 2.88.4 does not).ca75aff8.GNOME_EVEN_ODD_STACKguard still rejects odd-minor devel releases atcheck_latest's single exit, whichever tier answers. It is still worth apkgmgr check --package glib -vafter merge. I could not run it here, because there is no local pkgmgr build.at-spi2-core,atk,chromium-bin,chromium-headless-shell-bin,harfbuzz,libvips,next,pango,sshfs. 15 transitively, which addsagent-browser,ffmpeg,graphviz,libass,mermaid-cli,tamarin-prover.Refs gominimal/pkgmgr-rs#848
🤖 Generated with Claude Code