From 5ba0ed9ab2c28294713bdc56a8744ff0a446b59c Mon Sep 17 00:00:00 2001
From: Marco Trevisan <mail@3v1n0.net>
Date: Fri, 23 Jan 2026 18:48:30 +0100
Subject: [PATCH] gbase64: Use gsize to prevent potential overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both g_base64_encode_step() and g_base64_encode_close() return gsize
values, but these are summed to an int value.

If the sum of these returned values is bigger than MAXINT, we overflow
while doing the null byte write.

Spotted by treeplus.
Thanks to the Sovereign Tech Resilience programme from the Sovereign
Tech Agency.

ID: #YWH-PGM9867-168
Closes: #3870


(cherry picked from commit 6845f7776982849a2be1d8c9b0495e389092bff2)

Co-authored-by: Marco Trevisan (Treviño) <mail@3v1n0.net>

CVE: CVE-2026-1484
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/5ba0ed9ab2c28294713bdc56a8744ff0a446b59c]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 glib/gbase64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/glib/gbase64.c b/glib/gbase64.c
index 2ea4a4ef4..214b48911 100644
--- a/glib/gbase64.c
+++ b/glib/gbase64.c
@@ -262,8 +262,9 @@ g_base64_encode (const guchar *data,
                  gsize         len)
 {
   gchar *out;
-  gint state = 0, outlen;
+  gint state = 0;
   gint save = 0;
+  gsize outlen;
 
   g_return_val_if_fail (data != NULL || len == 0, NULL);
 
