mirror of
https://github.com/flatpak/flatpak.git
synced 2026-09-29 00:27:56 -04:00
The delta varint parser decoded into guint64 values which were then passed to GLib I/O and allocation functions that take gsize. On 32-bit systems where gsize is 32 bits this silently truncated the values. Change the varint output and all delta operation size parameters to gsize, and clamp the parsed value to G_MAXSIZE. Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc