Skip to content

CVE-2021-27218: gbytearray: Do not accept too large byte arrays

Krzesimir Nowak requested to merge krnowak/glib:byte-array-take into master

GByteArray uses guint for storing the length of the byte array, but it also has a constructor (g_byte_array_new_take) that takes length as a gsize. gsize may be larger than guint (64 bits for gsize vs 32 bits for guint). It is possible to call the function with a value greater than G_MAXUINT, which will result in silent length truncation. This may happen as a result of unreffing GBytes into GByteArray, so rather be loud about it.

Edited by Simon McVittie

Merge request reports