The old GSlice API had an automated trim of its magazines if an
allocation happened after a certain amount of time—a configurable toggle
that defaulted to 15 seconds. Trimming in a slab allocator allows to
free up memory and compact the heap.
Trimming does not come for free, so ideally applications allocating a
lot of GTypeInstance objects should trim their memory when it's
convenient for them, rather than on a timer.
See: https://gitlab.gnome.org/GNOME/evolution/-/merge_requests/218
`n_offsets` counts a number of offsets in an array, so should really be
a `size_t` — even though the maximum number of elements in the arrays
used by libpcre2 is `UINT32_MAX`, using `size_t` in GLib helps with
avoiding overflow when we’re growing the array.
`pos` almost always contains a non-negative value. It can contain `-1`
to indicate the match info has been iterated off the end of the results
list. That’s quite a waste of the `int` domain (all negative numbers
except `-1` are invalid), so let’s split the validity out into a boolean
and make `pos` itself unsigned. This fixes a load of signed/unsigned
comparison warnings.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3854
The `GRegex` external API can’t be changed, and has some string lengths
as `gssize` and some as `int`. But internally, we can consistently
handle them as `size_t` so that the longest possible strings can be
handled without fear of overflow.
This means calling `strlen()` on API boundaries and converting some
internal APIs. We can do this (and change the size of various structs)
because `GRegex` is opaque.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3854
It’s easy to confuse `compile_opts` (`PCRE2_*` flags) and
`orig_compile_opts` (`GRegexCompileFlags` flags). Rename them to
`pcre2_compile_opts` and `regex_compile_opts`, respectively, to make it
a bit less confusing.
Unfortunately the type checker can’t help us here as the `PCRE2_*` flags
are defined by `pcre2` using `#define`s rather than an `enum`, so
`pcre2_compile_opts` has to stay as a `uint32_t` rather than a more
specific type.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3919
`GRegex.compile_opts` contains the options using PCRE2’s flags;
`GRegex.orig_compile_opts` contains them in `GRegexCompileFlags` format,
and that’s what we want here.
Spotted by linhlhq as #YWH-PGM9867-194. The suggested fix is theirs, and
the unit test is adapted from their report.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3919
In `G_REGEX_RAW` mode, the input string is treated as a byte array
(basically ASCII) rather than a unichar array. Accordingly, the case
changing code for substitutions needs to operate on bytes with
`G_REGEX_RAW`, rather than operating on unichars.
This fixes a potential buffer overflow when trying to do a case change
on a match of a set of bytes which are a truncated multi-byte UTF-8
encoding at the end of the input buffer.
Spotted by linhlhq as #YWH-PGM9867-193. I adapted their reproducer as
the unit test, but implemented the fix in `gregex.c` independently.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3918
If the input string (which might be malicious, as the program is
choosing to escape it) ends with 0xc2 (a UTF-8 prefix byte), the code
wasn’t previously checking the input string length was long enough to
contain the following byte before reading it.
Fix that by switching from `g_utf8_get_char()` to
`g_utf8_get_char_validated()`.
Spotted by linhlhq as #YWH-PGM9867-187. Thank you for the suggested fix
and unit test, which have been adapted into this commit.
Also spotted by oss-fuzz after we added a fuzz test for this function.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3916
oss-fuzz#498475244
Add an api to get locations for attributes. This vastly
improves error reporting, to the point where it is possible
to e.g. can highlight erroneous attrbutes in an SVG editor.
Basic test included.
These properties all have their names prefixed with 'g-', in order to
avoid conflicts with property names coming directly from an actual D-Bus
interface that a derived type might want to install. The corresponding
accessor methods are identified by theit full C symbol name, so their
names are not prefixed.
But this resulted in g-ir-scanner being unable to see the connection
between the properties and their accessors. Help it out with explicit
annotations.
Signed-off-by: Sergey Bugaev <bugaevc@gmail.com>
Otherwise it’s possible to create a non-`NULL` but invalid `GDateTime`,
which breaks all kinds of internal assumptions.
Spotted by linhlhq as #YWH-PGM9867-191. Thanks to them for providing a
suggested fix and a test case, which I have adapted and validated.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3917
This seems like a function which could be used with untrusted inputs, so
it’s probably a good idea to fuzz it.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
This allows a single byte out-of-bounds read off the end of the
(potentially untrusted) byte array backing a `GVariant` when it’s
being checked for normal form.
I can’t see how this could practically be exploited, but it’s certainly
a security bug as the `GVariant` normal form checking code is supposed
to be robust to malicious inputs.
Spotted by linhlhq as #YWH-PGM9867-190, and fix and reproducer provided
by them too, thanks. Confirmed and turned into a unit test by me.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3915
