G_STRUCT_OFFSET (struct sockaddr_un, sun_path) == sizeof (struct sockaddr)
should hold, and therefor the compiler should optimize it away, but it's
not required. So be clear and add it.
If g_socket_address_new_from_native (addr, sizeof (sockaddr_un)) gets
called, the size of the path will be UNIX_PATH_MAX even if it is
a null-terminated string.
Ensure that we return UNIX_PATH_MAX - 1 (because we force null
ternmination) as the path length in this case.
When passing a filename of length UNIX_PATH_MAX via sockaddr_un it will
not be null-terminated. This will cause g_unix_socket_address_new() to
fail as it expects a null-terminated string.
Use g_unix_socket_address_new_with_type() instead as it allows passing a
length.
Testcase included.
Allow addresses of type G_UNIX_SOCKET_ADDRESS_PATH to be UNIX_PATH_MAX
characters long.
Previously they could only be UNIX_PATH_MAX - 1 characters long which
lead to an inconsistency with the UNIX APIs.
There is no implementation reason for this but correctness, where I
feared that AI exploit finders might find an exploit for this and wanted
to get ahead.
Testcase adapted for this usecase.
... so we don't create a file with elevated permissions if not
necessary.
This avoids a potential race where a temporary file is created with
higher priviliges than the result, which is technically a data leak.
Fixes: 45a36e52b5
g_iconv_open() returns (GIConv) -1 on failure, but finalization
treated that sentinel as a valid descriptor. This can crash native iconv
implementations which do not tolerate it, including Solaris.
Preserve NULL as the not-initialized state, skip both invalid descriptor
values during finalization, and add coverage for unsupported charsets and
initialization which fails before opening a converter.
inotify watches are keyed by inode, so watching a directory (or file)
through two different paths that resolve to the same inode - e.g. a real
path and a symlink alias - returns the same watch descriptor (wd). The
backend already tracks this by keeping a GList of watched dirs/files per
wd.
However, when a monitor was cancelled, _ip_stop_watching() (and likewise
ip_watched_file_stop()) called _ik_ignore() -> inotify_rm_watch() as soon
as that particular path had no subscribers, without checking whether any
other path still shared the same wd. This tore down the single kernel
watch out from under the still-active monitors on the other path: they
kept reporting g_file_monitor_is_cancelled() == FALSE but silently
stopped receiving events.
Only remove the kernel watch once no other watched directory/file still
references the wd, by removing our own entry from the wd hash first and
issuing _ik_ignore() only when the list has become empty.
Add a regression test covering cancellation of a directory monitor
established through a symlink alias.
Fixes: https://gitlab.gnome.org/GNOME/glib/-/issues/4055
g_utf8_strup(), g_utf8_strdown() and g_utf8_casefold() compute
str + len when len is non-negative, which could overflow if str
is near the end of the address space. Add g_return_val_if_fail
checks to prevent this.
Related: RHEL-216604
On Windows, setlocale() alone is not sufficient for GLib to detect
locale-specific casing rules — SetThreadLocale() is also needed.
Add SetThreadLocale() calls for Turkish and Lithuanian locales,
matching the pattern used in test_turkish_strupdown.
Also drop the .UTF-8 suffix from locale names, since it is not
available on Windows.
g_utf8_strdup and g_utf8_strdown take a len argument, but they
can be tricked into reading past that limit, e.g. when doing
lookahead for a combining dot, or when the text section before
the limit ends with a greek iota below (U+0345). Prevent this
by passing the limit to the helper functions that are used
in these cases (append_mark and has_more_above).
Tests included. The tests were produced and validated with
the help of AI.
Related: RHEL-216604
