From 8338414f6560216efe67d3cbf549e32f8630252a Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Sun, 29 Mar 2026 19:10:41 +0100
Subject: [PATCH] gvariant: Fix an off-by-one error in an offset comparison
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows a single byte out-of-bounds read off the end of the
(potentially untrusted) byte array backing a `GVariant` when it’s
being checked for normal form.

I can’t see how this could practically be exploited, but it’s certainly
a security bug as the `GVariant` normal form checking code is supposed
to be robust to malicious inputs.

Spotted by linhlhq as #YWH-PGM9867-190, and fix and reproducer provided
by them too, thanks. Confirmed and turned into a unit test by me.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Fixes: #3915
---
 glib/gvariant-serialiser.c |  2 +-
 glib/tests/gvariant.c      | 48 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c
index 1a050c40b2..73f78a072a 100644
--- a/glib/gvariant-serialiser.c
+++ b/glib/gvariant-serialiser.c
@@ -1250,7 +1250,7 @@ gvs_tuple_is_normal (GVariantSerialised value)
 
       while (offset & alignment)
         {
-          if (offset > value.size || value.data[offset] != '\0')
+          if (offset >= value.size || value.data[offset] != '\0')
             return FALSE;
           offset++;
         }
diff --git a/glib/tests/gvariant.c b/glib/tests/gvariant.c
index c1d66e8248..04925ae41b 100644
--- a/glib/tests/gvariant.c
+++ b/glib/tests/gvariant.c
@@ -5779,6 +5779,52 @@ test_normal_checking_tuple_offsets5 (void)
   g_variant_unref (variant);
 }
 
+/* This is a regression test that looping over the padding bytes in a short
+ * (non-normal) tuple doesn’t overflow the input data.
+ *
+ * See https://gitlab.gnome.org/GNOME/glib/-/issues/3915 */
+static void
+test_normal_checking_tuple_offsets6 (void)
+{
+  /*
+   * Type: (ynqiuxthdsog) — 12 members, first member 'y' (byte) has
+   * alignment 0, second 'n' (int16) has alignment 1.
+   * With 1 byte of data (0x28), after reading the first byte member,
+   * offset=1, alignment check for 'n' requires offset to be even,
+   * so the while loop checks value.data[1] — but size is only 1.
+   *
+   * Use heap allocation via GBytes so ASan reports heap-buffer-overflow.
+   */
+  uint8_t *heap_data = NULL;
+  GBytes *bytes = NULL;
+  const GVariantType *data_type = G_VARIANT_TYPE ("(ynqiuxthdsog)");
+  GVariant *variant = NULL;
+  GVariant *normal_variant = NULL;
+  GVariant *expected = NULL;
+
+  g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/3915");
+
+  heap_data = g_malloc (1);
+  heap_data[0] = 0x28;
+  bytes = g_bytes_new_take (heap_data, 1);
+
+  variant = g_variant_new_from_bytes (data_type, bytes, FALSE);
+  g_assert_nonnull (variant);
+
+  g_assert_false (g_variant_is_normal_form (variant));
+
+  normal_variant = g_variant_get_normal_form (variant);
+  g_assert_nonnull (normal_variant);
+
+  expected = g_variant_new_parsed ("(byte 0x28, int16 0, uint16 0, 0, uint32 0, int64 0, uint64 0, handle 0, 0.0, '', objectpath '/', signature '')");
+  g_assert_cmpvariant (expected, variant);
+  g_assert_cmpvariant (expected, normal_variant);
+
+  g_variant_unref (expected);
+  g_variant_unref (normal_variant);
+  g_variant_unref (variant);
+}
+
 /* Test that an otherwise-valid serialised GVariant is considered non-normal if
  * its offset table entries are too wide.
  *
@@ -6057,6 +6103,8 @@ main (int argc, char **argv)
                    test_normal_checking_tuple_offsets4);
   g_test_add_func ("/gvariant/normal-checking/tuple-offsets5",
                    test_normal_checking_tuple_offsets5);
+  g_test_add_func ("/gvariant/normal-checking/tuple-offsets6",
+                   test_normal_checking_tuple_offsets6);
   g_test_add_func ("/gvariant/normal-checking/tuple-offsets/minimal-sized",
                    test_normal_checking_tuple_offsets_minimal_sized);
   g_test_add_func ("/gvariant/normal-checking/empty-object-path",
-- 
GitLab