[ Reason ]
CVE-2025-4373 (#1104930).
I also took the opportunity to catch up with the upstream glib-2-84
branch by adding one unrelated bugfix commit (a 1-line change).
[ Impact ]
Fixes an out-of-bounds write if an attacker can somehow arrange for GLib
to be acting on overwhelmingly large strings (half the address space in
a single GString object, so 2GB for 32-bit processes).
Ensures that localtime_r() is not called without first calling tzset(),
which has unspecified behaviour.
[ Tests ]
Not yet tested. I will run autopkgtests and boot a GNOME system with the
proposed GLib before upload, and inform this bug if further changes are
needed.