From 25429bd0b22222d6986d000d62b44eebf490837d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Wed, 21 Jan 2026 20:09:44 +0100
Subject: [PATCH] gbase64: Ensure that the out value is within allocated size

We do not want to deference or write to it

Related to: #3870

CVE: CVE-2026-1484
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/25429bd0b22222d6986d000d62b44eebf490837d]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 glib/gbase64.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/glib/gbase64.c b/glib/gbase64.c
index 214b48911..0141b3b07 100644
--- a/glib/gbase64.c
+++ b/glib/gbase64.c
@@ -267,6 +267,7 @@ g_base64_encode (const guchar *data,
   gint state = 0;
   gint save = 0;
   gsize outlen;
+  gsize allocsize;
 
   g_return_val_if_fail (data != NULL || len == 0, NULL);
 
@@ -274,10 +275,15 @@ g_base64_encode (const guchar *data,
      +1 is needed for trailing \0, also check for unlikely integer overflow */
   g_return_val_if_fail (len < ((G_MAXSIZE - 1) / 4 - 1) * 3, NULL);
 
-  out = g_malloc ((len / 3 + 1) * 4 + 1);
+  allocsize = (len / 3 + 1) * 4 + 1;
+  out = g_malloc (allocsize);
 
   outlen = g_base64_encode_step (data, len, FALSE, out, &state, &save);
+  g_assert (outlen <= allocsize);
+
   outlen += g_base64_encode_close (FALSE, out + outlen, &state, &save);
+  g_assert (outlen <= allocsize);
+
   out[outlen] = '\0';
 
   return (gchar *) out;
