components/library/gtk+/patches/CVE-2024-6655.patch

   1 From: Matthias Clasen <mclasen@redhat.com>
   2 Date: Sat, 15 Jun 2024 14:18:01 -0400
   3 Subject: Stop looking for modules in cwd
   4 This is just not a good idea. It is surprising, and can be misused.
   5 Fixes: https://gitlab.gnome.org/GNOME/gtk/-/issues/6786
   6 (cherry picked from commit 3bbf0b6176d42836d23c36a6ac410e807ec0a7a7)
   7 Origin: gtk 3.24.43
   8 ---
   9  gtk/gtkmodules.c | 9 ++-------
  10  1 file changed, 2 insertions(+), 7 deletions(-)
  11 diff --git a/gtk/gtkmodules.c b/gtk/gtkmodules.c
  12 index 50729b6..c0f0c30 100644
  13 --- a/gtk/gtkmodules.c
  14 +++ b/gtk/gtkmodules.c
  15 @@ -229,13 +229,8 @@ find_module (const gchar *name)
  16    gchar *module_name;
  17
  18    module_name = _gtk_find_module (name, "modules");
  19 -  if (!module_name)
  20 -    {
  21 -      /* As last resort, try loading without an absolute path (using system
  22 -       * library path)
  23 -       */
  24 -      module_name = g_module_build_path (NULL, name);
  25 -    }
  26 +  if (module_name == NULL)
  27 +    return NULL;
  28
  29    module = g_module_open (module_name, G_MODULE_BIND_LOCAL | G_MODULE_BIND_LAZY);
  30