From 662aa569efa65eaa4672ab0671eb8533a354cd89 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Wed, 21 Jan 2026 22:00:17 +0100
Subject: [PATCH] guniprop: Use size_t for output_marks length

The input string length may overflow, and this would lead to wrong
behavior and invalid writes.

Spotted by treeplus.
Thanks to the Sovereign Tech Resilience programme from the Sovereign
Tech Agency.

ID: #YWH-PGM9867-171
Closes: #3872

CVE: CVE-2026-1489
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/662aa569efa65eaa4672ab0671eb8533a354cd89]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 glib/guniprop.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/glib/guniprop.c b/glib/guniprop.c
index fe0033fd6..1a0cc6408 100644
--- a/glib/guniprop.c
+++ b/glib/guniprop.c
@@ -753,13 +753,13 @@ get_locale_type (void)
   return LOCALE_NORMAL;
 }
 
-static gint
+static size_t
 output_marks (const char **p_inout,
 	      char        *out_buffer,
 	      gboolean     remove_dot)
 {
   const char *p = *p_inout;
-  gint len = 0;
+  size_t len = 0;
   
   while (*p)
     {
