RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
pango should be rebuilt against new glib2 package version (>= glib2-2.22.5-2.el6) that have g_new version with guards against integer overflows.

This is needed for:
  https://bugzilla.redhat.com/show_bug.cgi?id=554416#c7

Protections to g_new were added via:
  https://bugzilla.redhat.com/show_bug.cgi?id=573966

Additional info:
Rebuild should address existing blocker bug #573883 too.

Reproducer:
 - check dependency tree (see description).

Giving qa_ack.

Built pango-1.28.1-1.el6.

# rpm -qpR pango-1.28.1-1.el6.x86_64.rpm | grep glib2
glib2 >= 2.17.3-1

Shouldn't be this switched for glib2 >= 2.22 or so?

My system have glib2-2.22.5-3.el6, new pango is successfully installable and works fine.

Is this sufficient reproducer? If yes we could move to verified.

please update glib dependency to >=glib2-2.22.5-2.el6 as (according to bug 573966) the wanted behaviour was added into that version.

There will be no older glib2 than that in RHEL6. So, while it may be more correct to bump it, it is not as if that would prevent anything bad from happening.

closing this as not a bug see previous comments. reopen if you think we should do anything more about it

I'd say resolution is not correct, as requested rebuild was done.

the require from pango-1.28.1-3.el6 is glib2 >= 2.17.3-1 not 2.22 so it wasn't fixed as expected