Visual Studio 2019 does not work with the 10.0.26100.0 or later SDKs for
ARM64 builds, so downgrade to the 10.0.22621.0 SDK for ARM64 builds,
which should be still present.
Fixes: #3958.
The previous documentation stated: "If the correct value would cause
underflow, zero is returned and ERANGE is stored in errno." This was
copied verbatim from the ANSI C standard and is no longer accurate
under C99/C11.
C99/C11 only guarantees that the returned value's magnitude is no
greater than the smallest normalised positive number. Subnormal
(gradual underflow) results are permitted and zero is not required.
Additionally, whether ERANGE is set for gradual underflow is
implementation-defined — it may not be set when a subnormal value
is returned, even though errno is still reset before the call.
Add tests to verify the updated behaviour.
Closes#2173
This adds a new g_set_strv() that has been used in various GNOME projects
to help ensure that strv properties are changed with minimal notify()
emissions as well as reduce chances for UAF.
Additionally, g_set_strv_take() is provided to allow setting a GStrv
without making a copy of the provided string. Use this when you are
using API like g_strv_builder_end().
Fixes: #3907
Failure to call g_shell_quote() where required can be a serious problem
(see CWE-77 and CWE-88), so let's draw special attention to when you
need this function.
When running setuid, ignore this auth mechanism and hence also the
`$G_DBUS_COOKIE_SHA1_KEYRING_DIR` environment variable.
This was considered as part of #2168 but determined at the time to not
be a problem.
It’s since been reported as a vulnerability. I don’t see how it can
realistically be exploited in practice:
- This D-Bus auth mechanism is strongly discouraged and iirc it’s only
kept around for use on Windows
- The setuid binary would have to be running as a D-Bus server in a
peer-to-peer configuration, which is very rare
- Even rarer to run it as setuid root, rather than as a system service
via a service manager
- And the configuration would have to force this auth mechanism to be
used instead of any more appropriate mechanism
That said, I don’t see any reason why we _shouldn’t_ ignore this
environment variable when setuid. ¯\_(ツ)_/¯ The fallback for
`$G_DBUS_COOKIE_SHA1_KEYRING_DIR` is to build the keyring path using
`$HOME`, but that is equally as susceptible to attacker modification
when running setuid, hence we disable the whole auth mechanism.
This brings GIO inline with what libdbus does.
Spotted by cavid.
Thanks to the Sovereign Tech Resilience programme from the Sovereign
Tech Agency.
ID: #YWH-PGM9867-164
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Given that the whole point of `g_markup_escape_text()` is to escape
input so that it can safely be passed to the markup parser and be
treated as text, we should probably be testing that behaviour.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
This is like `g_set_str()`, but it takes ownership of the new string
passed in to it, so you can conveniently pass in the return value of
`g_strdup_printf()` (etc.) without additional memory management
boilerplate.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
This commit extends the generic marshaller to support parameter and
return types that are custom GTypeInstance. This can be useful for
situations where writing a custom marshaller is impractical or lacks the
necessary plumbing to do so, such as <closure/> in GtkExpression defined
from UI files.
Fixes: #3954
The following error has just popped up in mingw32 CI, which presumably
means the compiler has just been upgraded under our feet again:
```
../glib/gnulib/vasnprintf.c: In function '_g_gnulib_vasnprintf':
../glib/gnulib/vasnprintf.c:2429:21: error: variable 'flags' set but not used [-Werror=unused-but-set-variable=]
2429 | int flags = dp->flags;
| ^~~~~
cc1.exe: all warnings being treated as errors
```
This highlighted a bug in the version of gnulib we’re using, where the
`flags` variable was assigned but never used.
In lieu of updating our gnulib copylib version (which I don’t have the
energy to do right now; see #2603), copy across the fix for this issue
from upstream.
It’s upstream commit 5527d5c548702b89d217bbe58036996066a709b6.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
This fixes the addition happening with type `uint32_t`, rather than the
expected `gssize`. Because of the narrower type, this could have
resulted in integer overflow for large header lengths, bypassing the
message length check lower down in the function.
This is not exploitable in practice unless communicating peer-to-peer
with a malicious D-Bus peer, as invalid messages like this would be
filtered out by the message bus (such as `dbus-daemon`).
Rework the arithmetic to use checked arithmetic functions into a
`size_t` (largely as suggested by Simon McVittie), and add some unit
tests. Simply doing the arithmetic in the `gssize` domain would not fix
the issue on 32-bit systems.
Based on a report by Koda Reef, albeit reverse engineered as the report
did not contain a proof of concept of the vulnerability.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3933
If the line terminator is longer than a single byte, and the current
line extends to the end of the buffer, and the buffer (which is a
`GString`) is near a power of two in length (as that’s how `GString`s
are allocated) it’s possible for the `memcmp()` which checks the
terminator to read off the end of the string buffer.
Fix that by checking the terminator length against the last character
before calling `memcmp()`. Add a unit test.
Spotted by linhlhq as #YWH-PGM9867-199. The fix is theirs (validated by
me), and the unit test is adapted from their proof of concept.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3925
We can do this because `gdbusauthmechanism.h` is a private header.
Hook it up to the existing `reject_reason` code in each
`GDBusAuthMechanism` implementation, as all three implementations
currently intermingle reject reasons from the server and client code, so
there would currently be no benefit to having a separate server and
client implementation of `*_get_reject_reason()`.
This new private API will be used in a new unit test in the following
commit.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
The D-Bus specification says the cookie ID has to be non-negative, but
we weren’t checking that (or checking that it was non-empty).
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
