From a75052ceeebea434f271b670766acd5416bc83b9 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Thu, 16 Apr 2026 15:08:10 +0100
Subject: [PATCH 2/2] gdbusintrospection: Add some assertions before array
 dereferences
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The state handling inside the D-Bus introspection XML parser is
complicated, and it’s possible that these dereferences of the
`len - 1`th element might get reached when the array is empty.

Make failures like that more debuggable by adding an assertion on the
length beforehand.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Helps: #3932

CVE: CVE-2026-58016
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/656ad4582cb1d7a7fa8bafe3ce8aec6aa3c17da0]

Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
---
 gio/gdbusintrospection.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
index 6f722ee6153d..ed0d291f99f0 100644
--- a/gio/gdbusintrospection.c
+++ b/gio/gdbusintrospection.c
@@ -1096,6 +1096,7 @@ parse_data_get_annotation (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->annotations, g_new0 (GDBusAnnotationInfo, 1));
+  g_assert (data->annotations->len > 0);
   return data->annotations->pdata[data->annotations->len - 1];
 }
 
@@ -1105,6 +1106,7 @@ parse_data_get_arg (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->args, g_new0 (GDBusArgInfo, 1));
+  g_assert (data->args->len > 0);
   return data->args->pdata[data->args->len - 1];
 }
 
@@ -1114,6 +1116,7 @@ parse_data_get_out_arg (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->out_args, g_new0 (GDBusArgInfo, 1));
+  g_assert (data->out_args->len > 0);
   return data->out_args->pdata[data->out_args->len - 1];
 }
 
@@ -1123,6 +1126,7 @@ parse_data_get_method (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->methods, g_new0 (GDBusMethodInfo, 1));
+  g_assert (data->methods->len > 0);
   return data->methods->pdata[data->methods->len - 1];
 }
 
@@ -1132,6 +1136,7 @@ parse_data_get_signal (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->signals, g_new0 (GDBusSignalInfo, 1));
+  g_assert (data->signals->len > 0);
   return data->signals->pdata[data->signals->len - 1];
 }
 
@@ -1141,6 +1146,7 @@ parse_data_get_property (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->properties, g_new0 (GDBusPropertyInfo, 1));
+  g_assert (data->properties->len > 0);
   return data->properties->pdata[data->properties->len - 1];
 }
 
@@ -1150,6 +1156,7 @@ parse_data_get_interface (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->interfaces, g_new0 (GDBusInterfaceInfo, 1));
+  g_assert (data->interfaces->len > 0);
   return data->interfaces->pdata[data->interfaces->len - 1];
 }
 
@@ -1159,6 +1166,7 @@ parse_data_get_node (ParseData *data,
 {
   if (create_new)
     g_ptr_array_add (data->nodes, g_new0 (GDBusNodeInfo, 1));
+  g_assert (data->nodes->len > 0);
   return data->nodes->pdata[data->nodes->len - 1];
 }

--
2.54.0