File glib2-CVE-2021-27219-add-g_memdup2.patch of Package glib2

Overview Repositories Revisions Requests Users Attributes Meta

File glib2-CVE-2021-27219-add-g_memdup2.patch of Package glib2 (Revision 9c575e361a616b70d1f5ce2b78206193)

Currently displaying revision 9c575e361a616b70d1f5ce2b78206193 , Show latest

diff --unified --recursive --text --new-file --color glib-2.48.2.old/docs/reference/glib/Makefile.am glib-2.48.2.new/docs/reference/glib/Makefile.am
--- glib-2.48.2.old/docs/reference/glib/Makefile.am	2021-03-03 10:56:48.912490227 +0800
+++ glib-2.48.2.new/docs/reference/glib/Makefile.am	2021-03-03 17:24:42.092741871 +0800
@@ -46,6 +46,7 @@
 	gprintfint.h		\
 	gmirroringtable.h	\
 	gscripttable.h		\
+	gstrfuncsprivate.h	\
 	glib-mirroring-tab	\
 	gnulib			\
 	pcre			\
diff --unified --recursive --text --new-file --color glib-2.48.2.old/docs/reference/glib/Makefile.in glib-2.48.2.new/docs/reference/glib/Makefile.in
--- glib-2.48.2.old/docs/reference/glib/Makefile.in	2021-03-03 10:56:48.912490227 +0800
+++ glib-2.48.2.new/docs/reference/glib/Makefile.in	2021-03-03 17:30:33.739775112 +0800
@@ -464,6 +464,7 @@
 	gprintfint.h		\
 	gmirroringtable.h	\
 	gscripttable.h		\
+	gstrfuncsprivate.h	\
 	glib-mirroring-tab	\
 	gnulib			\
 	pcre			\
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gdatainputstream.c glib-2.48.2.new/gio/gdatainputstream.c
--- glib-2.48.2.old/gio/gdatainputstream.c	2021-03-03 10:56:48.889156970 +0800
+++ glib-2.48.2.new/gio/gdatainputstream.c	2021-03-03 17:41:43.134232936 +0800
@@ -27,6 +27,7 @@
 #include "gioenumtypes.h"
 #include "gioerror.h"
 #include "glibintl.h"
+#include "gstrfuncsprivate.h"
 
 #include <string.h>
 
@@ -856,7 +857,7 @@
 scan_for_chars (GDataInputStream *stream,
 		gsize            *checked_out,
 		const char       *stop_chars,
-                gssize            stop_chars_len)
+                gsize             stop_chars_len)
 {
   GBufferedInputStream *bstream;
   const char *buffer;
@@ -950,7 +951,7 @@
   gsize checked;
 
   gchar *stop_chars;
-  gssize stop_chars_len;
+  gsize stop_chars_len;
   gsize length;
 } GDataInputStreamReadData;
 
@@ -1076,12 +1077,17 @@
 {
   GDataInputStreamReadData *data;
   GTask *task;
+  gsize stop_chars_len_unsigned;
 
   data = g_slice_new0 (GDataInputStreamReadData);
-  if (stop_chars_len == -1)
-    stop_chars_len = strlen (stop_chars);
-  data->stop_chars = g_memdup (stop_chars, stop_chars_len);
-  data->stop_chars_len = stop_chars_len;
+
+  if (stop_chars_len < 0)
+    stop_chars_len_unsigned = strlen (stop_chars);
+  else
+    stop_chars_len_unsigned = (gsize) stop_chars_len;
+
+  data->stop_chars = g_memdup2 (stop_chars, stop_chars_len_unsigned);
+  data->stop_chars_len = stop_chars_len_unsigned;
   data->last_saw_cr = FALSE;
 
   task = g_task_new (stream, cancellable, callback, user_data);
@@ -1329,17 +1335,20 @@
   gssize found_pos;
   gssize res;
   char *data_until;
+  gsize stop_chars_len_unsigned;
 
   g_return_val_if_fail (G_IS_DATA_INPUT_STREAM (stream), NULL);
 
   if (stop_chars_len < 0)
-    stop_chars_len = strlen (stop_chars);
+    stop_chars_len_unsigned = strlen (stop_chars);
+  else
+    stop_chars_len_unsigned = (gsize) stop_chars_len;
 
   bstream = G_BUFFERED_INPUT_STREAM (stream);
 
   checked = 0;
 
-  while ((found_pos = scan_for_chars (stream, &checked, stop_chars, stop_chars_len)) == -1)
+  while ((found_pos = scan_for_chars (stream, &checked, stop_chars, stop_chars_len_unsigned)) == -1)
     {
       if (g_buffered_input_stream_get_available (bstream) ==
           g_buffered_input_stream_get_buffer_size (bstream))
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gdbusconnection.c glib-2.48.2.new/gio/gdbusconnection.c
--- glib-2.48.2.old/gio/gdbusconnection.c	2021-03-03 10:56:48.889156970 +0800
+++ glib-2.48.2.new/gio/gdbusconnection.c	2021-03-03 17:36:50.476638560 +0800
@@ -119,6 +119,7 @@
 #include "gasyncinitable.h"
 #include "giostream.h"
 #include "gasyncresult.h"
+#include "gstrfuncsprivate.h"
 #include "gtask.h"
 
 #ifdef G_OS_UNIX
@@ -3951,7 +3952,7 @@
   /* Don't waste memory by copying padding - remember to update this
    * when changing struct _GDBusInterfaceVTable in gdbusconnection.h
    */
-  return g_memdup ((gconstpointer) vtable, 3 * sizeof (gpointer));
+  return g_memdup2 ((gconstpointer) vtable, 3 * sizeof (gpointer));
 }
 
 static void
@@ -3968,7 +3969,7 @@
   /* Don't waste memory by copying padding - remember to update this
    * when changing struct _GDBusSubtreeVTable in gdbusconnection.h
    */
-  return g_memdup ((gconstpointer) vtable, 3 * sizeof (gpointer));
+  return g_memdup2 ((gconstpointer) vtable, 3 * sizeof (gpointer));
 }
 
 static void
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gdbusinterfaceskeleton.c glib-2.48.2.new/gio/gdbusinterfaceskeleton.c
--- glib-2.48.2.old/gio/gdbusinterfaceskeleton.c	2021-03-03 10:56:48.885823648 +0800
+++ glib-2.48.2.new/gio/gdbusinterfaceskeleton.c	2021-03-03 17:37:23.028412859 +0800
@@ -27,6 +27,7 @@
 #include "gdbusprivate.h"
 #include "gdbusmethodinvocation.h"
 #include "gdbusconnection.h"
+#include "gstrfuncsprivate.h"
 #include "gtask.h"
 #include "gioerror.h"
 
@@ -696,7 +697,7 @@
        * properly before building the hooked_vtable, so we create it
        * once at the last minute.
        */
-      interface_->priv->hooked_vtable = g_memdup (g_dbus_interface_skeleton_get_vtable (interface_), sizeof (GDBusInterfaceVTable));
+      interface_->priv->hooked_vtable = g_memdup2 (g_dbus_interface_skeleton_get_vtable (interface_), sizeof (GDBusInterfaceVTable));
       interface_->priv->hooked_vtable->method_call = skeleton_intercept_handle_method_call;
     }
 
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gfile.c glib-2.48.2.new/gio/gfile.c
--- glib-2.48.2.old/gio/gfile.c	2021-03-03 10:56:48.889156970 +0800
+++ glib-2.48.2.new/gio/gfile.c	2021-03-03 17:37:56.433533269 +0800
@@ -1,7 +1,7 @@
 /* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*- */
 
 /* GIO - GLib Input, Output and Streaming Library
- * 
+ *
  * Copyright (C) 2006-2007 Red Hat, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -60,6 +60,7 @@
 #include "gasyncresult.h"
 #include "gioerror.h"
 #include "glibintl.h"
+#include "gstrfuncsprivate.h"
 
 
 /**
@@ -145,7 +146,7 @@
  * short. Entity tags are somewhat like a more abstract version of the
  * traditional mtime, and can be used to quickly determine if the file
  * has been modified from the version on the file system. See the
- * HTTP 1.1 
+ * HTTP 1.1
  * [specification](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html)
  * for HTTP Etag headers, which are a very similar concept.
  */
@@ -2698,7 +2699,7 @@
     g_file_attribute_info_list_unref (attributes);
   if (namespaces)
     g_file_attribute_info_list_unref (namespaces);
-  
+
   return ret;
 }
 
@@ -5301,7 +5302,7 @@
  * reported. Using this flag may result in an increase in resource
  * usage, and may not have any effect depending on the #GFileMonitor
  * backend and/or filesystem type.
- * 
+ *
  * Returns: (transfer full): a #GFileMonitor for the given @file,
  *     or %NULL on error.
  *     Free the returned object with g_object_unref().
@@ -7547,7 +7548,7 @@
   g_main_context_invoke_full (g_task_get_context (task),
                               g_task_get_priority (task),
                               measure_disk_usage_invoke_progress,
-                              g_memdup (&progress, sizeof progress),
+                              g_memdup2 (&progress, sizeof progress),
                               g_free);
 }
 
@@ -7565,7 +7566,7 @@
                                  data->progress_callback ? measure_disk_usage_progress : NULL, task,
                                  &result.disk_usage, &result.num_dirs, &result.num_files,
                                  &error))
-    g_task_return_pointer (task, g_memdup (&result, sizeof result), g_free);
+    g_task_return_pointer (task, g_memdup2 (&result, sizeof result), g_free);
   else
     g_task_return_error (task, error);
 }
@@ -7588,7 +7589,7 @@
   data.progress_data = progress_data;
 
   task = g_task_new (file, cancellable, callback, user_data);
-  g_task_set_task_data (task, g_memdup (&data, sizeof data), g_free);
+  g_task_set_task_data (task, g_memdup2 (&data, sizeof data), g_free);
   g_task_set_priority (task, io_priority);
 
   g_task_run_in_thread (task, measure_disk_usage_thread);
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gkeyfilesettingsbackend.c glib-2.48.2.new/gio/gkeyfilesettingsbackend.c
--- glib-2.48.2.old/gio/gkeyfilesettingsbackend.c	2021-03-03 10:56:48.885823648 +0800
+++ glib-2.48.2.new/gio/gkeyfilesettingsbackend.c	2021-03-03 17:57:21.206992740 +0800
@@ -29,6 +29,7 @@
 #include "gfilemonitor.h"
 #include "gsimplepermission.h"
 #include "gsettingsbackend.h"
+#include "gstrfuncsprivate.h"
 
 
 #define G_TYPE_KEYFILE_SETTINGS_BACKEND      (g_keyfile_settings_backend_get_type ())
@@ -120,8 +121,8 @@
               gchar                   **group,
               gchar                   **basename)
 {
-  gint key_len = strlen (key);
-  gint i;
+  gsize key_len = strlen (key);
+  const gchar *last_slash;
 
   if (key_len < kfsb->prefix_len ||
       memcmp (key, kfsb->prefix, kfsb->prefix_len) != 0)
@@ -130,38 +131,48 @@
   key_len -= kfsb->prefix_len;
   key += kfsb->prefix_len;
 
-  for (i = key_len; i >= 0; i--)
-    if (key[i] == '/')
-      break;
+  last_slash = strrchr (key, '/');
+
+  /* Disallow empty group names or key names */
+  if (key_len == 0 ||
+      (last_slash != NULL &&
+       (*(last_slash + 1) == '\0' ||
+        last_slash == key)))
+    return FALSE;
 
   if (kfsb->root_group)
     {
       /* if a root_group was specified, make sure the user hasn't given
        * a path that ghosts that group name
        */
-      if (i == kfsb->root_group_len && memcmp (key, kfsb->root_group, i) == 0)
+      if (last_slash != NULL && (last_slash - key) == kfsb->root_group_len && memcmp (key, kfsb->root_group, last_slash - key) == 0)
         return FALSE;
     }
   else
     {
       /* if no root_group was given, ensure that the user gave a path */
-      if (i == -1)
+      if (last_slash == NULL)
         return FALSE;
     }
 
   if (group)
     {
-      if (i >= 0)
+      if (last_slash != NULL)
         {
-          *group = g_memdup (key, i + 1);
-          (*group)[i] = '\0';
+          *group = g_memdup2 (key, (last_slash - key) + 1);
+          (*group)[(last_slash - key)] = '\0';
         }
       else
         *group = g_strdup (kfsb->root_group);
     }
 
   if (basename)
-    *basename = g_memdup (key + i + 1, key_len - i);
+    {
+      if (last_slash != NULL)
+        *basename = g_memdup2 (last_slash + 1, key_len - (last_slash - key));
+      else
+        *basename = g_strdup (key);
+    }
 
   return TRUE;
 }
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gsettingsschema.c glib-2.48.2.new/gio/gsettingsschema.c
--- glib-2.48.2.old/gio/gsettingsschema.c	2021-03-03 10:56:48.902490261 +0800
+++ glib-2.48.2.new/gio/gsettingsschema.c	2021-03-03 17:36:50.476638560 +0800
@@ -20,6 +20,7 @@
 
 #include "gsettingsschema-internal.h"
 #include "gsettings.h"
+#include "gstrfuncsprivate.h"
 
 #include "gvdb/gvdb-reader.h"
 #include "strinfo.c"
@@ -1046,9 +1047,9 @@
 
       if (g_str_has_suffix (key, "/"))
         {
-          gint length = strlen (key);
+          gsize length = strlen (key);
 
-          strv[j] = g_memdup (key, length);
+          strv[j] = g_memdup2 (key, length);
           strv[j][length - 1] = '\0';
           j++;
         }
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gsocket.c glib-2.48.2.new/gio/gsocket.c
--- glib-2.48.2.old/gio/gsocket.c	2021-03-03 10:56:48.889156970 +0800
+++ glib-2.48.2.new/gio/gsocket.c	2021-03-03 17:52:03.781751289 +0800
@@ -66,6 +66,7 @@
 #include "gcredentials.h"
 #include "gcredentialsprivate.h"
 #include "glibintl.h"
+#include "gstrfuncsprivate.h"
 
 #ifdef G_OS_WIN32
 /* For Windows XP runtime compatibility, but use the system's if_nametoindex() if available */
@@ -165,7 +166,7 @@
                                                                   GError          **error);
 
 static GSocketAddress *
-cache_recv_address (GSocket *socket, struct sockaddr *native, int native_len);
+cache_recv_address (GSocket *socket, struct sockaddr *native, size_t native_len);
 
 static gssize
 g_socket_receive_message_with_timeout  (GSocket                 *socket,
@@ -259,7 +260,7 @@
   struct {
     GSocketAddress *addr;
     struct sockaddr *native;
-    gint native_len;
+    gsize native_len;
     guint64 last_used;
   } recv_addr_cache[RECV_ADDR_CACHE_SIZE];
 };
@@ -3942,7 +3943,7 @@
 	      timeout = 0;
 	  }
       }
-    
+
     if (num > 1)
       g_cancellable_release_fd (cancellable);
 
@@ -4685,14 +4686,14 @@
 }
 
 static GSocketAddress *
-cache_recv_address (GSocket *socket, struct sockaddr *native, int native_len)
+cache_recv_address (GSocket *socket, struct sockaddr *native, size_t native_len)
 {
   GSocketAddress *saddr;
   gint i;
   guint64 oldest_time = G_MAXUINT64;
   gint oldest_index = 0;
 
-  if (native_len <= 0)
+  if (native_len == 0)
     return NULL;
 
   saddr = NULL;
@@ -4700,7 +4701,7 @@
     {
       GSocketAddress *tmp = socket->priv->recv_addr_cache[i].addr;
       gpointer tmp_native = socket->priv->recv_addr_cache[i].native;
-      gint tmp_native_len = socket->priv->recv_addr_cache[i].native_len;
+      gsize tmp_native_len = socket->priv->recv_addr_cache[i].native_len;
 
       if (!tmp)
         continue;
@@ -4730,7 +4731,7 @@
       g_free (socket->priv->recv_addr_cache[oldest_index].native);
     }
 
-  socket->priv->recv_addr_cache[oldest_index].native = g_memdup (native, native_len);
+  socket->priv->recv_addr_cache[oldest_index].native = g_memdup2 (native, native_len);
   socket->priv->recv_addr_cache[oldest_index].native_len = native_len;
   socket->priv->recv_addr_cache[oldest_index].addr = g_object_ref (saddr);
   socket->priv->recv_addr_cache[oldest_index].last_used = g_get_monotonic_time ();
@@ -4811,7 +4812,7 @@
     while (1)
       {
 	result = recvmsg (socket->priv->fd, &msg, msg.msg_flags);
-#ifdef MSG_CMSG_CLOEXEC	
+#ifdef MSG_CMSG_CLOEXEC
 	if (result < 0 && get_socket_errno () == EINVAL)
 	  {
 	    /* We must be running on an old kernel.  Call without the flag. */
@@ -4878,6 +4879,9 @@
     /* do it */
     while (1)
       {
+        /* addrlen has to be of type int because that’s how WSARecvFrom() is defined */
+        G_STATIC_ASSERT (sizeof addr <= G_MAXINT);
+
 	addrlen = sizeof addr;
 	if (address)
 	  result = WSARecvFrom (socket->priv->fd,
@@ -5555,4 +5559,3 @@
 #endif
   return FALSE;
 }
-
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gtlspassword.c glib-2.48.2.new/gio/gtlspassword.c
--- glib-2.48.2.old/gio/gtlspassword.c	2021-03-03 10:56:48.895823616 +0800
+++ glib-2.48.2.new/gio/gtlspassword.c	2021-03-03 17:53:57.058786980 +0800
@@ -23,6 +23,7 @@
 #include "glibintl.h"
 
 #include "gioenumtypes.h"
+#include "gstrfuncsprivate.h"
 #include "gtlspassword.h"
 
 #include <string.h>
@@ -285,9 +286,14 @@
   g_return_if_fail (G_IS_TLS_PASSWORD (password));
 
   if (length < 0)
-    length = strlen ((gchar *)value);
+    {
+      /* FIXME: g_tls_password_set_value_full() doesn’t support unsigned gsize */
+      gsize length_unsigned = strlen ((gchar *) value);
+      g_return_if_fail (length_unsigned <= G_MAXSSIZE);
+      length = (gssize) length_unsigned;
+    }
 
-  g_tls_password_set_value_full (password, g_memdup (value, length), length, g_free);
+  g_tls_password_set_value_full (password, g_memdup2 (value, (gsize) length), length, g_free);
 }
 
 /**
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gwin32appinfo.c glib-2.48.2.new/gio/gwin32appinfo.c
--- glib-2.48.2.old/gio/gwin32appinfo.c	2021-03-03 10:56:48.899156938 +0800
+++ glib-2.48.2.new/gio/gwin32appinfo.c	2021-03-03 17:53:20.476400131 +0800
@@ -1,5 +1,5 @@
 /* GIO - GLib Input, Output and Streaming Library
- * 
+ *
  * Copyright (C) 2006-2007 Red Hat, Inc.
  * Copyright (C) 2014 Руслан Ижбулатов
  *
@@ -464,15 +464,34 @@
 /* Watch this key */
 static GWin32RegistryKey *classes_root_key;
 
+static gsize
+g_utf16_len (const gunichar2 *str)
+{
+  gsize result;
+
+  for (result = 0; str[0] != 0; str++, result++)
+    ;
+
+  return result;
+}
+
 static gunichar2 *
-g_wcsdup (const gunichar2 *str, gssize str_size)
+g_wcsdup (const gunichar2 *str, gssize str_len)
 {
-  if (str_size == -1)
-    {
-      str_size = wcslen (str) + 1;
-      str_size *= sizeof (gunichar2);
-    }
-  return g_memdup (str, str_size);
+  gsize str_len_unsigned;
+  gsize str_size;
+
+  g_return_val_if_fail (str != NULL, NULL);
+
+  if (str_len < 0)
+    str_len_unsigned = g_utf16_len (str);
+  else
+    str_len_unsigned = (gsize) str_len;
+
+  g_assert (str_len_unsigned <= G_MAXSIZE / sizeof (gunichar2) - 1);
+  str_size = (str_len_unsigned + 1) * sizeof (gunichar2);
+
+  return g_memdup2 (str, str_size);
 }
 
 #define URL_ASSOCIATIONS L"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\"
@@ -2103,7 +2122,7 @@
                                                   &program_id_folded))
                 continue;
 
-              
+
               handler_rec = g_hash_table_lookup (handlers, program_id_folded);
 
               if (handler_rec == NULL)
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/gwin32registrykey.c glib-2.48.2.new/gio/gwin32registrykey.c
--- glib-2.48.2.old/gio/gwin32registrykey.c	2021-03-03 10:56:48.885823648 +0800
+++ glib-2.48.2.new/gio/gwin32registrykey.c	2021-03-03 17:41:51.457258030 +0800
@@ -28,6 +28,8 @@
 #include <ntstatus.h>
 #include <winternl.h>
 
+#include "gstrfuncsprivate.h"
+
 #ifndef _WDMDDK_
 typedef enum _KEY_INFORMATION_CLASS {
   KeyBasicInformation,
@@ -125,16 +127,34 @@
   G_WIN32_REGISTRY_UPDATED_PATH = 1,
 } GWin32RegistryKeyUpdateFlag;
 
+static gsize
+g_utf16_len (const gunichar2 *str)
+{
+  gsize result;
+
+  for (result = 0; str[0] != 0; str++, result++)
+    ;
+
+  return result;
+}
+
 static gunichar2 *
-g_wcsdup (const gunichar2 *str,
-          gssize           str_size)
+g_wcsdup (const gunichar2 *str, gssize str_len)
 {
-  if (str_size == -1)
-    {
-      str_size = wcslen (str) + 1;
-      str_size *= sizeof (gunichar2);
-    }
-  return g_memdup (str, str_size);
+  gsize str_len_unsigned;
+  gsize str_size;
+
+  g_return_val_if_fail (str != NULL, NULL);
+
+  if (str_len < 0)
+    str_len_unsigned = g_utf16_len (str);
+  else
+    str_len_unsigned = (gsize) str_len;
+
+  g_assert (str_len_unsigned <= G_MAXSIZE / sizeof (gunichar2) - 1);
+  str_size = (str_len_unsigned + 1) * sizeof (gunichar2);
+
+  return g_memdup2 (str, str_size);
 }
 
 /**
@@ -247,7 +267,7 @@
   new_iter->value_name_size = iter->value_name_size;
 
   if (iter->value_data != NULL)
-    new_iter->value_data = g_memdup (iter->value_data, iter->value_data_size);
+    new_iter->value_data = g_memdup2 (iter->value_data, iter->value_data_size);
 
   new_iter->value_data_size = iter->value_data_size;
 
@@ -268,8 +288,8 @@
   new_iter->value_data_expanded_charsize = iter->value_data_expanded_charsize;
 
   if (iter->value_data_expanded_u8 != NULL)
-    new_iter->value_data_expanded_u8 = g_memdup (iter->value_data_expanded_u8,
-                                                 iter->value_data_expanded_charsize);
+    new_iter->value_data_expanded_u8 = g_memdup2 (iter->value_data_expanded_u8,
+                                                  iter->value_data_expanded_charsize);
 
   new_iter->value_data_expanded_u8_size = iter->value_data_expanded_charsize;
 
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/tests/async-close-output-stream.c glib-2.48.2.new/gio/tests/async-close-output-stream.c
--- glib-2.48.2.old/gio/tests/async-close-output-stream.c	2021-03-03 10:56:48.892490291 +0800
+++ glib-2.48.2.new/gio/tests/async-close-output-stream.c	2021-03-03 17:36:50.476638560 +0800
@@ -24,6 +24,8 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "gstrfuncsprivate.h"
+
 #define DATA_TO_WRITE "Hello world\n"
 
 typedef struct
@@ -147,9 +149,9 @@
 
   data->expected_size = g_memory_output_stream_get_data_size (G_MEMORY_OUTPUT_STREAM (data->data_stream));
 
-  g_assert_cmpint (data->expected_size, >, 0);
+  g_assert_cmpuint (data->expected_size, >, 0);
 
-  data->expected_output = g_memdup (written, (guint)data->expected_size);
+  data->expected_output = g_memdup2 (written, data->expected_size);
 
   /* then recreate the streams and prepare them for the asynchronous close */
   destroy_streams (data);
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/tests/gdbus-export.c glib-2.48.2.new/gio/tests/gdbus-export.c
--- glib-2.48.2.old/gio/tests/gdbus-export.c	2021-03-03 10:56:48.889156970 +0800
+++ glib-2.48.2.new/gio/tests/gdbus-export.c	2021-03-03 17:36:50.476638560 +0800
@@ -23,6 +23,7 @@
 #include <string.h>
 
 #include "gdbus-tests.h"
+#include "gstrfuncsprivate.h"
 
 /* all tests rely on a shared mainloop */
 static GMainLoop *loop = NULL;
@@ -652,7 +653,7 @@
       g_assert_not_reached ();
     }
 
-  return g_memdup (interfaces, 2 * sizeof (void *));
+  return g_memdup2 (interfaces, 2 * sizeof (void *));
 }
 
 static const GDBusInterfaceVTable *
@@ -708,7 +709,7 @@
 {
   const GDBusInterfaceInfo *interfaces[2] = { &dyna_interface_info, NULL };
 
-  return g_memdup (interfaces, 2 * sizeof (void *));
+  return g_memdup2 (interfaces, 2 * sizeof (void *));
 }
 
 static const GDBusInterfaceVTable *
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/tests/gsettings.c glib-2.48.2.new/gio/tests/gsettings.c
--- glib-2.48.2.old/gio/tests/gsettings.c	2021-03-03 10:56:48.889156970 +0800
+++ glib-2.48.2.new/gio/tests/gsettings.c	2021-03-03 17:58:56.164679558 +0800
@@ -8,12 +8,69 @@
 
 #include "testenum.h"
 
+/**
+ * g_assert_no_errno:
+ * @expr: the expression to check
+ *
+ * Debugging macro to check that an expression has a non-negative return value,
+ * as used by traditional POSIX functions (such as `rmdir()`) to indicate
+ * success.
+ *
+ * If the assertion fails (i.e. the @expr returns a negative value), an error
+ * message is logged and the testcase is marked as failed. The error message
+ * will contain the value of `errno` and its human-readable message from
+ * g_strerror().
+ *
+ * This macro will clear the value of `errno` before executing @expr.
+ *
+ * Since: 2.66
+ * Backported here as a private macro for testing.
+ */
+#define g_assert_no_errno(expr)         G_STMT_START { \
+                                             int __ret, __errsv; \
+                                             errno = 0; \
+                                             __ret = expr; \
+                                             __errsv = errno; \
+                                             if (__ret < 0) \
+                                               { \
+                                                 gchar *__msg; \
+                                                 __msg = g_strdup_printf ("assertion failed (" #expr " >= 0): errno %i: %s", __errsv, g_strerror (__errsv)); \
+                                                 g_assertion_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, __msg); \
+                                                 g_free (__msg); \
+                                               } \
+                                        } G_STMT_END
+
 static gboolean backend_set;
 
 /* These tests rely on the schemas in org.gtk.test.gschema.xml
  * to be compiled and installed in the same directory.
  */
 
+typedef struct
+{
+  gchar *tmp_dir;
+} Fixture;
+
+static void
+setup (Fixture       *fixture,
+       gconstpointer  user_data)
+{
+  GError *error = NULL;
+
+  fixture->tmp_dir = g_dir_make_tmp ("gio-test-gsettings_XXXXXX", &error);
+  g_assert_no_error (error);
+
+  g_test_message ("Using temporary directory: %s", fixture->tmp_dir);
+}
+
+static void
+teardown (Fixture       *fixture,
+          gconstpointer  user_data)
+{
+  g_assert_cmpint (g_rmdir (fixture->tmp_dir), ==, 0);
+  g_clear_pointer (&fixture->tmp_dir, g_free);
+}
+
 static void
 check_and_free (GVariant    *value,
                 const gchar *expected)
@@ -1612,11 +1669,20 @@
   (*b) = TRUE;
 }
 
+typedef struct
+{
+  const gchar *path;
+  const gchar *root_group;
+  const gchar *keyfile_group;
+  const gchar *root_path;
+} KeyfileTestData;
+
 /*
  * Test that using a keyfile works
  */
 static void
-test_keyfile (void)
+test_keyfile (Fixture       *fixture,
+              gconstpointer  user_data)
 {
   GSettingsBackend *kf_backend;
   GSettings *settings;
@@ -1627,11 +1693,11 @@
   gchar *data;
   gsize len;
   gboolean called = FALSE;
+  gchar *keyfile_path = NULL, *store_path = NULL;
 
-  g_remove ("keyfile/gsettings.store");
-  g_rmdir ("keyfile");
-
-  kf_backend = g_keyfile_settings_backend_new ("keyfile/gsettings.store", "/", "root");
+  keyfile_path = g_build_filename (fixture->tmp_dir, "keyfile", NULL);
+  store_path = g_build_filename (keyfile_path, "gsettings.store", NULL);
+  kf_backend = g_keyfile_settings_backend_new (store_path, "/", "root");
   settings = g_settings_new_with_backend ("org.gtk.test", kf_backend);
   g_object_unref (kf_backend);
 
@@ -1653,7 +1719,7 @@
   g_settings_apply (settings);
 
   keyfile = g_key_file_new ();
-  g_assert (g_key_file_load_from_file (keyfile, "keyfile/gsettings.store", 0, NULL));
+  g_assert (g_key_file_load_from_file (keyfile, store_path, 0, NULL));
 
   str = g_key_file_get_string (keyfile, "tests", "greeting", NULL);
   g_assert_cmpstr (str, ==, "'see if this works'");
@@ -1667,7 +1733,7 @@
   g_settings_reset (settings, "greeting");
   g_settings_apply (settings);
   keyfile = g_key_file_new ();
-  g_assert (g_key_file_load_from_file (keyfile, "keyfile/gsettings.store", 0, NULL));
+  g_assert (g_key_file_load_from_file (keyfile, store_path, 0, NULL));
 
   str = g_key_file_get_string (keyfile, "tests", "greeting", NULL);
   g_assert (str == NULL);
@@ -1677,7 +1743,7 @@
 
   g_key_file_set_string (keyfile, "tests", "greeting", "'howdy'");
   data = g_key_file_to_data (keyfile, &len, NULL);
-  g_file_set_contents ("keyfile/gsettings.store", data, len, &error);
+  g_file_set_contents (store_path, data, len, &error);
   g_assert_no_error (error);
   while (!called)
     g_main_context_iteration (NULL, FALSE);
@@ -1688,11 +1754,15 @@
   g_free (str);
 
   g_settings_set (settings, "farewell", "s", "cheerio");
-  
+
+  /* Check that empty keys/groups are not allowed. */
+  g_assert_false (g_settings_is_writable (settings, ""));
+  g_assert_false (g_settings_is_writable (settings, "/"));
+
   called = FALSE;
   g_signal_connect (settings, "writable-changed::greeting", G_CALLBACK (key_changed_cb), &called);
 
-  g_chmod ("keyfile", 0500);
+  g_chmod (keyfile_path, 0500);
   while (!called)
     g_main_context_iteration (NULL, FALSE);
   g_signal_handlers_disconnect_by_func (settings, key_changed_cb, &called);
@@ -1704,7 +1774,156 @@
   g_free (data);
 
   g_object_unref (settings);
-  g_chmod ("keyfile", 0777);
+
+  /* Clean up the temporary directory. */
+  g_chmod (keyfile_path, 0777);
+  g_assert_cmpint (g_remove (store_path), ==, 0);
+  g_rmdir (keyfile_path);
+  g_free (store_path);
+  g_free (keyfile_path);
+}
+
+/*
+ * Test that using a keyfile works with a schema with no path set.
+ */
+static void
+test_keyfile_no_path (Fixture       *fixture,
+                      gconstpointer  user_data)
+{
+  const KeyfileTestData *test_data = user_data;
+  GSettingsBackend *kf_backend;
+  GSettings *settings;
+  GKeyFile *keyfile;
+  gboolean writable;
+  gchar *key = NULL;
+  GError *error = NULL;
+  gchar *keyfile_path = NULL, *store_path = NULL;
+
+  keyfile_path = g_build_filename (fixture->tmp_dir, "keyfile", NULL);
+  store_path = g_build_filename (keyfile_path, "gsettings.store", NULL);
+  kf_backend = g_keyfile_settings_backend_new (store_path, test_data->root_path, test_data->root_group);
+  settings = g_settings_new_with_backend_and_path ("org.gtk.test.no-path", kf_backend, test_data->path);
+  g_object_unref (kf_backend);
+
+  g_settings_reset (settings, "test-boolean");
+  g_assert_true (g_settings_get_boolean (settings, "test-boolean"));
+
+  writable = g_settings_is_writable (settings, "test-boolean");
+  g_assert_true (writable);
+  g_settings_set (settings, "test-boolean", "b", FALSE);
+
+  g_assert_false (g_settings_get_boolean (settings, "test-boolean"));
+
+  g_settings_delay (settings);
+  g_settings_set (settings, "test-boolean", "b", TRUE);
+  g_settings_apply (settings);
+
+  keyfile = g_key_file_new ();
+  g_assert_true (g_key_file_load_from_file (keyfile, store_path, 0, NULL));
+
+  g_assert_true (g_key_file_get_boolean (keyfile, test_data->keyfile_group, "test-boolean", NULL));
+
+  g_key_file_free (keyfile);
+
+  g_settings_reset (settings, "test-boolean");
+  g_settings_apply (settings);
+  keyfile = g_key_file_new ();
+  g_assert_true (g_key_file_load_from_file (keyfile, store_path, 0, NULL));
+
+  g_assert_false (g_key_file_get_string (keyfile, test_data->keyfile_group, "test-boolean", &error));
+  g_assert_error (error, G_KEY_FILE_ERROR, G_KEY_FILE_ERROR_KEY_NOT_FOUND);
+  g_clear_error (&error);
+
+  /* Check that empty keys/groups are not allowed. */
+  g_assert_false (g_settings_is_writable (settings, ""));
+  g_assert_false (g_settings_is_writable (settings, "/"));
+
+  /* Keys which ghost the root group name are not allowed. This can only be
+   * tested when the path is `/` as otherwise it acts as a prefix and prevents
+   * any ghosting. */
+  if (g_str_equal (test_data->path, "/"))
+    {
+      key = g_strdup_printf ("%s/%s", test_data->root_group, "");
+      g_assert_false (g_settings_is_writable (settings, key));
+      g_free (key);
+
+      key = g_strdup_printf ("%s/%s", test_data->root_group, "/");
+      g_assert_false (g_settings_is_writable (settings, key));
+      g_free (key);
+
+      key = g_strdup_printf ("%s/%s", test_data->root_group, "test-boolean");
+      g_assert_false (g_settings_is_writable (settings, key));
+      g_free (key);
+    }
+
+  g_key_file_free (keyfile);
+  g_object_unref (settings);
+
+  /* Clean up the temporary directory. */
+  g_assert_no_errno (g_chmod (keyfile_path, 0777));
+  g_assert_no_errno (g_remove (store_path));
+  g_assert_no_errno (g_rmdir (keyfile_path));
+  g_free (store_path);
+  g_free (keyfile_path);
+}
+
+/*
+ * Test that a keyfile rejects writes to keys outside its root path.
+ */
+static void
+test_keyfile_outside_root_path (Fixture       *fixture,
+                                gconstpointer  user_data)
+{
+  GSettingsBackend *kf_backend;
+  GSettings *settings;
+  gchar *keyfile_path = NULL, *store_path = NULL;
+
+  keyfile_path = g_build_filename (fixture->tmp_dir, "keyfile", NULL);
+  store_path = g_build_filename (keyfile_path, "gsettings.store", NULL);
+  kf_backend = g_keyfile_settings_backend_new (store_path, "/tests/basic-types/", "root");
+  settings = g_settings_new_with_backend_and_path ("org.gtk.test.no-path", kf_backend, "/tests/");
+  g_object_unref (kf_backend);
+
+  g_assert_false (g_settings_is_writable (settings, "test-boolean"));
+
+  g_object_unref (settings);
+
+  /* Clean up the temporary directory. The keyfile probably doesn’t exist, so
+   * don’t error on failure. */
+  g_remove (store_path);
+  g_assert_no_errno (g_rmdir (keyfile_path));
+  g_free (store_path);
+  g_free (keyfile_path);
+}
+
+/*
+ * Test that a keyfile rejects writes to keys in the root if no root group is set.
+ */
+static void
+test_keyfile_no_root_group (Fixture       *fixture,
+                            gconstpointer  user_data)
+{
+  GSettingsBackend *kf_backend;
+  GSettings *settings;
+  gchar *keyfile_path = NULL, *store_path = NULL;
+
+  keyfile_path = g_build_filename (fixture->tmp_dir, "keyfile", NULL);
+  store_path = g_build_filename (keyfile_path, "gsettings.store", NULL);
+  kf_backend = g_keyfile_settings_backend_new (store_path, "/", NULL);
+  settings = g_settings_new_with_backend_and_path ("org.gtk.test.no-path", kf_backend, "/");
+  g_object_unref (kf_backend);
+
+  g_assert_false (g_settings_is_writable (settings, "test-boolean"));
+  g_assert_true (g_settings_is_writable (settings, "child/test-boolean"));
+
+  g_object_unref (settings);
+
+  /* Clean up the temporary directory. The keyfile probably doesn’t exist, so
+   * don’t error on failure. */
+  g_remove (store_path);
+  g_assert_no_errno (g_rmdir (keyfile_path));
+  g_free (store_path);
+  g_free (keyfile_path);
 }
 
 /* Test that getting child schemas works
@@ -2576,6 +2795,14 @@
   gchar *schema_text;
   gchar *enums;
   gint result;
+  const KeyfileTestData keyfile_test_data_explicit_path = { "/tests/", "root", "tests", "/" };
+  const KeyfileTestData keyfile_test_data_empty_path = { "/", "root", "root", "/" };
+  const KeyfileTestData keyfile_test_data_long_path = {
+    "/tests/path/is/very/long/and/this/makes/some/comparisons/take/a/different/branch/",
+    "root",
+    "tests/path/is/very/long/and/this/makes/some/comparisons/take/a/different/branch",
+    "/"
+  };
 
   setlocale (LC_ALL, "");
 
@@ -2659,7 +2886,12 @@
       g_test_add_func ("/gsettings/no-write-binding/subprocess/pass", test_no_write_binding_pass);
     }
 
-  g_test_add_func ("/gsettings/keyfile", test_keyfile);
+  g_test_add ("/gsettings/keyfile", Fixture, NULL, setup, test_keyfile, teardown);
+  g_test_add ("/gsettings/keyfile/explicit-path", Fixture, &keyfile_test_data_explicit_path, setup, test_keyfile_no_path, teardown);
+  g_test_add ("/gsettings/keyfile/empty-path", Fixture, &keyfile_test_data_empty_path, setup, test_keyfile_no_path, teardown);
+  g_test_add ("/gsettings/keyfile/long-path", Fixture, &keyfile_test_data_long_path, setup, test_keyfile_no_path, teardown);
+  g_test_add ("/gsettings/keyfile/outside-root-path", Fixture, NULL, setup, test_keyfile_outside_root_path, teardown);
+  g_test_add ("/gsettings/keyfile/no-root-group", Fixture, NULL, setup, test_keyfile_no_root_group, teardown);
   g_test_add_func ("/gsettings/child-schema", test_child_schema);
   g_test_add_func ("/gsettings/strinfo", test_strinfo);
   g_test_add_func ("/gsettings/enums", test_enums);
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/tests/tls-interaction.c glib-2.48.2.new/gio/tests/tls-interaction.c
--- glib-2.48.2.old/gio/tests/tls-interaction.c	2021-03-03 10:56:48.889156970 +0800
+++ glib-2.48.2.new/gio/tests/tls-interaction.c	2021-03-03 17:54:02.291985707 +0800
@@ -174,6 +174,38 @@
 }
 
 
+/* Return a copy of @str that is allocated in a silly way, to exercise
+ * custom free-functions. The returned pointer points to a copy of @str
+ * in a buffer of the form "BEFORE \0 str \0 AFTER". */
+static guchar *
+special_dup (const char *str)
+{
+  GString *buf = g_string_new ("BEFORE");
+  guchar *ret;
+
+  g_string_append_c (buf, '\0');
+  g_string_append (buf, str);
+  g_string_append_c (buf, '\0');
+  g_string_append (buf, "AFTER");
+  ret = (guchar *) g_string_free (buf, FALSE);
+  return ret + strlen ("BEFORE") + 1;
+}
+
+
+/* Free a copy of @str that was made with special_dup(), after asserting
+ * that it has not been corrupted. */
+static void
+special_free (gpointer p)
+{
+  gchar *s = p;
+  gchar *buf = s - strlen ("BEFORE") - 1;
+
+  g_assert_cmpstr (buf, ==, "BEFORE");
+  g_assert_cmpstr (s + strlen (s) + 1, ==, "AFTER");
+  g_free (buf);
+}
+
+
 static GTlsInteractionResult
 test_interaction_ask_password_sync_success (GTlsInteraction    *interaction,
                                             GTlsPassword       *password,
@@ -181,6 +213,8 @@
                                             GError            **error)
 {
   TestInteraction *self;
+  const guchar *value;
+  gsize len;
 
   g_assert (TEST_IS_INTERACTION (interaction));
   self = TEST_INTERACTION (interaction);
@@ -192,6 +226,27 @@
   g_assert (error != NULL);
   g_assert (*error == NULL);
 
+  /* Exercise different ways to set the value */
+  g_tls_password_set_value (password, (const guchar *) "foo", 4);
+  len = 0;
+  value = g_tls_password_get_value (password, &len);
+  g_assert_cmpmem (value, len, "foo", 4);
+
+  g_tls_password_set_value (password, (const guchar *) "bar", -1);
+  len = 0;
+  value = g_tls_password_get_value (password, &len);
+  g_assert_cmpmem (value, len, "bar", 3);
+
+  g_tls_password_set_value_full (password, special_dup ("baa"), 4, special_free);
+  len = 0;
+  value = g_tls_password_get_value (password, &len);
+  g_assert_cmpmem (value, len, "baa", 4);
+
+  g_tls_password_set_value_full (password, special_dup ("baz"), -1, special_free);
+  len = 0;
+  value = g_tls_password_get_value (password, &len);
+  g_assert_cmpmem (value, len, "baz", 3);
+
   /* Don't do this in real life. Include a null terminator for testing */
   g_tls_password_set_value (password, (const guchar *)"the password", 13);
   return G_TLS_INTERACTION_HANDLED;
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gio/win32/gwinhttpfile.c glib-2.48.2.new/gio/win32/gwinhttpfile.c
--- glib-2.48.2.old/gio/win32/gwinhttpfile.c	2021-03-03 10:56:48.899156938 +0800
+++ glib-2.48.2.new/gio/win32/gwinhttpfile.c	2021-03-03 17:41:38.211082880 +0800
@@ -29,6 +29,7 @@
 #include "gio/gfile.h"
 #include "gio/gfileattribute.h"
 #include "gio/gfileinfo.h"
+#include "gstrfuncsprivate.h"
 #include "gwinhttpfile.h"
 #include "gwinhttpfileinputstream.h"
 #include "gwinhttpfileoutputstream.h"
@@ -393,10 +394,10 @@
   child = g_object_new (G_TYPE_WINHTTP_FILE, NULL);
   child->vfs = winhttp_file->vfs;
   child->url = winhttp_file->url;
-  child->url.lpszScheme = g_memdup (winhttp_file->url.lpszScheme, (winhttp_file->url.dwSchemeLength+1)*2);
-  child->url.lpszHostName = g_memdup (winhttp_file->url.lpszHostName, (winhttp_file->url.dwHostNameLength+1)*2);
-  child->url.lpszUserName = g_memdup (winhttp_file->url.lpszUserName, (winhttp_file->url.dwUserNameLength+1)*2);
-  child->url.lpszPassword = g_memdup (winhttp_file->url.lpszPassword, (winhttp_file->url.dwPasswordLength+1)*2);
+  child->url.lpszScheme = g_memdup2 (winhttp_file->url.lpszScheme, ((gsize) winhttp_file->url.dwSchemeLength + 1) * 2);
+  child->url.lpszHostName = g_memdup2 (winhttp_file->url.lpszHostName, ((gsize) winhttp_file->url.dwHostNameLength + 1) * 2);
+  child->url.lpszUserName = g_memdup2 (winhttp_file->url.lpszUserName, ((gsize) winhttp_file->url.dwUserNameLength + 1) * 2);
+  child->url.lpszPassword = g_memdup2 (winhttp_file->url.lpszPassword, ((gsize) winhttp_file->url.dwPasswordLength + 1) * 2);
   child->url.lpszUrlPath = wnew_path;
   child->url.dwUrlPathLength = wcslen (wnew_path);
   child->url.lpszExtraInfo = NULL;
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/gbytes.c glib-2.48.2.new/glib/gbytes.c
--- glib-2.48.2.old/glib/gbytes.c	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/gbytes.c	2021-03-03 17:39:08.093717239 +0800
@@ -33,6 +33,8 @@
 
 #include <string.h>
 
+#include "gstrfuncsprivate.h"
+
 /**
  * GBytes:
  *
@@ -93,7 +95,7 @@
 {
   g_return_val_if_fail (data != NULL || size == 0, NULL);
 
-  return g_bytes_new_take (g_memdup (data, size), size);
+  return g_bytes_new_take (g_memdup2 (data, size), size);
 }
 
 /**
@@ -463,7 +465,7 @@
        * Copy: Non g_malloc (or compatible) allocator, or static memory,
        * so we have to copy, and then unref.
        */
-      result = g_memdup (bytes->data, bytes->size);
+      result = g_memdup2 (bytes->data, bytes->size);
       *size = bytes->size;
       g_bytes_unref (bytes);
     }
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/gdir.c glib-2.48.2.new/glib/gdir.c
--- glib-2.48.2.old/glib/gdir.c	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/gdir.c	2021-03-03 17:39:08.097050433 +0800
@@ -37,6 +37,7 @@
 #include "gconvert.h"
 #include "gfileutils.h"
 #include "gstrfuncs.h"
+#include "gstrfuncsprivate.h"
 #include "gtestutils.h"
 #include "glibintl.h"
 
@@ -113,7 +114,7 @@
     return NULL;
 #endif
 
-  return g_memdup (&dir, sizeof dir);
+  return g_memdup2 (&dir, sizeof dir);
 }
 
 /**
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/ghash.c glib-2.48.2.new/glib/ghash.c
--- glib-2.48.2.old/glib/ghash.c	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/ghash.c	2021-03-03 17:40:20.464076928 +0800
@@ -34,6 +34,7 @@
 
 #include "glib-private.h"
 #include "gstrfuncs.h"
+#include "gstrfuncsprivate.h"
 #include "gatomic.h"
 #include "gtestutils.h"
 #include "gslice.h"
@@ -961,7 +962,7 @@
    * split the table.
    */
   if (G_UNLIKELY (hash_table->keys == hash_table->values && hash_table->keys[node_index] != new_value))
-    hash_table->values = g_memdup (hash_table->keys, sizeof (gpointer) * hash_table->size);
+    hash_table->values = g_memdup2 (hash_table->keys, sizeof (gpointer) * hash_table->size);
 
   /* Step 3: Actually do the write */
   hash_table->values[node_index] = new_value;
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/giochannel.c glib-2.48.2.new/glib/giochannel.c
--- glib-2.48.2.old/glib/giochannel.c	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/giochannel.c	2021-03-03 17:53:43.279142335 +0800
@@ -37,6 +37,7 @@
 #include "giochannel.h"
 
 #include "gstrfuncs.h"
+#include "gstrfuncsprivate.h"
 #include "gtestutils.h"
 #include "glibintl.h"
 
@@ -883,17 +884,26 @@
                             const gchar	*line_term,
 			    gint         length)
 {
+  guint length_unsigned;
+
   g_return_if_fail (channel != NULL);
   g_return_if_fail (line_term == NULL || length != 0); /* Disallow "" */
 
   if (line_term == NULL)
-    length = 0;
-  else if (length < 0)
-    length = strlen (line_term);
+    length_unsigned = 0;
+  else if (length >= 0)
+    length_unsigned = (guint) length;
+  else
+    {
+      /* FIXME: We’re constrained by line_term_len being a guint here */
+      gsize length_size = strlen (line_term);
+      g_return_if_fail (length_size <= G_MAXUINT);
+      length_unsigned = (guint) length_size;
+    }
 
   g_free (channel->line_term);
-  channel->line_term = line_term ? g_memdup (line_term, length) : NULL;
-  channel->line_term_len = length;
+  channel->line_term = line_term ? g_memdup2 (line_term, length_unsigned) : NULL;
+  channel->line_term_len = length_unsigned;
 }
 
 /**
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/gslice.c glib-2.48.2.new/glib/gslice.c
--- glib-2.48.2.old/glib/gslice.c	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/gslice.c	2021-03-03 17:39:08.097050433 +0800
@@ -45,6 +45,7 @@
 #include "gmain.h"
 #include "gmem.h"               /* gslice.h */
 #include "gstrfuncs.h"
+#include "gstrfuncsprivate.h"
 #include "gutils.h"
 #include "gtrashstack.h"
 #include "gtestutils.h"
@@ -352,7 +353,7 @@
       array[i++] = allocator->contention_counters[address];
       array[i++] = allocator_get_magazine_threshold (allocator, address);
       *n_values = i;
-      return g_memdup (array, sizeof (array[0]) * *n_values);
+      return g_memdup2 (array, sizeof (array[0]) * *n_values);
     default:
       return NULL;
     }
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/gstrfuncsprivate.h glib-2.48.2.new/glib/gstrfuncsprivate.h
--- glib-2.48.2.old/glib/gstrfuncsprivate.h	1970-01-01 08:00:00.000000000 +0800
+++ glib-2.48.2.new/glib/gstrfuncsprivate.h	2021-03-03 17:16:02.163398876 +0800
@@ -0,0 +1,55 @@
+/* GLIB - Library of useful routines for C programming
+ * Copyright (C) 1995-1997  Peter Mattis, Spencer Kimball and Josh MacDonald
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <glib.h>
+#include <string.h>
+
+/*
+ * g_memdup2:
+ * @mem: (nullable): the memory to copy.
+ * @byte_size: the number of bytes to copy.
+ *
+ * Allocates @byte_size bytes of memory, and copies @byte_size bytes into it
+ * from @mem. If @mem is %NULL it returns %NULL.
+ *
+ * This replaces g_memdup(), which was prone to integer overflows when
+ * converting the argument from a #gsize to a #guint.
+ *
+ * This static inline version is a backport of the new public API from
+ * GLib 2.68, kept internal to GLib for backport to older stable releases.
+ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2319.
+ *
+ * Returns: (nullable): a pointer to the newly-allocated copy of the memory,
+ *    or %NULL if @mem is %NULL.
+ * Since: 2.68
+ */
+static inline gpointer
+g_memdup2 (gconstpointer mem,
+           gsize         byte_size)
+{
+  gpointer new_mem;
+
+  if (mem && byte_size != 0)
+    {
+      new_mem = g_malloc (byte_size);
+      memcpy (new_mem, mem, byte_size);
+    }
+  else
+    new_mem = NULL;
+
+  return new_mem;
+}
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/gtestutils.c glib-2.48.2.new/glib/gtestutils.c
--- glib-2.48.2.old/glib/gtestutils.c	2021-03-03 10:56:48.915823552 +0800
+++ glib-2.48.2.new/glib/gtestutils.c	2021-03-03 17:39:08.097050433 +0800
@@ -49,6 +49,7 @@
 #include "gpattern.h"
 #include "grand.h"
 #include "gstrfuncs.h"
+#include "gstrfuncsprivate.h"
 #include "gtimer.h"
 #include "gslice.h"
 #include "gspawn.h"
@@ -3239,7 +3240,7 @@
       if (p <= tbuffer->data->str + mlength)
         {
           g_string_erase (tbuffer->data, 0, mlength);
-          tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup (&msg, sizeof (msg)));
+          tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup2 (&msg, sizeof (msg)));
           return TRUE;
         }
 
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/gvariant.c glib-2.48.2.new/glib/gvariant.c
--- glib-2.48.2.old/glib/gvariant.c	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/gvariant.c	2021-03-03 17:39:08.097050433 +0800
@@ -33,6 +33,7 @@
 
 #include <string.h>
 
+#include "gstrfuncsprivate.h"
 
 /**
  * SECTION:gvariant
@@ -720,7 +721,7 @@
   g_variant_ref_sink (value);
 
   return g_variant_new_from_children (G_VARIANT_TYPE_VARIANT,
-                                      g_memdup (&value, sizeof value),
+                                      g_memdup2 (&value, sizeof value),
                                       1, g_variant_is_trusted (value));
 }
 
@@ -1225,7 +1226,7 @@
       return NULL;
     }
 
-  data = g_memdup (elements, n_elements * element_size);
+  data = g_memdup2 (elements, n_elements * element_size);
   value = g_variant_new_from_data (array_type, data,
                                    n_elements * element_size,
                                    FALSE, g_free, data);
@@ -1902,7 +1903,7 @@
   if (length)
     *length = size;
 
-  return g_memdup (original, size + 1);
+  return g_memdup2 (original, size + 1);
 }
 
 /**
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/gvarianttype.c glib-2.48.2.new/glib/gvarianttype.c
--- glib-2.48.2.old/glib/gvarianttype.c	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/gvarianttype.c	2021-03-03 17:39:08.097050433 +0800
@@ -27,6 +27,7 @@
 
 #include <string.h>
 
+#include "gstrfuncsprivate.h"
 
 /**
  * SECTION:gvarianttype
@@ -1109,7 +1110,7 @@
   g_assert (offset < sizeof buffer);
   buffer[offset++] = ')';
 
-  return (GVariantType *) g_memdup (buffer, offset);
+  return (GVariantType *) g_memdup2 (buffer, offset);
 }
 
 /**
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/Makefile.am glib-2.48.2.new/glib/Makefile.am
--- glib-2.48.2.old/glib/Makefile.am	2021-03-03 10:56:48.922490196 +0800
+++ glib-2.48.2.new/glib/Makefile.am	2021-03-03 17:33:19.054943542 +0800
@@ -26,11 +26,11 @@
 else
 PRINTF_SUBDIR = gnulib
 printf_la = gnulib/libgnulib.la
-endif 
+endif
 
 if USE_SYSTEM_PCRE
 else
-MAYBE_PCRE = pcre 
+MAYBE_PCRE = pcre
 endif
 
 SUBDIRS = libcharset $(PRINTF_SUBDIR) $(MAYBE_PCRE) update-pcre . tests
@@ -164,6 +164,7 @@
 	gslist.c		\
 	gstdio.c		\
 	gstrfuncs.c		\
+	gstrfuncsprivate.h	\
 	gstring.c		\
 	gstringchunk.c		\
 	gtestutils.c		\
@@ -425,7 +426,7 @@
 
 INSTALL_PROGS	+= gtester
 gtester_SOURCES	 = gtester.c
-gtester_LDADD	 = libglib-2.0.la 
+gtester_LDADD	 = libglib-2.0.la
 
 auto_config_binscripts = gtester-report
 bin_SCRIPTS = ${auto_config_binscripts}
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/Makefile.in glib-2.48.2.new/glib/Makefile.in
--- glib-2.48.2.old/glib/Makefile.in	2021-03-03 10:56:48.925823518 +0800
+++ glib-2.48.2.new/glib/Makefile.in	2021-03-03 17:34:01.199052078 +0800
@@ -248,8 +248,8 @@
 	goption.c gpattern.c gpoll.c gprimes.c gqsort.c gquark.c \
 	gqueue.c grand.c gregex.c gscanner.c gscripttable.h \
 	gsequence.c gshell.c gslice.c gslist.c gstdio.c gstrfuncs.c \
-	gstring.c gstringchunk.c gtestutils.c gthread.c \
-	gthreadprivate.h gthreadpool.c gtimer.c gtimezone.c \
+	gstrfuncsprivate.h gstring.c gstringchunk.c gtestutils.c \
+	gthread.c gthreadprivate.h gthreadpool.c gtimer.c gtimezone.c \
 	gtranslit.c gtranslit-data.h gtrashstack.c gtree.c guniprop.c \
 	gutf8.c gunibreak.h gunibreak.c gunichartables.h gunicollate.c \
 	gunicomp.h gunidecomp.h gunidecomp.c gunicodeprivate.h \
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/tests/array-test.c glib-2.48.2.new/glib/tests/array-test.c
--- glib-2.48.2.old/glib/tests/array-test.c	2021-03-03 10:56:48.919156874 +0800
+++ glib-2.48.2.new/glib/tests/array-test.c	2021-03-03 17:41:03.932379251 +0800
@@ -19,7 +19,7 @@
  * Modified by the GLib Team and others 1997-2000.  See the AUTHORS
  * file for a list of people on the GLib Team.  See the ChangeLog
  * files for a list of changes.  These files are distributed with
- * GLib at ftp://ftp.gtk.org/pub/gtk/. 
+ * GLib at ftp://ftp.gtk.org/pub/gtk/.
  */
 
 #undef G_DISABLE_ASSERT
@@ -30,6 +30,8 @@
 #include <string.h>
 #include "glib.h"
 
+#include "gstrfuncsprivate.h"
+
 static void
 sum_up (gpointer data,
 	gpointer user_data)
@@ -323,7 +325,7 @@
 
   for (i = 0; i < 10000; i++)
     g_assert (g_ptr_array_index (gparray, i) == GINT_TO_POINTER (i));
-  
+
   g_ptr_array_foreach (gparray, sum_up, &sum);
   g_assert (sum == 49995000);
 
@@ -802,7 +804,7 @@
   GByteArray *gbarray;
   guint8 *data;
 
-  data = g_memdup ("woooweeewow", 11);
+  data = g_memdup2 ("woooweeewow", 11);
   gbarray = g_byte_array_new_take (data, 11);
   g_assert (gbarray->data == data);
   g_assert_cmpuint (gbarray->len, ==, 11);
@@ -869,4 +871,3 @@
 
   return g_test_run ();
 }
-
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/tests/option-context.c glib-2.48.2.new/glib/tests/option-context.c
--- glib-2.48.2.old/glib/tests/option-context.c	2021-03-03 10:56:48.919156874 +0800
+++ glib-2.48.2.new/glib/tests/option-context.c	2021-03-03 17:39:08.097050433 +0800
@@ -27,6 +27,8 @@
 #include <string.h>
 #include <locale.h>
 
+#include "gstrfuncsprivate.h"
+
 static GOptionEntry main_entries[] = {
   { "main-switch", 0, 0,
     G_OPTION_ARG_NONE, NULL,
@@ -256,7 +258,7 @@
 static char **
 copy_stringv (char **argv, int argc)
 {
-  return g_memdup (argv, sizeof (char *) * (argc + 1));
+  return g_memdup2 (argv, sizeof (char *) * (argc + 1));
 }
 
 static void
@@ -2275,7 +2277,7 @@
   g_option_context_add_group (context, group);
 
   argv = split_string ("program --test arg1 -f arg2 --group-test arg3 --frob arg4 -z arg5", &argc);
-  orig_argv = g_memdup (argv, (argc + 1) * sizeof (char *));
+  orig_argv = g_memdup2 (argv, (argc + 1) * sizeof (char *));
 
   retval = g_option_context_parse (context, &argc, &argv, &error);
 
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/tests/strfuncs.c glib-2.48.2.new/glib/tests/strfuncs.c
--- glib-2.48.2.old/glib/tests/strfuncs.c	2021-03-03 10:56:48.922490196 +0800
+++ glib-2.48.2.new/glib/tests/strfuncs.c	2021-03-03 17:21:36.368527380 +0800
@@ -32,6 +32,8 @@
 #include <string.h>
 #include "glib.h"
 
+#include "gstrfuncsprivate.h"
+
 #if defined (_MSC_VER) && (_MSC_VER <= 1800)
 #define isnan(x) _isnan(x)
 
@@ -199,6 +201,46 @@
   #undef TEST_DIGIT
 }
 
+/* Testing g_memdup() function with various positive and negative cases */
+static void
+test_memdup (void)
+{
+  gchar *str_dup = NULL;
+  const gchar *str = "The quick brown fox jumps over the lazy dog";
+
+  /* Testing negative cases */
+  g_assert_null (g_memdup (NULL, 1024));
+  g_assert_null (g_memdup (str, 0));
+  g_assert_null (g_memdup (NULL, 0));
+
+  /* Testing normal usage cases */
+  str_dup = g_memdup (str, strlen (str) + 1);
+  g_assert_nonnull (str_dup);
+  g_assert_cmpstr (str, ==, str_dup);
+
+  g_free (str_dup);
+}
+
+/* Testing g_memdup2() function with various positive and negative cases */
+static void
+test_memdup2 (void)
+{
+  gchar *str_dup = NULL;
+  const gchar *str = "The quick brown fox jumps over the lazy dog";
+
+  /* Testing negative cases */
+  g_assert_null (g_memdup2 (NULL, 1024));
+  g_assert_null (g_memdup2 (str, 0));
+  g_assert_null (g_memdup2 (NULL, 0));
+
+  /* Testing normal usage cases */
+  str_dup = g_memdup2 (str, strlen (str) + 1);
+  g_assert_nonnull (str_dup);
+  g_assert_cmpstr (str, ==, str_dup);
+
+  g_free (str_dup);
+}
+
 static void
 test_strdup (void)
 {
@@ -250,7 +292,7 @@
   gchar **copy;
 
   copy = g_strdupv (NULL);
-  g_assert (copy == NULL);  
+  g_assert (copy == NULL);
 
   copy = g_strdupv (vec);
   g_assert (copy != NULL);
@@ -287,7 +329,7 @@
   g_free (str);
 
   str = g_strconcat (GLIB_TEST_STRING,
-		     GLIB_TEST_STRING, 
+		     GLIB_TEST_STRING,
 		     GLIB_TEST_STRING,
 		     NULL);
   g_assert (str != NULL);
@@ -319,7 +361,7 @@
 
   str = g_strjoin (NULL,
 		   GLIB_TEST_STRING,
-		   GLIB_TEST_STRING, 
+		   GLIB_TEST_STRING,
 		   GLIB_TEST_STRING,
 		   NULL);
   g_assert (str != NULL);
@@ -328,7 +370,7 @@
 
   str = g_strjoin (":",
 		   GLIB_TEST_STRING,
-		   GLIB_TEST_STRING, 
+		   GLIB_TEST_STRING,
 		   GLIB_TEST_STRING,
 		   NULL);
   g_assert (str != NULL);
@@ -420,7 +462,7 @@
   /* round trip */
   tmp = g_strescape ("abc\\\"\b\f\n\r\t\v\003\177\234\313", NULL);
   str = g_strcompress (tmp);
-  g_assert (str != NULL); 
+  g_assert (str != NULL);
   g_assert_cmpstr (str, ==, "abc\\\"\b\f\n\r\t\v\003\177\234\313");
   g_free (str);
   g_free (tmp);
@@ -846,7 +888,7 @@
   strv_check (g_strsplit_set (",x,y.z,", ",.", 1), ",x,y.z,", NULL);
   strv_check (g_strsplit_set (",,x,.y,,z,,", ",.", 1), ",,x,.y,,z,,", NULL);
   strv_check (g_strsplit_set (",.x,,y,,z,,", ",,..", 1), ",.x,,y,,z,,", NULL);
-   
+
   strv_check (g_strsplit_set ("", ",", 0), NULL);
   strv_check (g_strsplit_set ("x", ",", 0), "x", NULL);
   strv_check (g_strsplit_set ("x,y", ",", 0), "x", "y", NULL);
@@ -883,7 +925,7 @@
   strv_check (g_strsplit_set (",x,y,z", ",", 2), "", "x,y,z", NULL);
   strv_check (g_strsplit_set (",x,y,z,", ",", 2), "", "x,y,z,", NULL);
   strv_check (g_strsplit_set (",,x,,y,,z,,", ",", 2), "", ",x,,y,,z,,", NULL);
-  
+
   strv_check (g_strsplit_set (",,x,.y,..z,,", ",.", 3), "", "", "x,.y,..z,,", NULL);
 }
 
@@ -920,7 +962,7 @@
   gint l;
   gchar *dummy;
 
-  /* we try a copy of number, with some free space for malloc before that. 
+  /* we try a copy of number, with some free space for malloc before that.
    * This is supposed to smash the some wrong pointer calculations. */
 
   dummy = g_malloc (100000);
@@ -1011,10 +1053,10 @@
   d = -179769313486231570814527423731704356798070567525844996598917476803157260780028538760589558632766878171540458953514382464234321326889464182768467546703537516986049910576551282076245490090389328944075868508455133942304583236903222948165808559332123348274797826204144723168738177180919299881250404026184124858368.0;
   g_assert (d == g_ascii_strtod (g_ascii_dtostr (buffer, sizeof (buffer), d), NULL));
 #endif
-  
+
   d = pow (2.0, -1024.1);
   g_assert (d == g_ascii_strtod (g_ascii_dtostr (buffer, sizeof (buffer), d), NULL));
-  
+
   d = -pow (2.0, -1024.1);
   g_assert (d == g_ascii_strtod (g_ascii_dtostr (buffer, sizeof (buffer), d), NULL));
 
@@ -1525,6 +1567,8 @@
   g_test_add_func ("/strfuncs/strstr", test_strstr);
   g_test_add_func ("/strfuncs/has-prefix", test_has_prefix);
   g_test_add_func ("/strfuncs/has-suffix", test_has_suffix);
+  g_test_add_func ("/strfuncs/memdup", test_memdup);
+  g_test_add_func ("/strfuncs/memdup2", test_memdup2);
   g_test_add_func ("/strfuncs/strsplit", test_strsplit);
   g_test_add_func ("/strfuncs/strsplit-set", test_strsplit_set);
   g_test_add_func ("/strfuncs/strv-length", test_strv_length);
diff --unified --recursive --text --new-file --color glib-2.48.2.old/glib/tests/uri.c glib-2.48.2.new/glib/tests/uri.c
--- glib-2.48.2.old/glib/tests/uri.c	2021-03-03 10:56:48.919156874 +0800
+++ glib-2.48.2.new/glib/tests/uri.c	2021-03-03 17:41:22.021690658 +0800
@@ -81,7 +81,7 @@
    * and would not occur in real life.
    */
   { "/:", NULL, "file:///:"},
-  { "/?&=", NULL, "file:///%3F&="}, 
+  { "/?&=", NULL, "file:///%3F&="},
   { "/", "0123456789-", NULL, G_CONVERT_ERROR_ILLEGAL_SEQUENCE},
   { "/", "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "file://ABCDEFGHIJKLMNOPQRSTUVWXYZ/"},
   { "/", "abcdefghijklmnopqrstuvwxyz", "file://abcdefghijklmnopqrstuvwxyz/"},
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gobject/gsignal.c glib-2.48.2.new/gobject/gsignal.c
--- glib-2.48.2.old/gobject/gsignal.c	2021-03-03 10:56:48.932490165 +0800
+++ glib-2.48.2.new/gobject/gsignal.c	2021-03-03 17:39:03.060598110 +0800
@@ -28,6 +28,7 @@
 #include <signal.h>
 
 #include "gsignal.h"
+#include "gstrfuncsprivate.h"
 #include "gtype-private.h"
 #include "gbsearcharray.h"
 #include "gvaluecollector.h"
@@ -1723,7 +1724,7 @@
   node->single_va_closure_is_valid = FALSE;
   node->flags = signal_flags & G_SIGNAL_FLAGS_MASK;
   node->n_params = n_params;
-  node->param_types = g_memdup (param_types, sizeof (GType) * n_params);
+  node->param_types = g_memdup2 (param_types, sizeof (GType) * n_params);
   node->return_type = return_type;
   node->class_closure_bsa = NULL;
   if (accumulator)
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gobject/gtype.c glib-2.48.2.new/gobject/gtype.c
--- glib-2.48.2.old/gobject/gtype.c	2021-03-03 10:56:48.932490165 +0800
+++ glib-2.48.2.new/gobject/gtype.c	2021-03-03 17:39:03.060598110 +0800
@@ -33,6 +33,7 @@
 
 #include "glib-private.h"
 #include "gconstructor.h"
+#include "gstrfuncsprivate.h"
 
 #ifdef G_OS_WIN32
 #include <windows.h>
@@ -1480,7 +1481,7 @@
   iholder->next = iface_node_get_holders_L (iface);
   iface_node_set_holders_W (iface, iholder);
   iholder->instance_type = NODE_TYPE (node);
-  iholder->info = info ? g_memdup (info, sizeof (*info)) : NULL;
+  iholder->info = info ? g_memdup2 (info, sizeof (*info)) : NULL;
   iholder->plugin = plugin;
 
   /* create an iface entry for this type */
@@ -1741,7 +1742,7 @@
         INVALID_RECURSION ("g_type_plugin_*", iholder->plugin, NODE_NAME (iface));
       
       check_interface_info_I (iface, instance_type, &tmp_info);
-      iholder->info = g_memdup (&tmp_info, sizeof (tmp_info));
+      iholder->info = g_memdup2 (&tmp_info, sizeof (tmp_info));
     }
   
   return iholder;	/* we don't modify write lock upon returning NULL */
@@ -2022,10 +2023,10 @@
       IFaceEntry *pentry = type_lookup_iface_entry_L (pnode, iface);
       
       if (pentry)
-	vtable = g_memdup (pentry->vtable, iface->data->iface.vtable_size);
+	vtable = g_memdup2 (pentry->vtable, iface->data->iface.vtable_size);
     }
   if (!vtable)
-    vtable = g_memdup (iface->data->iface.dflt_vtable, iface->data->iface.vtable_size);
+    vtable = g_memdup2 (iface->data->iface.dflt_vtable, iface->data->iface.vtable_size);
   entry->vtable = vtable;
   vtable->g_type = NODE_TYPE (iface);
   vtable->g_instance_type = NODE_TYPE (node);
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gobject/gtypemodule.c glib-2.48.2.new/gobject/gtypemodule.c
--- glib-2.48.2.old/gobject/gtypemodule.c	2021-03-03 10:56:48.932490165 +0800
+++ glib-2.48.2.new/gobject/gtypemodule.c	2021-03-03 17:39:03.063931302 +0800
@@ -19,6 +19,7 @@
 
 #include <stdlib.h>
 
+#include "gstrfuncsprivate.h"
 #include "gtypeplugin.h"
 #include "gtypemodule.h"
 
@@ -421,7 +422,7 @@
   module_type_info->loaded = TRUE;
   module_type_info->info = *type_info;
   if (type_info->value_table)
-    module_type_info->info.value_table = g_memdup (type_info->value_table,
+    module_type_info->info.value_table = g_memdup2 (type_info->value_table,
 						   sizeof (GTypeValueTable));
 
   return module_type_info->type;
diff --unified --recursive --text --new-file --color glib-2.48.2.old/gobject/tests/param.c glib-2.48.2.new/gobject/tests/param.c
--- glib-2.48.2.old/gobject/tests/param.c	2021-03-03 10:56:48.932490165 +0800
+++ glib-2.48.2.new/gobject/tests/param.c	2021-03-03 17:39:03.063931302 +0800
@@ -2,6 +2,8 @@
 #include <glib-object.h>
 #include <stdlib.h>
 
+#include "gstrfuncsprivate.h"
+
 static void
 test_param_value (void)
 {
@@ -851,7 +853,7 @@
             test_path = g_strdup_printf ("/param/implement/subprocess/%d-%d-%d-%d",
                                          data.change_this_flag, data.change_this_type,
                                          data.use_this_flag, data.use_this_type);
-            test_data = g_memdup (&data, sizeof (TestParamImplementData));
+            test_data = g_memdup2 (&data, sizeof (TestParamImplementData));
             g_test_add_data_func_full (test_path, test_data, test_param_implement_child, g_free);
             g_free (test_path);
           }

Places

File glib2-CVE-2021-27219-add-g_memdup2.patch of Package glib2 (Revision 9c575e361a616b70d1f5ce2b78206193)

Places