From 7b46597384de916b4027ebaff662d06ff3ea2bc8 Mon Sep 17 00:00:00 2001

From: Philip Withnall <pwithnall@endlessos.org>

Date: Thu, 4 Feb 2021 13:30:52 +0000

Subject: [PATCH 1/6] gstrfuncs: Add internal g_memdup2() function

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

This will replace the existing `g_memdup()` function for use within

GLib. It has an unavoidable security flaw of taking its `byte_size`

argument as a `guint` rather than as a `gsize`. Most callers will

expect it to be a `gsize`, and may pass in large values which could

silently be truncated, resulting in an undersize allocation compared

to what the caller expects.

This could lead to a classic buffer overflow vulnerability for many

callers of `g_memdup()`.

`g_memdup2()`, in comparison, takes its `byte_size` as a `gsize`.

Spotted by Kevin Backhouse of GHSL.

In GLib 2.68, `g_memdup2()` will be a new public API. In this version

for backport to older stable releases, it’s a new `static inline` API

in a private header, so that use of `g_memdup()` within GLib can be

fixed without adding a new API in a stable release series.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>

Helps: CVE-2021-27219

Helps: GHSL-2021-045

Helps: #2319

(cherry picked from commit 5e5f75a77e399c638be66d74e5daa8caeb433e00)

---

 docs/reference/glib/meson.build |  1 +

 glib/gstrfuncsprivate.h         | 55 +++++++++++++++++++++++++++++++++

 glib/meson.build                |  1 +

 glib/tests/strfuncs.c           | 23 ++++++++++++++

 4 files changed, 80 insertions(+)

 create mode 100644 glib/gstrfuncsprivate.h

diff --git a/docs/reference/glib/meson.build b/docs/reference/glib/meson.build

index f0f915e96..1a3680941 100644

--- a/docs/reference/glib/meson.build

+++ b/docs/reference/glib/meson.build

@@ -20,6 +20,7 @@ if get_option('gtk_doc')

     'gprintfint.h',

     'gmirroringtable.h',

     'gscripttable.h',

+    'gstrfuncsprivate.h',

     'glib-mirroring-tab',

     'gnulib',

     'pcre',

diff --git a/glib/gstrfuncsprivate.h b/glib/gstrfuncsprivate.h

new file mode 100644

index 000000000..85c88328a

--- /dev/null

+++ b/glib/gstrfuncsprivate.h

@@ -0,0 +1,55 @@

+/* GLIB - Library of useful routines for C programming

+ * Copyright (C) 1995-1997  Peter Mattis, Spencer Kimball and Josh MacDonald

+ *

+ * This library is free software; you can redistribute it and/or

+ * modify it under the terms of the GNU Lesser General Public

+ * License as published by the Free Software Foundation; either

+ * version 2.1 of the License, or (at your option) any later version.

+ *

+ * This library is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ * Lesser General Public License for more details.

+ *

+ * You should have received a copy of the GNU Lesser General Public

+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.

+ */

+

+#include <glib.h>

+#include <string.h>

+

+/*

+ * g_memdup2:

+ * @mem: (nullable): the memory to copy.

+ * @byte_size: the number of bytes to copy.

+ *

+ * Allocates @byte_size bytes of memory, and copies @byte_size bytes into it

+ * from @mem. If @mem is %NULL it returns %NULL.

+ *

+ * This replaces g_memdup(), which was prone to integer overflows when

+ * converting the argument from a #gsize to a #guint.

+ *

+ * This static inline version is a backport of the new public API from

+ * GLib 2.68, kept internal to GLib for backport to older stable releases.

+ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2319.

+ *

+ * Returns: (nullable): a pointer to the newly-allocated copy of the memory,

+ *    or %NULL if @mem is %NULL.

+ * Since: 2.68

+ */

+static inline gpointer

+g_memdup2 (gconstpointer mem,

+           gsize         byte_size)

+{

+  gpointer new_mem;

+

+  if (mem && byte_size != 0)

+    {

+      new_mem = g_malloc (byte_size);

+      memcpy (new_mem, mem, byte_size);

+    }

+  else

+    new_mem = NULL;

+

+  return new_mem;

+}

diff --git a/glib/meson.build b/glib/meson.build

index a2f9da81c..481fd06ff 100644

--- a/glib/meson.build

+++ b/glib/meson.build

@@ -167,6 +167,7 @@ glib_sources = files(

   'gslist.c',

   'gstdio.c',

   'gstrfuncs.c',

+  'gstrfuncsprivate.h',

   'gstring.c',

   'gstringchunk.c',

   'gtestutils.c',

diff --git a/glib/tests/strfuncs.c b/glib/tests/strfuncs.c

index 7e031bdb1..2aa252946 100644

--- a/glib/tests/strfuncs.c

+++ b/glib/tests/strfuncs.c

@@ -32,6 +32,8 @@

 #include <string.h>

 #include "glib.h"

+#include "gstrfuncsprivate.h"

+

 #if defined (_MSC_VER) && (_MSC_VER <= 1800)

 #define isnan(x) _isnan(x)

@@ -199,6 +201,26 @@ test_is_to_digit (void)

   #undef TEST_DIGIT

 }

+/* Testing g_memdup2() function with various positive and negative cases */

+static void

+test_memdup2 (void)

+{

+  gchar *str_dup = NULL;

+  const gchar *str = "The quick brown fox jumps over the lazy dog";

+

+  /* Testing negative cases */

+  g_assert_null (g_memdup2 (NULL, 1024));

+  g_assert_null (g_memdup2 (str, 0));

+  g_assert_null (g_memdup2 (NULL, 0));

+

+  /* Testing normal usage cases */

+  str_dup = g_memdup2 (str, strlen (str) + 1);

+  g_assert_nonnull (str_dup);

+  g_assert_cmpstr (str, ==, str_dup);

+

+  g_free (str_dup);

+}

+

 static void

 test_strdup (void)

 {

@@ -1726,6 +1748,7 @@ main (int   argc,

   g_test_init (&argc, &argv, NULL);

   g_test_add_func ("/strfuncs/test-is-to-digit", test_is_to_digit);

+  g_test_add_func ("/strfuncs/memdup2", test_memdup2);

   g_test_add_func ("/strfuncs/strdup", test_strdup);

   g_test_add_func ("/strfuncs/strndup", test_strndup);

   g_test_add_func ("/strfuncs/strdup-printf", test_strdup_printf);

-- 

2.31.1

From d6aab169954d9e6e77753dee68e1b3f5932f6dee Mon Sep 17 00:00:00 2001

From: Philip Withnall <pwithnall@endlessos.org>

Date: Thu, 4 Feb 2021 13:41:21 +0000

Subject: [PATCH 2/6] glib: Use g_memdup2() instead of g_memdup() in obvious

 places

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Convert all the call sites which use `g_memdup()`’s length argument

trivially (for example, by passing a `sizeof()` or an existing `gsize`

variable), so that they use `g_memdup2()` instead.

In almost all of these cases the use of `g_memdup()` would not have

caused problems, but it will soon be deprecated, so best port away from

it

In particular, this fixes an overflow within `g_bytes_new()`, identified

as GHSL-2021-045 (aka CVE-2021-27219) by GHSL team member Kevin Backhouse.

Adapted for GLib 2.58 by Simon McVittie.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>

Fixes: CVE-2021-27219

Fixes: GHSL-2021-045

Helps: #2319

(cherry picked from commit 0736b7c1e7cf4232c5d7eb2b0fbfe9be81bd3baa)

[Backport to 2.58: Omit changes to ghash.c, will be a separate commit]

[Backport to 2.58: Omit changes to giochannel.c, not needed in this branch]

[Backport to 2.58: Omit changes to uri test, not needed in this branch]

Signed-off-by: Simon McVittie <smcv@collabora.com>

---

 glib/gbytes.c               | 6 ++++--

 glib/gdir.c                 | 3 ++-

 glib/gslice.c               | 3 ++-

 glib/gtestutils.c           | 3 ++-

 glib/gvariant.c             | 7 ++++---

 glib/gvarianttype.c         | 3 ++-

 glib/tests/array-test.c     | 2 +-

 glib/tests/option-context.c | 6 ++++--

 8 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/glib/gbytes.c b/glib/gbytes.c

index 3b14a51cd..5141170d7 100644

--- a/glib/gbytes.c

+++ b/glib/gbytes.c

@@ -33,6 +33,8 @@

 #include <string.h>

+#include "gstrfuncsprivate.h"

+

 /**

  * GBytes:

  *

@@ -94,7 +96,7 @@ g_bytes_new (gconstpointer data,

 {

   g_return_val_if_fail (data != NULL || size == 0, NULL);

-  return g_bytes_new_take (g_memdup (data, size), size);

+  return g_bytes_new_take (g_memdup2 (data, size), size);

 }

 /**

@@ -490,7 +492,7 @@ g_bytes_unref_to_data (GBytes *bytes,

        * Copy: Non g_malloc (or compatible) allocator, or static memory,

        * so we have to copy, and then unref.

        */

-      result = g_memdup (bytes->data, bytes->size);

+      result = g_memdup2 (bytes->data, bytes->size);

       *size = bytes->size;

       g_bytes_unref (bytes);

     }

diff --git a/glib/gdir.c b/glib/gdir.c

index cb4ad0b2f..9d955d57f 100644

--- a/glib/gdir.c

+++ b/glib/gdir.c

@@ -37,6 +37,7 @@

 #include "gconvert.h"

 #include "gfileutils.h"

 #include "gstrfuncs.h"

+#include "gstrfuncsprivate.h"

 #include "gtestutils.h"

 #include "glibintl.h"

@@ -113,7 +114,7 @@ g_dir_open_with_errno (const gchar *path,

     return NULL;

 #endif

-  return g_memdup (&dir, sizeof dir);

+  return g_memdup2 (&dir, sizeof dir);

 }

 /**

diff --git a/glib/gslice.c b/glib/gslice.c

index 454c8a602..8e2359515 100644

--- a/glib/gslice.c

+++ b/glib/gslice.c

@@ -45,6 +45,7 @@

 #include "gmain.h"

 #include "gmem.h"               /* gslice.h */

 #include "gstrfuncs.h"

+#include "gstrfuncsprivate.h"

 #include "gutils.h"

 #include "gtrashstack.h"

 #include "gtestutils.h"

@@ -352,7 +353,7 @@ g_slice_get_config_state (GSliceConfig ckey,

       array[i++] = allocator->contention_counters[address];

       array[i++] = allocator_get_magazine_threshold (allocator, address);

       *n_values = i;

-      return g_memdup (array, sizeof (array[0]) * *n_values);

+      return g_memdup2 (array, sizeof (array[0]) * *n_values);

     default:

       return NULL;

     }

diff --git a/glib/gtestutils.c b/glib/gtestutils.c

index 0447dcda5..14e071fce 100644

--- a/glib/gtestutils.c

+++ b/glib/gtestutils.c

@@ -49,6 +49,7 @@

 #include "gpattern.h"

 #include "grand.h"

 #include "gstrfuncs.h"

+#include "gstrfuncsprivate.h"

 #include "gtimer.h"

 #include "gslice.h"

 #include "gspawn.h"

@@ -3397,7 +3398,7 @@ g_test_log_extract (GTestLogBuffer *tbuffer)

       if (p <= tbuffer->data->str + mlength)

         {

           g_string_erase (tbuffer->data, 0, mlength);

-          tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup (&msg, sizeof (msg)));

+          tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup2 (&msg, sizeof (msg)));

           return TRUE;

         }

diff --git a/glib/gvariant.c b/glib/gvariant.c

index 8be9ce798..45a1a73dc 100644

--- a/glib/gvariant.c

+++ b/glib/gvariant.c

@@ -33,6 +33,7 @@

 #include <string.h>

+#include "gstrfuncsprivate.h"

 /**

  * SECTION:gvariant

@@ -720,7 +721,7 @@ g_variant_new_variant (GVariant *value)

   g_variant_ref_sink (value);

   return g_variant_new_from_children (G_VARIANT_TYPE_VARIANT,

-                                      g_memdup (&value, sizeof value),

+                                      g_memdup2 (&value, sizeof value),

                                       1, g_variant_is_trusted (value));

 }

@@ -1224,7 +1225,7 @@ g_variant_new_fixed_array (const GVariantType  *element_type,

       return NULL;

     }

-  data = g_memdup (elements, n_elements * element_size);

+  data = g_memdup2 (elements, n_elements * element_size);

   value = g_variant_new_from_data (array_type, data,

                                    n_elements * element_size,

                                    FALSE, g_free, data);

@@ -1901,7 +1902,7 @@ g_variant_dup_bytestring (GVariant *value,

   if (length)

     *length = size;

-  return g_memdup (original, size + 1);

+  return g_memdup2 (original, size + 1);

 }

 /**

diff --git a/glib/gvarianttype.c b/glib/gvarianttype.c

index c8433e65a..dbbf7d2d1 100644

--- a/glib/gvarianttype.c

+++ b/glib/gvarianttype.c

@@ -28,6 +28,7 @@

 #include <string.h>

+#include "gstrfuncsprivate.h"

 /**

  * SECTION:gvarianttype

@@ -1174,7 +1175,7 @@ g_variant_type_new_tuple (const GVariantType * const *items,

   g_assert (offset < sizeof buffer);

   buffer[offset++] = ')';

-  return (GVariantType *) g_memdup (buffer, offset);

+  return (GVariantType *) g_memdup2 (buffer, offset);

 }

 /**

-- 

2.31.1

From 7e2c2a07508a97b9d75e402afe4749b02a34dd8b Mon Sep 17 00:00:00 2001

From: Simon McVittie <smcv@collabora.com>

Date: Thu, 18 Mar 2021 10:31:00 +0000

Subject: [PATCH 3/6] ghash: Use g_memdup2() instead of g_memdup()

Backport of part of commit 0736b7c1e7cf4232c5d7eb2b0fbfe9be81bd3baa

to the simpler structure of the GHashTable code in glib-2-58.

Helps: #2319

Signed-off-by: Simon McVittie <smcv@collabora.com>

---

 glib/ghash.c | 3 ++-

 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/glib/ghash.c b/glib/ghash.c

index 6bb04a50d..608d136f4 100644

--- a/glib/ghash.c

+++ b/glib/ghash.c

@@ -34,6 +34,7 @@

 #include "glib-private.h"

 #include "gstrfuncs.h"

+#include "gstrfuncsprivate.h"

 #include "gatomic.h"

 #include "gtestutils.h"

 #include "gslice.h"

@@ -967,7 +968,7 @@ g_hash_table_insert_node (GHashTable *hash_table,

    * split the table.

    */

   if (G_UNLIKELY (hash_table->keys == hash_table->values && hash_table->keys[node_index] != new_value))

-    hash_table->values = g_memdup (hash_table->keys, sizeof (gpointer) * hash_table->size);

+    hash_table->values = g_memdup2 (hash_table->keys, sizeof (gpointer) * hash_table->size);

   /* Step 3: Actually do the write */

   hash_table->values[node_index] = new_value;

-- 

2.31.1

From 9e0c87610dccd1b0eaca28a3baa521ea6a24f46b Mon Sep 17 00:00:00 2001

From: Philip Withnall <pwithnall@endlessos.org>

Date: Thu, 4 Feb 2021 13:39:25 +0000

Subject: [PATCH 4/6] gobject: Use g_memdup2() instead of g_memdup() in obvious

 places

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Convert all the call sites which use `g_memdup()`’s length argument

trivially (for example, by passing a `sizeof()`), so that they use

`g_memdup2()` instead.

In almost all of these cases the use of `g_memdup()` would not have

caused problems, but it will soon be deprecated, so best port away from

it.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>

Helps: #2319

(cherry picked from commit 6110caea45b235420b98cd41d845cc92238f6781)

---

 gobject/gsignal.c     | 3 ++-

 gobject/gtype.c       | 9 +++++----

 gobject/gtypemodule.c | 3 ++-

 gobject/tests/param.c | 4 +++-

 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/gobject/gsignal.c b/gobject/gsignal.c

index b22dfcca8..92555eb60 100644

--- a/gobject/gsignal.c

+++ b/gobject/gsignal.c

@@ -28,6 +28,7 @@

 #include <signal.h>

 #include "gsignal.h"

+#include "gstrfuncsprivate.h"

 #include "gtype-private.h"

 #include "gbsearcharray.h"

 #include "gvaluecollector.h"

@@ -1724,7 +1725,7 @@ g_signal_newv (const gchar       *signal_name,

   node->single_va_closure_is_valid = FALSE;

   node->flags = signal_flags & G_SIGNAL_FLAGS_MASK;

   node->n_params = n_params;

-  node->param_types = g_memdup (param_types, sizeof (GType) * n_params);

+  node->param_types = g_memdup2 (param_types, sizeof (GType) * n_params);

   node->return_type = return_type;

   node->class_closure_bsa = NULL;

   if (accumulator)

diff --git a/gobject/gtype.c b/gobject/gtype.c

index 275a8b60b..9e663ce52 100644

--- a/gobject/gtype.c

+++ b/gobject/gtype.c

@@ -33,6 +33,7 @@

 #include "glib-private.h"

 #include "gconstructor.h"

+#include "gstrfuncsprivate.h"

 #ifdef G_OS_WIN32

 #include <windows.h>

@@ -1471,7 +1472,7 @@ type_add_interface_Wm (TypeNode             *node,

   iholder->next = iface_node_get_holders_L (iface);

   iface_node_set_holders_W (iface, iholder);

   iholder->instance_type = NODE_TYPE (node);

-  iholder->info = info ? g_memdup (info, sizeof (*info)) : NULL;

+  iholder->info = info ? g_memdup2 (info, sizeof (*info)) : NULL;

   iholder->plugin = plugin;

   /* create an iface entry for this type */

@@ -1732,7 +1733,7 @@ type_iface_retrieve_holder_info_Wm (TypeNode *iface,

         INVALID_RECURSION ("g_type_plugin_*", iholder->plugin, NODE_NAME (iface));

       check_interface_info_I (iface, instance_type, &tmp_info);

-      iholder->info = g_memdup (&tmp_info, sizeof (tmp_info));

+      iholder->info = g_memdup2 (&tmp_info, sizeof (tmp_info));

     }

   return iholder;	/* we don't modify write lock upon returning NULL */

@@ -2013,10 +2014,10 @@ type_iface_vtable_base_init_Wm (TypeNode *iface,

       IFaceEntry *pentry = type_lookup_iface_entry_L (pnode, iface);

       if (pentry)

-	vtable = g_memdup (pentry->vtable, iface->data->iface.vtable_size);

+	vtable = g_memdup2 (pentry->vtable, iface->data->iface.vtable_size);

     }

   if (!vtable)

-    vtable = g_memdup (iface->data->iface.dflt_vtable, iface->data->iface.vtable_size);

+    vtable = g_memdup2 (iface->data->iface.dflt_vtable, iface->data->iface.vtable_size);

   entry->vtable = vtable;

   vtable->g_type = NODE_TYPE (iface);

   vtable->g_instance_type = NODE_TYPE (node);

diff --git a/gobject/gtypemodule.c b/gobject/gtypemodule.c

index c67f789b1..cf877bc0b 100644

--- a/gobject/gtypemodule.c

+++ b/gobject/gtypemodule.c

@@ -19,6 +19,7 @@

 #include <stdlib.h>

+#include "gstrfuncsprivate.h"

 #include "gtypeplugin.h"

 #include "gtypemodule.h"

@@ -436,7 +437,7 @@ g_type_module_register_type (GTypeModule     *module,

   module_type_info->loaded = TRUE;

   module_type_info->info = *type_info;

   if (type_info->value_table)

-    module_type_info->info.value_table = g_memdup (type_info->value_table,

+    module_type_info->info.value_table = g_memdup2 (type_info->value_table,

 						   sizeof (GTypeValueTable));

   return module_type_info->type;

diff --git a/gobject/tests/param.c b/gobject/tests/param.c

index 758289bf8..971cff162 100644

--- a/gobject/tests/param.c

+++ b/gobject/tests/param.c

@@ -2,6 +2,8 @@

 #include <glib-object.h>

 #include <stdlib.h>

+#include "gstrfuncsprivate.h"

+

 static void

 test_param_value (void)

 {

@@ -851,7 +853,7 @@ main (int argc, char *argv[])

             test_path = g_strdup_printf ("/param/implement/subprocess/%d-%d-%d-%d",

                                          data.change_this_flag, data.change_this_type,

                                          data.use_this_flag, data.use_this_type);

-            test_data = g_memdup (&data, sizeof (TestParamImplementData));

+            test_data = g_memdup2 (&data, sizeof (TestParamImplementData));

             g_test_add_data_func_full (test_path, test_data, test_param_implement_child, g_free);

             g_free (test_path);

           }

-- 

2.31.1

From d3f7a79540fc1e85eb82c2987e9f7e2dbd93ff74 Mon Sep 17 00:00:00 2001

From: Philip Withnall <pwithnall@endlessos.org>

Date: Thu, 4 Feb 2021 13:37:56 +0000

Subject: [PATCH 5/6] gio: Use g_memdup2() instead of g_memdup() in obvious

 places

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Convert all the call sites which use `g_memdup()`’s length argument

trivially (for example, by passing a `sizeof()`), so that they use

`g_memdup2()` instead.

In almost all of these cases the use of `g_memdup()` would not have

caused problems, but it will soon be deprecated, so best port away from

it.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>

Helps: #2319

(cherry picked from commit be8834340a2d928ece82025463ae23dee2c333d0)

---

 gio/gdbusconnection.c                 | 5 +++--

 gio/gdbusinterfaceskeleton.c          | 3 ++-

 gio/gfile.c                           | 7 ++++---

 gio/gsettingsschema.c                 | 5 +++--

 gio/gwin32registrykey.c               | 8 +++++---

 gio/tests/async-close-output-stream.c | 6 ++++--

 gio/tests/gdbus-export.c              | 5 +++--

 gio/win32/gwinhttpfile.c              | 9 +++++----

 8 files changed, 29 insertions(+), 19 deletions(-)

diff --git a/gio/gdbusconnection.c b/gio/gdbusconnection.c

index 6f7e5fefc..117c8df35 100644

--- a/gio/gdbusconnection.c

+++ b/gio/gdbusconnection.c

@@ -119,6 +119,7 @@

 #include "gasyncinitable.h"

 #include "giostream.h"

 #include "gasyncresult.h"

+#include "gstrfuncsprivate.h"

 #include "gtask.h"

 #ifdef G_OS_UNIX

@@ -3970,7 +3971,7 @@ _g_dbus_interface_vtable_copy (const GDBusInterfaceVTable *vtable)

   /* Don't waste memory by copying padding - remember to update this

    * when changing struct _GDBusInterfaceVTable in gdbusconnection.h

    */

-  return g_memdup ((gconstpointer) vtable, 3 * sizeof (gpointer));

+  return g_memdup2 ((gconstpointer) vtable, 3 * sizeof (gpointer));

 }

 static void

@@ -3987,7 +3988,7 @@ _g_dbus_subtree_vtable_copy (const GDBusSubtreeVTable *vtable)

   /* Don't waste memory by copying padding - remember to update this

    * when changing struct _GDBusSubtreeVTable in gdbusconnection.h

    */

-  return g_memdup ((gconstpointer) vtable, 3 * sizeof (gpointer));

+  return g_memdup2 ((gconstpointer) vtable, 3 * sizeof (gpointer));

 }

 static void

diff --git a/gio/gdbusinterfaceskeleton.c b/gio/gdbusinterfaceskeleton.c

index 96bd520aa..672604c49 100644

--- a/gio/gdbusinterfaceskeleton.c

+++ b/gio/gdbusinterfaceskeleton.c

@@ -27,6 +27,7 @@

 #include "gdbusprivate.h"

 #include "gdbusmethodinvocation.h"

 #include "gdbusconnection.h"

+#include "gstrfuncsprivate.h"

 #include "gtask.h"

 #include "gioerror.h"

@@ -697,7 +698,7 @@ add_connection_locked (GDBusInterfaceSkeleton *interface_,

        * properly before building the hooked_vtable, so we create it

        * once at the last minute.

        */

-      interface_->priv->hooked_vtable = g_memdup (g_dbus_interface_skeleton_get_vtable (interface_), sizeof (GDBusInterfaceVTable));

+      interface_->priv->hooked_vtable = g_memdup2 (g_dbus_interface_skeleton_get_vtable (interface_), sizeof (GDBusInterfaceVTable));

       interface_->priv->hooked_vtable->method_call = skeleton_intercept_handle_method_call;

     }

diff --git a/gio/gfile.c b/gio/gfile.c

index ff313ebf8..29ebaaa62 100644

--- a/gio/gfile.c

+++ b/gio/gfile.c

@@ -60,6 +60,7 @@

 #include "gasyncresult.h"

 #include "gioerror.h"

 #include "glibintl.h"

+#include "gstrfuncsprivate.h"

 /**

@@ -7734,7 +7735,7 @@ measure_disk_usage_progress (gboolean reporting,

   g_main_context_invoke_full (g_task_get_context (task),

                               g_task_get_priority (task),

                               measure_disk_usage_invoke_progress,

-                              g_memdup (&progress, sizeof progress),

+                              g_memdup2 (&progress, sizeof progress),

                               g_free);

 }

@@ -7752,7 +7753,7 @@ measure_disk_usage_thread (GTask        *task,

                                  data->progress_callback ? measure_disk_usage_progress : NULL, task,

                                  &result.disk_usage, &result.num_dirs, &result.num_files,

                                  &error))

-    g_task_return_pointer (task, g_memdup (&result, sizeof result), g_free);

+    g_task_return_pointer (task, g_memdup2 (&result, sizeof result), g_free);

   else

     g_task_return_error (task, error);

 }

@@ -7776,7 +7777,7 @@ g_file_real_measure_disk_usage_async (GFile                        *file,

   task = g_task_new (file, cancellable, callback, user_data);

   g_task_set_source_tag (task, g_file_real_measure_disk_usage_async);

-  g_task_set_task_data (task, g_memdup (&data, sizeof data), g_free);

+  g_task_set_task_data (task, g_memdup2 (&data, sizeof data), g_free);

   g_task_set_priority (task, io_priority);

   g_task_run_in_thread (task, measure_disk_usage_thread);

diff --git a/gio/gsettingsschema.c b/gio/gsettingsschema.c

index 17b7e3b01..499944395 100644

--- a/gio/gsettingsschema.c

+++ b/gio/gsettingsschema.c

@@ -20,6 +20,7 @@

 #include "gsettingsschema-internal.h"

 #include "gsettings.h"

+#include "gstrfuncsprivate.h"

 #include "gvdb/gvdb-reader.h"

 #include "strinfo.c"

@@ -1054,9 +1055,9 @@ g_settings_schema_list_children (GSettingsSchema *schema)

       if (g_str_has_suffix (key, "/"))

         {

-          gint length = strlen (key);

+          gsize length = strlen (key);

-          strv[j] = g_memdup (key, length);

+          strv[j] = g_memdup2 (key, length);

           strv[j][length - 1] = '\0';

           j++;

         }

diff --git a/gio/gwin32registrykey.c b/gio/gwin32registrykey.c

index c19fede4e..619fd48af 100644

--- a/gio/gwin32registrykey.c

+++ b/gio/gwin32registrykey.c

@@ -28,6 +28,8 @@

 #include <ntstatus.h>

 #include <winternl.h>

+#include "gstrfuncsprivate.h"

+

 #ifndef _WDMDDK_

 typedef enum _KEY_INFORMATION_CLASS {

   KeyBasicInformation,

@@ -247,7 +249,7 @@ g_win32_registry_value_iter_copy (const GWin32RegistryValueIter *iter)

   new_iter->value_name_size = iter->value_name_size;

   if (iter->value_data != NULL)

-    new_iter->value_data = g_memdup (iter->value_data, iter->value_data_size);

+    new_iter->value_data = g_memdup2 (iter->value_data, iter->value_data_size);

   new_iter->value_data_size = iter->value_data_size;

@@ -268,8 +270,8 @@ g_win32_registry_value_iter_copy (const GWin32RegistryValueIter *iter)

   new_iter->value_data_expanded_charsize = iter->value_data_expanded_charsize;