Sync from SUSE:SLFO:1.1 libsoup2 revision b7e03545979d2003799f63066cdf8212

2025-04-15 21:29:45 +02:00
24 changed files with 7 additions and 1655 deletions
--- a/04df03bc.patch
+++ b/04df03bc.patch
@@ -1,145 +0,0 @@
-From 04df03bc092ac20607f3e150936624d4f536e68b Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Mon, 8 Jul 2024 12:33:15 -0500
-Subject: [PATCH] headers: Strictly don't allow NUL bytes
-
-In the past (2015) this was allowed for some problematic sites. However Chromium also does not allow NUL bytes in either header names or values these days. So this should no longer be a problem.
---
- libsoup/soup-headers.c      | 15 +++------
- tests/header-parsing-test.c | 62 +++++++++++++++++--------------------
- 2 files changed, 32 insertions(+), 45 deletions(-)
-
-diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index a0cf351ac..f30ee467a 100644
--- a/libsoup/soup-headers.c
-+++ b/libsoup/soup-headers.c
-@@ -51,13 +51,14 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest)
- 	 * ignorable trailing whitespace.
- 	 */
- 
-+	/* No '\0's are allowed */
-+	if (memchr (str, '\0', len))
-+		return FALSE;
-+
- 	/* Skip over the Request-Line / Status-Line */
- 	headers_start = memchr (str, '\n', len);
- 	if (!headers_start)
- 		return FALSE;
-	/* No '\0's in the Request-Line / Status-Line */
-	if (memchr (str, '\0', headers_start - str))
-		return FALSE;
- 
- 	/* We work on a copy of the headers, which we can write '\0's
- 	 * into, so that we don't have to individually g_strndup and
-@@ -69,14 +70,6 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest)
- 	headers_copy[copy_len] = '\0';
- 	value_end = headers_copy;
- 
-	/* There shouldn't be any '\0's in the headers already, but
-	 * this is the web we're talking about.
-	 */
-	while ((p = memchr (headers_copy, '\0', copy_len))) {
-		memmove (p, p + 1, copy_len - (p - headers_copy));
-		copy_len--;
-	}
-
- 	while (*(value_end + 1)) {
- 		name = value_end + 1;
- 		name_end = strchr (name, ':');
-diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
-index edf8eebb3..715c2c6f2 100644
--- a/tests/header-parsing-test.c
-+++ b/tests/header-parsing-test.c
-@@ -358,24 +358,6 @@ static struct RequestTest {
- 	  }
- 	},
- 
-	{ "NUL in header name", "760832",
-	  "GET / HTTP/1.1\r\nHost\x00: example.com\r\n", 36,
-	  SOUP_STATUS_OK,
-	  "GET", "/", SOUP_HTTP_1_1,
-	  { { "Host", "example.com" },
-	    { NULL }
-	  }
-	},
-
-	{ "NUL in header value", "760832",
-	  "GET / HTTP/1.1\r\nHost: example\x00" "com\r\n", 35,
-	  SOUP_STATUS_OK,
-	  "GET", "/", SOUP_HTTP_1_1,
-	  { { "Host", "examplecom" },
-	    { NULL }
-	  }
-	},
-
- 	/************************/
- 	/*** INVALID REQUESTS ***/
- 	/************************/
-@@ -448,6 +430,21 @@ static struct RequestTest {
- 	  SOUP_STATUS_EXPECTATION_FAILED,
- 	  NULL, NULL, -1,
- 	  { { NULL } }
-+	},
-+
-+	// https://gitlab.gnome.org/GNOME/libsoup/-/issues/377
-+	{ "NUL in header name", NULL,
-+	  "GET / HTTP/1.1\r\nHost\x00: example.com\r\n", 36,
-+	  SOUP_STATUS_BAD_REQUEST,
-+	  NULL, NULL, -1,
-+	  { { NULL } }
-+	},
-+
-+	{ "NUL in header value", NULL,
-+	  "HTTP/1.1 200 OK\r\nFoo: b\x00" "ar\r\n", 28,
-+	  SOUP_STATUS_BAD_REQUEST,
-+           NULL, NULL, -1,
-+	  { { NULL } }
- 	}
- };
- static const int num_reqtests = G_N_ELEMENTS (reqtests);
-@@ -620,22 +617,6 @@ static struct ResponseTest {
- 	    { NULL } }
- 	},
- 
-	{ "NUL in header name", "760832",
-	  "HTTP/1.1 200 OK\r\nF\x00oo: bar\r\n", 28,
-	  SOUP_HTTP_1_1, SOUP_STATUS_OK, "OK",
-	  { { "Foo", "bar" },
-	    { NULL }
-	  }
-	},
-
-	{ "NUL in header value", "760832",
-	  "HTTP/1.1 200 OK\r\nFoo: b\x00" "ar\r\n", 28,
-	  SOUP_HTTP_1_1, SOUP_STATUS_OK, "OK",
-	  { { "Foo", "bar" },
-	    { NULL }
-	  }
-	},
-
- 	/********************************/
- 	/*** VALID CONTINUE RESPONSES ***/
- 	/********************************/
-@@ -768,6 +749,19 @@ static struct ResponseTest {
- 	  { { NULL }
- 	  }
- 	},
-+
-+	// https://gitlab.gnome.org/GNOME/libsoup/-/issues/377
-+	{ "NUL in header name", NULL,
-+	  "HTTP/1.1 200 OK\r\nF\x00oo: bar\r\n", 28,
-+	  -1, 0, NULL,
-+	  { { NULL } }
-+	},
-+
-+	{ "NUL in header value", "760832",
-+	  "HTTP/1.1 200 OK\r\nFoo: b\x00" "ar\r\n", 28,
-+	  -1, 0, NULL,
-+	  { { NULL } }
-+	},
- };
- static const int num_resptests = G_N_ELEMENTS (resptests);
- 
-- 
-GitLab
-
--- a/19124679.patch
+++ b/19124679.patch
@@ -1,26 +0,0 @@
-From 1912467968aabbf76287e639aa254751b00c0a2a Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Mon, 28 Oct 2024 12:29:48 -0500
-Subject: [PATCH] Fix using int instead of size_t for strcspn return
-
-CVE-2025-32050
---
- libsoup/soup-headers.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index 2d287fc2..cc481cfa 100644
--- a/libsoup/soup-headers.c
-+++ b/libsoup/soup-headers.c
-@@ -905,7 +905,7 @@ append_param_quoted (GString    *string,
- 		     const char *name,
- 		     const char *value)
- {
-	int len;
-+	gsize len;
- 
- 	g_string_append (string, name);
- 	g_string_append (string, "=\"");
-- 
-GitLab
-
--- a/29b96fab.patch
+++ b/29b96fab.patch
@@ -1,38 +0,0 @@
-From 29b96fab2512666d7241e46c98cc45b60b795c0c Mon Sep 17 00:00:00 2001
-From: Ignacio Casal Quinteiro <qignacio@amazon.com>
-Date: Wed, 2 Oct 2024 11:17:19 +0200
-Subject: [PATCH] websocket-test: disconnect error copy after the test ends
-
-Otherwise the server will have already sent a few more wrong
-bytes and the client will continue getting errors to copy
-but the error is already != NULL and it will assert
---
- tests/websocket-test.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/tests/websocket-test.c b/tests/websocket-test.c
-index 06c443bb5..6a48c1f9b 100644
--- a/tests/websocket-test.c
-+++ b/tests/websocket-test.c
-@@ -1539,8 +1539,9 @@ test_receive_invalid_encode_length_64 (Test *test,
- 	GError *error = NULL;
- 	InvalidEncodeLengthTest context = { test, NULL };
- 	guint i;
-+	guint error_id;
- 
-	g_signal_connect (test->client, "error", G_CALLBACK (on_error_copy), &error);
-+	error_id = g_signal_connect (test->client, "error", G_CALLBACK (on_error_copy), &error);
- 	g_signal_connect (test->client, "message", G_CALLBACK (on_binary_message), &received);
- 
- 	/* We use 127(\x7f) as payload length with 65535 extended length */
-@@ -1553,6 +1554,7 @@ test_receive_invalid_encode_length_64 (Test *test,
- 	WAIT_UNTIL (error != NULL || received != NULL);
- 	g_assert_error (error, SOUP_WEBSOCKET_ERROR, SOUP_WEBSOCKET_CLOSE_PROTOCOL_ERROR);
- 	g_clear_error (&error);
-+        g_signal_handler_disconnect (test->client, error_id);
- 	g_assert_null (received);
- 
-         g_thread_join (thread);
-- 
-GitLab
-
--- a/4c9e75c6.patch
+++ b/4c9e75c6.patch
@@ -1,42 +0,0 @@
-From 4c9e75c6676a37b6485620c332e568e1a3f530ff Mon Sep 17 00:00:00 2001
-From: Simon McVittie <smcv@debian.org>
-Date: Wed, 13 Nov 2024 14:14:23 +0000
-Subject: [PATCH] websocket-test: Disconnect error signal in another place
-
-This is the same change as commit 29b96fab "websocket-test: disconnect
-error copy after the test ends", and is done for the same reason, but
-replicating it into a different function.
-
-Fixes: 6adc0e3e "websocket: process the frame as soon as we read data"
-Resolves: https://gitlab.gnome.org/GNOME/libsoup/-/issues/399
-Signed-off-by: Simon McVittie <smcv@debian.org>
---
- tests/websocket-test.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/tests/websocket-test.c b/tests/websocket-test.c
-index 6a48c1f9..723f2857 100644
--- a/tests/websocket-test.c
-+++ b/tests/websocket-test.c
-@@ -1508,8 +1508,9 @@ test_receive_invalid_encode_length_16 (Test *test,
- 	GError *error = NULL;
- 	InvalidEncodeLengthTest context = { test, NULL };
- 	guint i;
-+	guint error_id;
- 
-	g_signal_connect (test->client, "error", G_CALLBACK (on_error_copy), &error);
-+	error_id = g_signal_connect (test->client, "error", G_CALLBACK (on_error_copy), &error);
- 	g_signal_connect (test->client, "message", G_CALLBACK (on_binary_message), &received);
- 
- 	/* We use 126(~) as payload length with 125 extended length */
-@@ -1522,6 +1523,7 @@ test_receive_invalid_encode_length_16 (Test *test,
- 	WAIT_UNTIL (error != NULL || received != NULL);
- 	g_assert_error (error, SOUP_WEBSOCKET_ERROR, SOUP_WEBSOCKET_CLOSE_PROTOCOL_ERROR);
- 	g_clear_error (&error);
-+        g_signal_handler_disconnect (test->client, error_id);
- 	g_assert_null (received);
- 
- 	g_thread_join (thread);
-- 
-GitLab
-
--- a/5739a090.patch
+++ b/5739a090.patch
@@ -1,36 +0,0 @@
-From 5739a090529209c2afc13f482256573bcd9ce940 Mon Sep 17 00:00:00 2001
-From: Ar Jun <pkillarjun@protonmail.com>
-Date: Mon, 18 Nov 2024 14:59:51 -0600
-Subject: [PATCH] Fix heap buffer overflow in
- soup-content-sniffer.c:sniff_feed_or_html()
-
-CVE-2025-32053
---
- libsoup/soup-content-sniffer.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
-index 744f48a0..3fb29adf 100644
--- a/libsoup/soup-content-sniffer.c
-+++ b/libsoup/soup-content-sniffer.c
-@@ -623,7 +623,7 @@ skip_insignificant_space (const char *resource, gsize *pos, gsize resource_lengt
- 	       (resource[*pos] == '\x0D')) {
- 		*pos = *pos + 1;
- 
-		if (*pos > resource_length)
-+		if (*pos >= resource_length)
- 			return TRUE;
- 	}
- 
-@@ -682,7 +682,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, SoupBuffer *buffer)
- 		do {
- 			pos++;
- 
-			if (pos > resource_length)
-+			if ((pos + 1) > resource_length)
- 				goto text_html;
- 		} while (resource[pos] != '>');
- 
-- 
-GitLab
-
--- a/96c22b67.patch
+++ b/96c22b67.patch
@@ -1,138 +0,0 @@
-From 96c22b67345d3ab9cc431e551ec6aef767212af5 Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Tue, 18 Feb 2025 14:29:50 -0600
-Subject: [PATCH] sniffer: Add better coverage of skip_insignificant_space()
-
-CVE-2025-2784
---
- libsoup/soup-content-sniffer.c | 10 +++----
- tests/sniffing-test.c          | 53 ++++++++++++++++++++++++++++++----
- tests/soup-tests.gresource.xml |  1 -
- 3 files changed, 53 insertions(+), 11 deletions(-)
-
-diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
-index 4c8134a7f..7669c6385 100644
--- a/libsoup/soup-content-sniffer.c
-+++ b/libsoup/soup-content-sniffer.c
-@@ -612,8 +612,11 @@ sniff_text_or_binary (SoupContentSniffer *sniffer, SoupBuffer *buffer)
- }
- 
- static gboolean
-skip_insignificant_space (const char *resource, int *pos, int resource_length)
-+skip_insignificant_space (const char *resource, gsize *pos, gsize resource_length)
- {
-+        if (*pos >= resource_length)
-+	        return TRUE;
-+
- 	while ((resource[*pos] == '\x09') ||
- 	       (resource[*pos] == '\x20') ||
- 	       (resource[*pos] == '\x0A') ||
-@@ -632,7 +635,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, SoupBuffer *buffer)
- {
- 	const char *resource = (const char *)buffer->data;
- 	int resource_length = MIN (512, buffer->length);
-	int pos = 0;
-+	gsize pos = 0;
- 
- 	if (resource_length < 3)
- 		goto text_html;
-@@ -642,9 +645,6 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, SoupBuffer *buffer)
- 		pos = 3;
- 
-  look_for_tag:
-	if (pos >= resource_length)
-		goto text_html;
-
- 	if (skip_insignificant_space (resource, &pos, resource_length))
- 		goto text_html;
- 
-diff --git a/tests/sniffing-test.c b/tests/sniffing-test.c
-index 0a4569a43..372b659e1 100644
--- a/tests/sniffing-test.c
-+++ b/tests/sniffing-test.c
-@@ -436,6 +436,52 @@ test_disabled (gconstpointer data)
- 	soup_uri_free (uri);
- }
- 
-+static const gsize MARKUP_LENGTH = strlen ("<!--") + strlen ("-->");
-+
-+static void
-+do_skip_whitespace_test (void)
-+{
-+        SoupContentSniffer *sniffer = soup_content_sniffer_new ();
-+        SoupMessage *msg = soup_message_new (SOUP_METHOD_GET, "http://example.org");
-+        const char *test_cases[] = {
-+                "",
-+                "<rdf:RDF",
-+                "<rdf:RDFxmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"",
-+                "<rdf:RDFxmlns=\"http://purl.org/rss/1.0/\"",
-+        };
-+
-+        soup_message_headers_set_content_type (msg->response_headers, "text/html", NULL);
-+
-+        for (guint i = 0; i < G_N_ELEMENTS (test_cases); i++) {
-+                const char *trailing_data = test_cases[i];
-+                gsize leading_zeros = 512 - MARKUP_LENGTH - strlen (trailing_data);
-+                gsize testsize = MARKUP_LENGTH + leading_zeros + strlen (trailing_data);
-+                guint8 *data = g_malloc0 (testsize);
-+                guint8 *p = data;
-+                char *content_type;
-+                GBytes *buffer;
-+
-+                // Format of <!--[0x00 * $leading_zeros]-->$trailing_data
-+                memcpy (p, "<!--", strlen ("<!--"));
-+                p += strlen ("<!--");
-+                p += leading_zeros;
-+                memcpy (p, "-->", strlen ("-->"));
-+                p += strlen ("-->");
-+                if (strlen (trailing_data))
-+                        memcpy (p, trailing_data, strlen (trailing_data));
-+                // Purposefully not NUL terminated.                
-+
-+                buffer = g_bytes_new_take (g_steal_pointer (&data), testsize);
-+                content_type = soup_content_sniffer_sniff (sniffer, msg, (SoupBuffer *) buffer, NULL);
-+
-+                g_free (content_type);
-+                g_bytes_unref (buffer);
-+        }
-+
-+        g_object_unref (msg);
-+        g_object_unref (sniffer);
-+}
-+
- int
- main (int argc, char **argv)
- {
-@@ -605,16 +651,13 @@ main (int argc, char **argv)
- 			      "type/text_html; charset=UTF-8/test.html => text/html; charset=UTF-8",
- 			      do_sniffing_test);
- 
-        /* Test hitting skip_insignificant_space() with number of bytes equaling resource_length. */
-	g_test_add_data_func ("/sniffing/whitespace",
-			      "type/text_html/whitespace.html => text/html",
-			      do_sniffing_test);
-
- 	/* Test that disabling the sniffer works correctly */
- 	g_test_add_data_func ("/sniffing/disabled",
- 			      "/text_or_binary/home.gif",
- 			      test_disabled);
- 
-+	g_test_add_func ("/sniffing/whitespace", do_skip_whitespace_test);
-+
- 	ret = g_test_run ();
- 
- 	soup_uri_free (base_uri);
-diff --git a/tests/soup-tests.gresource.xml b/tests/soup-tests.gresource.xml
-index cbef1d402..9c08d170e 100644
--- a/tests/soup-tests.gresource.xml
-+++ b/tests/soup-tests.gresource.xml
-@@ -25,6 +25,5 @@
-     <file>resources/text.txt</file>
-     <file>resources/text_binary.txt</file>
-     <file>resources/tux.webp</file>
-    <file>resources/whitespace.html</file>
-   </gresource>
- </gresources>
-- 
-GitLab
-
--- a/a35222dd.patch
+++ b/a35222dd.patch
@@ -1,129 +0,0 @@
-From a35222dd0bfab2ac97c10e86b95f762456628283 Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Tue, 27 Aug 2024 13:53:26 -0500
-Subject: [PATCH] headers: Be more robust against invalid input when parsing
- params
-
-If you pass invalid input to a function such as soup_header_parse_param_list_strict()
-it can cause an overflow if it decodes the input to UTF-8.
-
-This should never happen with valid UTF-8 input which libsoup's client API
-ensures, however it's server API does not currently.
---
- libsoup/soup-headers.c | 46 ++++++++++++++++++++++--------------------
- 1 file changed, 24 insertions(+), 22 deletions(-)
-
-diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index f30ee467..613e1905 100644
--- a/libsoup/soup-headers.c
-+++ b/libsoup/soup-headers.c
-@@ -646,8 +646,9 @@ soup_header_contains (const char *header, const char *token)
- }
- 
- static void
-decode_quoted_string (char *quoted_string)
-+decode_quoted_string_inplace (GString *quoted_gstring)
- {
-+	char *quoted_string = quoted_gstring->str;
- 	char *src, *dst;
- 
- 	src = quoted_string + 1;
-@@ -661,10 +662,11 @@ decode_quoted_string (char *quoted_string)
- }
- 
- static gboolean
-decode_rfc5987 (char *encoded_string)
-+decode_rfc5987_inplace (GString *encoded_gstring)
- {
- 	char *q, *decoded;
- 	gboolean iso_8859_1 = FALSE;
-+	const char *encoded_string = encoded_gstring->str;
- 
- 	q = strchr (encoded_string, '\'');
- 	if (!q)
-@@ -696,14 +698,7 @@ decode_rfc5987 (char *encoded_string)
- 		decoded = utf8;
- 	}
- 
-	/* If encoded_string was UTF-8, then each 3-character %-escape
-	 * will be converted to a single byte, and so decoded is
-	 * shorter than encoded_string. If encoded_string was
-	 * iso-8859-1, then each 3-character %-escape will be
-	 * converted into at most 2 bytes in UTF-8, and so it's still
-	 * shorter.
-	 */
-	strcpy (encoded_string, decoded);
-+	g_string_assign (encoded_gstring, decoded);
- 	g_free (decoded);
- 	return TRUE;
- }
-@@ -713,15 +708,17 @@ parse_param_list (const char *header, char delim, gboolean strict)
- {
- 	GHashTable *params;
- 	GSList *list, *iter;
-	char *item, *eq, *name_end, *value;
-	gboolean override, duplicated;
- 
- 	params = g_hash_table_new_full (soup_str_case_hash, 
- 					soup_str_case_equal,
-					g_free, NULL);
-+					g_free, g_free);
- 
- 	list = parse_list (header, delim);
- 	for (iter = list; iter; iter = iter->next) {
-+		char *item, *eq, *name_end;
-+		gboolean override, duplicated;
-+		GString *parsed_value = NULL;
-+
- 		item = iter->data;
- 		override = FALSE;
- 
-@@ -736,19 +733,19 @@ parse_param_list (const char *header, char delim, gboolean strict)
- 
- 			*name_end = '\0';
- 
-			value = (char *)skip_lws (eq + 1);
-+			parsed_value = g_string_new ((char *)skip_lws (eq + 1));
- 
- 			if (name_end[-1] == '*' && name_end > item + 1) {
- 				name_end[-1] = '\0';
-				if (!decode_rfc5987 (value)) {
-+				if (!decode_rfc5987_inplace (parsed_value)) {
-+					g_string_free (parsed_value, TRUE);
- 					g_free (item);
- 					continue;
- 				}
- 				override = TRUE;
-			} else if (*value == '"')
-				decode_quoted_string (value);
-		} else
-			value = NULL;
-+			} else if (parsed_value->str[0] == '"')
-+				decode_quoted_string_inplace (parsed_value);
-+		}
- 
- 		duplicated = g_hash_table_lookup_extended (params, item, NULL, NULL);
- 
-@@ -756,11 +753,16 @@ parse_param_list (const char *header, char delim, gboolean strict)
- 			soup_header_free_param_list (params);
- 			params = NULL;
- 			g_slist_foreach (iter, (GFunc)g_free, NULL);
-+			if (parsed_value)
-+				g_string_free (parsed_value, TRUE);
- 			break;
-		} else if (override || !duplicated)
-			g_hash_table_replace (params, item, value);
-		else
-+		} else if (override || !duplicated) {
-+			g_hash_table_replace (params, item, parsed_value ? g_string_free (parsed_value, FALSE) : NULL);
-+		} else {
-+			if (parsed_value)
-+				g_string_free (parsed_value, TRUE);
- 			g_free (item);
-+		}
- 	}
- 
- 	g_slist_free (list);
-- 
-GitLab
-
--- a/a5b86bfc.patch
+++ b/a5b86bfc.patch
@@ -1,28 +0,0 @@
-From a5b86bfc9405e01f12a975ae6898b1ce6a870e11 Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Sat, 16 Nov 2024 12:07:30 -0600
-Subject: [PATCH] Fix heap buffer overflow in soup_content_sniffer_sniff
-
-Co-Author: Ar Jun <pkillarjun@protonmail.com>
-
-CVE-2025-32052
---
- libsoup/soup-content-sniffer.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
-index 7669c638..744f48a0 100644
--- a/libsoup/soup-content-sniffer.c
-+++ b/libsoup/soup-content-sniffer.c
-@@ -504,7 +504,7 @@ sniff_unknown (SoupContentSniffer *sniffer, SoupBuffer *buffer,
- 			guint index_pattern = 0;
- 			gboolean skip_row = FALSE;
- 
-			while ((index_stream < resource_length) &&
-+			while ((index_stream < resource_length - 1) &&
- 			       (index_pattern <= type_row->pattern_length)) {
- 				/* Skip insignificant white space ("WS" in the spec) */
- 				if (type_row->pattern[index_pattern] == ' ') {
-- 
-GitLab
-
--- a/c9083869.patch
+++ b/c9083869.patch
@@ -1,56 +0,0 @@
-From c9083869ec2a3037e6df4bd86b45c419ba295f8e Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Thu, 26 Dec 2024 18:31:42 -0600
-Subject: [PATCH] soup_header_parse_quality_list: Fix leak
-
-When iterating over the parsed list we now steal the allocated strings that we want and then free_full the list which may contain remaining strings.
---
- libsoup/soup-headers.c | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index a5f7a7f6..85385cea 100644
--- a/libsoup/soup-headers.c
-+++ b/libsoup/soup-headers.c
-@@ -530,7 +530,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
- 	GSList *unsorted;
- 	QualityItem *array;
- 	GSList *sorted, *iter;
-	char *item, *semi;
-+	char *semi;
- 	const char *param, *equal, *value;
- 	double qval;
- 	int n;
-@@ -543,9 +543,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
- 	unsorted = soup_header_parse_list (header);
- 	array = g_new0 (QualityItem, g_slist_length (unsorted));
- 	for (iter = unsorted, n = 0; iter; iter = iter->next) {
-		item = iter->data;
- 		qval = 1.0;
-		for (semi = strchr (item, ';'); semi; semi = strchr (semi + 1, ';')) {
-+		for (semi = strchr (iter->data, ';'); semi; semi = strchr (semi + 1, ';')) {
- 			param = skip_lws (semi + 1);
- 			if (*param != 'q')
- 				continue;
-@@ -577,15 +576,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
- 		if (qval == 0.0) {
- 			if (unacceptable) {
- 				*unacceptable = g_slist_prepend (*unacceptable,
-								 item);
-+								 g_steal_pointer (&iter->data));
- 			}
- 		} else {
-			array[n].item = item;
-+			array[n].item = g_steal_pointer (&iter->data);
- 			array[n].qval = qval;
- 			n++;
- 		}
- 	}
-	g_slist_free (unsorted);
-+	g_slist_free_full (unsorted, g_free);
- 
- 	qsort (array, n, sizeof (QualityItem), sort_by_qval);
- 	sorted = NULL;
-- 
-GitLab
-
--- a/ef6c4bf6.patch
+++ b/ef6c4bf6.patch
@@ -1,55 +0,0 @@
-From ef6c4bf664d22fae0b9a96b6f4778bb4b24d1aca Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Wed, 5 Feb 2025 14:39:42 -0600
-Subject: [PATCH] sniffer: Fix potential overflow
-
-CVE-2025-2784
---
- libsoup/soup-content-sniffer.c | 2 +-
- tests/sniffing-test.c          | 5 +++++
- tests/soup-tests.gresource.xml | 1 +
- 3 files changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
-index 967ec6141..4c8134a7f 100644
--- a/libsoup/soup-content-sniffer.c
-+++ b/libsoup/soup-content-sniffer.c
-@@ -642,7 +642,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, SoupBuffer *buffer)
- 		pos = 3;
- 
-  look_for_tag:
-	if (pos > resource_length)
-+	if (pos >= resource_length)
- 		goto text_html;
- 
- 	if (skip_insignificant_space (resource, &pos, resource_length))
-diff --git a/tests/sniffing-test.c b/tests/sniffing-test.c
-index d2aa86b9d..0a4569a43 100644
--- a/tests/sniffing-test.c
-+++ b/tests/sniffing-test.c
-@@ -605,6 +605,11 @@ main (int argc, char **argv)
- 			      "type/text_html; charset=UTF-8/test.html => text/html; charset=UTF-8",
- 			      do_sniffing_test);
- 
-+        /* Test hitting skip_insignificant_space() with number of bytes equaling resource_length. */
-+	g_test_add_data_func ("/sniffing/whitespace",
-+			      "type/text_html/whitespace.html => text/html",
-+			      do_sniffing_test);
-+
- 	/* Test that disabling the sniffer works correctly */
- 	g_test_add_data_func ("/sniffing/disabled",
- 			      "/text_or_binary/home.gif",
-diff --git a/tests/soup-tests.gresource.xml b/tests/soup-tests.gresource.xml
-index 9c08d170e..cbef1d402 100644
--- a/tests/soup-tests.gresource.xml
-+++ b/tests/soup-tests.gresource.xml
-@@ -25,5 +25,6 @@
-     <file>resources/text.txt</file>
-     <file>resources/text_binary.txt</file>
-     <file>resources/tux.webp</file>
-+    <file>resources/whitespace.html</file>
-   </gresource>
- </gresources>
-- 
-GitLab
-
--- a/libsoup-CVE-2024-52532.patch
+++ b/libsoup-CVE-2024-52532.patch
@@ -1,34 +0,0 @@
-From f84fc43fe62e25ca807975fa758f2e3d7737db4f Mon Sep 17 00:00:00 2001
-From: Mike Gorse <mgorse@suse.com>
-Date: Tue, 12 Nov 2024 17:20:25 -0600
-Subject: [PATCH] websocket: process the frame as soon as we read data
-
-Otherwise we can enter in a read loop because we were not
-validating the data until the all the data was read.
-
-Fixes #391
-
-Backport of https://gitlab.gnome.org/GNOME/libsoup/-/commit/6adc0e3e.patch
---
- libsoup/soup-websocket-connection.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/libsoup/soup-websocket-connection.c b/libsoup/soup-websocket-connection.c
-index 6d136d41..2db34d3c 100644
--- a/libsoup/soup-websocket-connection.c
-+++ b/libsoup/soup-websocket-connection.c
-@@ -1155,9 +1155,9 @@ soup_websocket_connection_read (SoupWebsocketConnection *self)
- 		}
- 
- 		pv->incoming->len = len + count;
-	} while (count > 0);
- 
-	process_incoming (self);
-+		process_incoming (self);
-+	} while (count > 0 && !pv->close_sent && !pv->io_closing);
- 
- 	if (end) {
- 		if (!pv->close_sent || !pv->close_received) {
-- 
-2.47.0
-
--- a/libsoup-CVE-2025-32906.patch
+++ b/libsoup-CVE-2025-32906.patch
@@ -1,134 +0,0 @@
-From 1f509f31b6f8420a3661c3f990424ab7b9164931 Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Tue, 11 Feb 2025 14:36:26 -0600
-Subject: [PATCH] headers: Handle parsing edge case
-
-This version number is specifically crafted to pass sanity checks allowing it to go one byte out of bounds.
---
- libsoup/soup-headers.c      |  2 +-
- tests/header-parsing-test.c | 12 ++++++++++++
- 2 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index 85385cea..9d6d00a3 100644
--- a/libsoup/soup-headers.c
-+++ b/libsoup/soup-headers.c
-@@ -225,7 +225,7 @@ soup_headers_parse_request (const char          *str,
- 	    !g_ascii_isdigit (version[5]))
- 		return SOUP_STATUS_BAD_REQUEST;
- 	major_version = strtoul (version + 5, &p, 10);
-	if (*p != '.' || !g_ascii_isdigit (p[1]))
-+	if (p + 1 >= str + len || *p != '.' || !g_ascii_isdigit (p[1]))
- 		return SOUP_STATUS_BAD_REQUEST;
- 	minor_version = strtoul (p + 1, &p, 10);
- 	version_end = p;
-diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
-index 07ea2866..10ddb684 100644
--- a/tests/header-parsing-test.c
-+++ b/tests/header-parsing-test.c
-@@ -6,6 +6,10 @@ typedef struct {
- 	const char *name, *value;
- } Header;
- 
-+static char unterminated_http_version[] = {
-+        'G','E','T',' ','/',' ','H','T','T','P','/','1', '0', '0', '.'
-+};
-+
- static struct RequestTest {
- 	const char *description;
- 	const char *bugref;
-@@ -383,6 +387,14 @@ static struct RequestTest {
- 	  { { NULL } }
- 	},
- 
-+        /* This couldn't be a C string as going one byte over would have been safe. */
-+	{ "Long HTTP version terminating at missing minor version", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404",
-+	  unterminated_http_version, sizeof (unterminated_http_version),
-+	  SOUP_STATUS_BAD_REQUEST,
-+           NULL, NULL, -1,
-+	  { { NULL } }
-+	},
-+
- 	{ "Non-HTTP request", NULL,
- 	  "GET / SOUP/1.1\r\nHost: example.com\r\n", -1,
- 	  SOUP_STATUS_BAD_REQUEST,
-- 
-From af5b9a4a3945c52b940d5ac181ef51bb12011f1f Mon Sep 17 00:00:00 2001
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Wed, 12 Feb 2025 11:30:02 -0600
-Subject: [PATCH] headers: Handle parsing only newlines
-
-Closes #404
-Closes #407
---
- libsoup/soup-headers.c      |  4 ++--
- tests/header-parsing-test.c | 13 ++++++++++++-
- 2 files changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index 9d6d00a3..52ef2ece 100644
--- a/libsoup/soup-headers.c
-+++ b/libsoup/soup-headers.c
-@@ -186,7 +186,7 @@ soup_headers_parse_request (const char          *str,
- 	/* RFC 2616 4.1 "servers SHOULD ignore any empty line(s)
- 	 * received where a Request-Line is expected."
- 	 */
-	while ((*str == '\r' || *str == '\n') && len > 0) {
-+	while (len > 0 && (*str == '\r' || *str == '\n')) {
- 		str++;
- 		len--;
- 	}
-@@ -371,7 +371,7 @@ soup_headers_parse_response (const char          *str,
- 	 * after a response, which we then see prepended to the next
- 	 * response on that connection.
- 	 */
-	while ((*str == '\r' || *str == '\n') && len > 0) {
-+	while (len > 0 && (*str == '\r' || *str == '\n')) {
- 		str++;
- 		len--;
- 	}
-diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
-index 10ddb684..4faafbd6 100644
--- a/tests/header-parsing-test.c
-+++ b/tests/header-parsing-test.c
-@@ -6,10 +6,15 @@ typedef struct {
- 	const char *name, *value;
- } Header;
- 
-+/* These are not C strings to ensure going one byte over is not safe. */
- static char unterminated_http_version[] = {
-         'G','E','T',' ','/',' ','H','T','T','P','/','1', '0', '0', '.'
- };
- 
-+static char only_newlines[] = {
-+        '\n', '\n', '\n', '\n'
-+};
-+
- static struct RequestTest {
- 	const char *description;
- 	const char *bugref;
-@@ -387,7 +392,6 @@ static struct RequestTest {
- 	  { { NULL } }
- 	},
- 
-        /* This couldn't be a C string as going one byte over would have been safe. */
- 	{ "Long HTTP version terminating at missing minor version", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404",
- 	  unterminated_http_version, sizeof (unterminated_http_version),
- 	  SOUP_STATUS_BAD_REQUEST,
-@@ -457,6 +461,13 @@ static struct RequestTest {
- 	  SOUP_STATUS_BAD_REQUEST,
-            NULL, NULL, -1,
- 	  { { NULL } }
-+	},
-+
-+	{ "Only newlines", NULL,
-+	  only_newlines, sizeof (only_newlines),
-+	  SOUP_STATUS_BAD_REQUEST,
-+           NULL, NULL, -1,
-+	  { { NULL } }
- 	}
- };
- static const int num_reqtests = G_N_ELEMENTS (reqtests);
-- 
-2.49.0
-
--- a/libsoup-CVE-2025-32907.patch
+++ b/libsoup-CVE-2025-32907.patch
@@ -1,12 +0,0 @@
-diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
-index ee7a3cb1..f101d4b4 100644
--- a/libsoup/soup-message-headers.c
-+++ b/libsoup/soup-message-headers.c
-@@ -1244,6 +1244,7 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders  *hdrs,
- 			if (cur->start <= prev->end) {
- 				prev->end = MAX (prev->end, cur->end);
- 				g_array_remove_index (array, i);
-+				i--;
- 			}
- 		}
- 	}
--- a/libsoup-CVE-2025-32909.patch
+++ b/libsoup-CVE-2025-32909.patch
@@ -1,19 +0,0 @@
-diff -urp libsoup-2.74.3.orig/libsoup/soup-content-sniffer.c libsoup-2.74.3/libsoup/soup-content-sniffer.c
--- libsoup-2.74.3.orig/libsoup/soup-content-sniffer.c	2025-05-27 13:32:31.235362963 -0500
-+++ libsoup-2.74.3/libsoup/soup-content-sniffer.c	2025-05-27 19:19:50.297235824 -0500
-@@ -227,9 +227,14 @@ sniff_mp4 (SoupContentSniffer *sniffer,
- {
- 	const char *resource = (const char *)buffer->data;
- 	guint resource_length = MIN (512, buffer->length);
-	guint32 box_size = *((guint32*)resource);
-+	guint32 box_size;
- 	guint i;
- 
-+        if (resource_length < sizeof (guint32))
-+                return FALSE;
-+
-+	box_size = *((guint32*)resource);
-+
- #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
- 	box_size = ((box_size >> 24) |
- 		    ((box_size << 8) & 0x00FF0000) |
--- a/libsoup-CVE-2025-32910.patch
+++ b/libsoup-CVE-2025-32910.patch
@@ -1,328 +0,0 @@
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Sun, 8 Dec 2024 20:00:35 -0600
-Subject: auth-digest: Handle missing realm in authenticate header
-
-(cherry picked from commit e40df6d48a1cbab56f5d15016cc861a503423cfe)
---
- libsoup/soup-auth-digest.c |  3 +++
- tests/auth-test.c          | 50 ++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 53 insertions(+)
-
-diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
-index e8ba990..263a15a 100644
--- a/libsoup/soup-auth-digest.c
-+++ b/libsoup/soup-auth-digest.c
-@@ -142,6 +142,9 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
- 	guint qop_options;
- 	gboolean ok = TRUE;
- 
-+        if (!soup_auth_get_realm (auth))
-+                return FALSE;
-+
- 	g_free (priv->domain);
- 	g_free (priv->nonce);
- 	g_free (priv->opaque);
-diff --git a/tests/auth-test.c b/tests/auth-test.c
-index 8295ec3..61a16b6 100644
--- a/tests/auth-test.c
-+++ b/tests/auth-test.c
-@@ -1549,6 +1549,55 @@ do_cancel_after_retry_test (void)
-         soup_test_session_abort_unref (session);
- }
- 
-+static void
-+on_request_read_for_missing_realm (SoupServer        *server,
-+                                   SoupServerMessage *msg,
-+                                   gpointer           user_data)
-+{
-+        SoupMessageHeaders *response_headers = soup_server_message_get_response_headers (msg);
-+        soup_message_headers_replace (response_headers, "WWW-Authenticate", "Digest qop=\"auth\"");
-+}
-+
-+static void
-+do_missing_realm_test (void)
-+{
-+        SoupSession *session;
-+        SoupMessage *msg;
-+        SoupServer *server;
-+        SoupAuthDomain *digest_auth_domain;
-+        gint status;
-+        GUri *uri;
-+
-+        server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
-+	soup_server_add_handler (server, NULL,
-+				 server_callback, NULL, NULL);
-+	uri = soup_test_server_get_uri (server, "http", NULL);
-+
-+	digest_auth_domain = soup_auth_domain_digest_new (
-+		"realm", "auth-test",
-+		"auth-callback", server_digest_auth_callback,
-+		NULL);
-+        soup_auth_domain_add_path (digest_auth_domain, "/");
-+	soup_server_add_auth_domain (server, digest_auth_domain);
-+        g_object_unref (digest_auth_domain);
-+
-+        g_signal_connect (server, "request-read",
-+                          G_CALLBACK (on_request_read_for_missing_realm),
-+                          NULL);
-+
-+        session = soup_test_session_new (NULL);
-+        msg = soup_message_new_from_uri ("GET", uri);
-+        g_signal_connect (msg, "authenticate",
-+                          G_CALLBACK (on_digest_authenticate),
-+                          NULL);
-+
-+        status = soup_test_session_send_message (session, msg);
-+
-+        g_assert_cmpint (status, ==, SOUP_STATUS_UNAUTHORIZED);
-+	g_uri_unref (uri);
-+	soup_test_server_quit_unref (server);
-+}
-+
- int
- main (int argc, char **argv)
- {
-@@ -1576,6 +1625,7 @@ main (int argc, char **argv)
- 	g_test_add_func ("/auth/async-message-do-not-use-auth-cache", do_async_message_do_not_use_auth_cache_test);
- 	g_test_add_func ("/auth/authorization-header-request", do_message_has_authorization_header_test);
- 	g_test_add_func ("/auth/cancel-after-retry", do_cancel_after_retry_test);
-+	g_test_add_func ("/auth/missing-realm", do_missing_realm_test);
- 
- 	ret = g_test_run ();
- 
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Thu, 26 Dec 2024 18:18:35 -0600
-Subject: auth-digest: Handle missing nonce
-
-(cherry picked from commit 405a8a34597a44bd58c4759e7d5e23f02c3b556a)
---
- libsoup/soup-auth-digest.c | 44 ++++++++++++++++++++++++++++++++++----------
- tests/auth-test.c          | 19 +++++++++++--------
- 2 files changed, 45 insertions(+), 18 deletions(-)
-
-diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
-index 263a15a..34a75b0 100644
--- a/libsoup/soup-auth-digest.c
-+++ b/libsoup/soup-auth-digest.c
-@@ -132,6 +132,19 @@ soup_auth_digest_get_qop (SoupAuthDigestQop qop)
- 	return g_string_free (out, FALSE);
- }
- 
-+static gboolean
-+validate_params (SoupAuthDigest *auth_digest)
-+{
-+        SoupAuthDigestPrivate *priv = soup_auth_digest_get_instance_private (auth_digest);
-+
-+        if (priv->qop || priv->algorithm == SOUP_AUTH_DIGEST_ALGORITHM_MD5_SESS) {
-+                if (!priv->nonce)
-+                        return FALSE;
-+        }
-+
-+        return TRUE;
-+}
-+
- static gboolean
- soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
- 			 GHashTable *auth_params)
-@@ -169,16 +182,21 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
- 	if (priv->algorithm == -1)
- 		ok = FALSE;
- 
-	stale = g_hash_table_lookup (auth_params, "stale");
-	if (stale && !g_ascii_strcasecmp (stale, "TRUE") && *priv->hex_urp)
-		recompute_hex_a1 (priv);
-	else {
-		g_free (priv->user);
-		priv->user = NULL;
-		g_free (priv->cnonce);
-		priv->cnonce = NULL;
-		memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
-		memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
-+        if (!validate_params (auth_digest))
-+                ok = FALSE;
-+
-+        if (ok) {
-+                stale = g_hash_table_lookup (auth_params, "stale");
-+                if (stale && !g_ascii_strcasecmp (stale, "TRUE") && *priv->hex_urp)
-+                        recompute_hex_a1 (priv);
-+                else {
-+                        g_free (priv->user);
-+                        priv->user = NULL;
-+                        g_free (priv->cnonce);
-+                        priv->cnonce = NULL;
-+                        memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
-+                        memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
-+                }
-         }
- 
- 	return ok;
-@@ -269,6 +287,8 @@ soup_auth_digest_compute_hex_a1 (const char              *hex_urp,
- 
- 		/* In MD5-sess, A1 is hex_urp:nonce:cnonce */
- 
-+                g_assert (nonce && cnonce);
-+
- 		checksum = g_checksum_new (G_CHECKSUM_MD5);
- 		g_checksum_update (checksum, (guchar *)hex_urp, strlen (hex_urp));
- 		g_checksum_update (checksum, (guchar *)":", 1);
-@@ -359,6 +379,8 @@ soup_auth_digest_compute_response (const char        *method,
- 	if (qop) {
- 		char tmp[9];
- 
-+                g_assert (cnonce);
-+
- 		g_snprintf (tmp, 9, "%.8x", nc);
- 		g_checksum_update (checksum, (guchar *)tmp, strlen (tmp));
- 		g_checksum_update (checksum, (guchar *)":", 1);
-@@ -422,6 +444,8 @@ soup_auth_digest_get_authorization (SoupAuth *auth, SoupMessage *msg)
- 	g_return_val_if_fail (uri != NULL, NULL);
- 	url = soup_uri_to_string (uri, TRUE);
- 
-+        g_assert (priv->nonce);
-+        g_assert (!priv->qop || priv->cnonce);
- 	soup_auth_digest_compute_response (msg->method, url, priv->hex_a1,
- 					   priv->qop, priv->nonce,
- 					   priv->cnonce, priv->nc,
-diff --git a/tests/auth-test.c b/tests/auth-test.c
-index 61a16b6..6fb1e4a 100644
--- a/tests/auth-test.c
-+++ b/tests/auth-test.c
-@@ -1550,16 +1550,17 @@ do_cancel_after_retry_test (void)
- }
- 
- static void
-on_request_read_for_missing_realm (SoupServer        *server,
-                                   SoupServerMessage *msg,
-                                   gpointer           user_data)
-+on_request_read_for_missing_params (SoupServer        *server,
-+                                      SoupServerMessage *msg,
-+                                      gpointer           user_data)
- {
-+        const char *auth_header = user_data;
-         SoupMessageHeaders *response_headers = soup_server_message_get_response_headers (msg);
-        soup_message_headers_replace (response_headers, "WWW-Authenticate", "Digest qop=\"auth\"");
-+        soup_message_headers_replace (response_headers, "WWW-Authenticate", auth_header);
- }
- 
- static void
-do_missing_realm_test (void)
-+do_missing_params_test (gconstpointer auth_header)
- {
-         SoupSession *session;
-         SoupMessage *msg;
-@@ -1582,8 +1583,8 @@ do_missing_realm_test (void)
-         g_object_unref (digest_auth_domain);
- 
-         g_signal_connect (server, "request-read",
-                          G_CALLBACK (on_request_read_for_missing_realm),
-                          NULL);
-+                          G_CALLBACK (on_request_read_for_missing_params),
-+                          (gpointer)auth_header);
- 
-         session = soup_test_session_new (NULL);
-         msg = soup_message_new_from_uri ("GET", uri);
-@@ -1625,7 +1626,9 @@ main (int argc, char **argv)
- 	g_test_add_func ("/auth/async-message-do-not-use-auth-cache", do_async_message_do_not_use_auth_cache_test);
- 	g_test_add_func ("/auth/authorization-header-request", do_message_has_authorization_header_test);
- 	g_test_add_func ("/auth/cancel-after-retry", do_cancel_after_retry_test);
-	g_test_add_func ("/auth/missing-realm", do_missing_realm_test);
-+        g_test_add_data_func ("/auth/missing-params/realm", "Digest qop=\"auth\"", do_missing_params_test);
-+        g_test_add_data_func ("/auth/missing-params/nonce", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\"", do_missing_params_test);
-+        g_test_add_data_func ("/auth/missing-params/nonce-md5-sess", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\" algorithm=\"MD5-sess\"", do_missing_params_test);
- 
- 	ret = g_test_run ();
- 
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Fri, 27 Dec 2024 13:52:52 -0600
-Subject: auth-digest: Fix leak
-
-(cherry picked from commit ea16eeacb052e423eb5c3b0b705e5eab34b13832)
---
- libsoup/soup-auth-digest.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
-index 34a75b0..10615c7 100644
--- a/libsoup/soup-auth-digest.c
-+++ b/libsoup/soup-auth-digest.c
-@@ -66,6 +66,7 @@ soup_auth_digest_finalize (GObject *object)
- 	g_free (priv->nonce);
- 	g_free (priv->domain);
- 	g_free (priv->cnonce);
-+        g_free (priv->opaque);
- 
- 	memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
- 	memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
-From: Andreas Henriksson <andreas@fatal.se>
-Date: Sat, 26 Apr 2025 20:09:29 +0200
-Subject: Backport auth tests for CVE-2025-32910
-
-Forward-ported from bullseye-security.
---
- tests/auth-test.c | 28 ++++++++++++++++++++--------
- 1 file changed, 20 insertions(+), 8 deletions(-)
-
-diff --git a/tests/auth-test.c b/tests/auth-test.c
-index 6fb1e4a..88478ee 100644
--- a/tests/auth-test.c
-+++ b/tests/auth-test.c
-@@ -1549,14 +1549,26 @@ do_cancel_after_retry_test (void)
-         soup_test_session_abort_unref (session);
- }
- 
-+//from upstream commit 9af7d0fc751f7afcd8b03bc827a4d3af0c4556f8
-+static gboolean
-+on_digest_authenticate (SoupMessage *msg,
-+                        SoupAuth    *auth,
-+                        gboolean     retrying,
-+                        gpointer     user_data)
-+{
-+        g_assert_false (retrying);
-+        soup_auth_authenticate (auth, "user", "good");
-+        return TRUE;
-+}
-+
- static void
- on_request_read_for_missing_params (SoupServer        *server,
-                                      SoupServerMessage *msg,
-+                                      SoupMessage *msg,
-+                                      SoupClientContext *client,
-                                       gpointer           user_data)
- {
-         const char *auth_header = user_data;
-        SoupMessageHeaders *response_headers = soup_server_message_get_response_headers (msg);
-        soup_message_headers_replace (response_headers, "WWW-Authenticate", auth_header);
-+        soup_message_headers_replace (msg->response_headers, "WWW-Authenticate", auth_header);
- }
- 
- static void
-@@ -1567,7 +1579,7 @@ do_missing_params_test (gconstpointer auth_header)
-         SoupServer *server;
-         SoupAuthDomain *digest_auth_domain;
-         gint status;
-        GUri *uri;
-+        SoupURI *uri;
- 
-         server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
- 	soup_server_add_handler (server, NULL,
-@@ -1586,16 +1598,16 @@ do_missing_params_test (gconstpointer auth_header)
-                           G_CALLBACK (on_request_read_for_missing_params),
-                           (gpointer)auth_header);
- 
-        session = soup_test_session_new (NULL);
-+        session = soup_test_session_new (SOUP_TYPE_SESSION_ASYNC, NULL);
-         msg = soup_message_new_from_uri ("GET", uri);
-        g_signal_connect (msg, "authenticate",
-+        g_signal_connect (session, "authenticate",
-                           G_CALLBACK (on_digest_authenticate),
-                           NULL);
- 
-        status = soup_test_session_send_message (session, msg);
-+        status = soup_session_send_message (session, msg);
- 
-         g_assert_cmpint (status, ==, SOUP_STATUS_UNAUTHORIZED);
-	g_uri_unref (uri);
-+	soup_uri_free (uri);
- 	soup_test_server_quit_unref (server);
- }
- 
--- a/libsoup-CVE-2025-32912.patch
+++ b/libsoup-CVE-2025-32912.patch
@@ -1,59 +0,0 @@
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Wed, 5 Feb 2025 14:03:05 -0600
-Subject: auth-digest: Handle missing nonce
-
-(cherry picked from commit cd077513f267e43ce4b659eb18a1734d8a369992)
---
- libsoup/soup-auth-digest.c | 2 +-
- tests/auth-test.c          | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
-index 10615c7..d7d4845 100644
--- a/libsoup/soup-auth-digest.c
-+++ b/libsoup/soup-auth-digest.c
-@@ -156,7 +156,7 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
- 	guint qop_options;
- 	gboolean ok = TRUE;
- 
-        if (!soup_auth_get_realm (auth))
-+        if (!soup_auth_get_realm (auth) || !g_hash_table_contains (auth_params, "nonce"))
-                 return FALSE;
- 
- 	g_free (priv->domain);
-diff --git a/tests/auth-test.c b/tests/auth-test.c
-index 88478ee..f582033 100644
--- a/tests/auth-test.c
-+++ b/tests/auth-test.c
-@@ -1641,6 +1641,7 @@ main (int argc, char **argv)
-         g_test_add_data_func ("/auth/missing-params/realm", "Digest qop=\"auth\"", do_missing_params_test);
-         g_test_add_data_func ("/auth/missing-params/nonce", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\"", do_missing_params_test);
-         g_test_add_data_func ("/auth/missing-params/nonce-md5-sess", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\" algorithm=\"MD5-sess\"", do_missing_params_test);
-+        g_test_add_data_func ("/auth/missing-params/nonce-and-qop", "Digest realm=\"auth-test\"", do_missing_params_test);
- 
- 	ret = g_test_run ();
- 
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Sat, 8 Feb 2025 12:30:13 -0600
-Subject: digest-auth: Handle NULL nonce
-
-`contains` only handles a missing nonce, `lookup` handles both missing and empty.
-
-(cherry picked from commit 910ebdcd3dd82386717a201c13c834f3a63eed7f)
---
- libsoup/soup-auth-digest.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
-index d7d4845..fbd216a 100644
--- a/libsoup/soup-auth-digest.c
-+++ b/libsoup/soup-auth-digest.c
-@@ -156,7 +156,7 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
- 	guint qop_options;
- 	gboolean ok = TRUE;
- 
-        if (!soup_auth_get_realm (auth) || !g_hash_table_contains (auth_params, "nonce"))
-+        if (!soup_auth_get_realm (auth) || !g_hash_table_lookup (auth_params, "nonce"))
-                 return FALSE;
- 
- 	g_free (priv->domain);
--- a/libsoup-CVE-2025-32913.patch
+++ b/libsoup-CVE-2025-32913.patch
@@ -1,104 +0,0 @@
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Fri, 27 Dec 2024 17:53:50 -0600
-Subject: soup_message_headers_get_content_disposition: Fix NULL deref
-
-(cherry picked from commit 7b4ef0e004ece3a308ccfaa714c284f4c96ade34)
---
- libsoup/soup-message-headers.c | 13 +++++++++----
- tests/header-parsing-test.c    | 14 ++++++++++++++
- 2 files changed, 23 insertions(+), 4 deletions(-)
-
-diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
-index 39ad14a..a577169 100644
--- a/libsoup/soup-message-headers.c
-+++ b/libsoup/soup-message-headers.c
-@@ -1454,10 +1454,15 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders  *hdrs,
- 	 */
- 	if (params && g_hash_table_lookup_extended (*params, "filename",
- 						    &orig_key, &orig_value)) {
-		char *filename = strrchr (orig_value, '/');
-
-		if (filename)
-			g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
-+                if (orig_value) {
-+                        char *filename = strrchr (orig_value, '/');
-+
-+                        if (filename)
-+                                g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
-+                } else {
-+                        /* filename with no value isn't valid. */
-+                        g_hash_table_remove (*params, "filename");
-+                }
- 	}
- 	return TRUE;
- }
-diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
-index e00ec1c..8e433ca 100644
--- a/tests/header-parsing-test.c
-+++ b/tests/header-parsing-test.c
-@@ -1051,6 +1051,7 @@ do_param_list_tests (void)
- #define RFC5987_TEST_HEADER_FALLBACK "attachment; filename*=Unknown''t%FF%FF%FFst.txt; filename=\"test.txt\""
- #define RFC5987_TEST_HEADER_NO_TYPE  "filename=\"test.txt\""
- #define RFC5987_TEST_HEADER_NO_TYPE_2  "filename=\"test.txt\"; foo=bar"
-+#define RFC5987_TEST_HEADER_EMPTY_FILENAME ";filename"
- 
- static void
- do_content_disposition_tests (void)
-@@ -1152,6 +1153,19 @@ do_content_disposition_tests (void)
-         g_assert_cmpstr (parameter2, ==, "bar");
- 	g_hash_table_destroy (params);
- 
-+        /* Empty filename */
-+        soup_message_headers_clear (hdrs);
-+        soup_message_headers_append (hdrs, "Content-Disposition",
-+				     RFC5987_TEST_HEADER_EMPTY_FILENAME);
-+	if (!soup_message_headers_get_content_disposition (hdrs,
-+							   &disposition,
-+							   &params)) {
-+		soup_test_assert (FALSE, "empty filename decoding FAILED");
-+		return;
-+	}
-+        g_assert_false (g_hash_table_contains (params, "filename"));
-+	g_hash_table_destroy (params);
-+
- 	soup_message_headers_free (hdrs);
- 
- 	/* Ensure that soup-multipart always quotes filename */
-From: Patrick Griffis <pgriffis@igalia.com>
-Date: Fri, 27 Dec 2024 18:00:39 -0600
-Subject: soup_message_headers_get_content_disposition: strdup truncated
- filenames
-
-This table frees the strings it contains.
-
-(cherry picked from commit f4a761fb66512fff59798765e8ac5b9e57dceef0)
---
- libsoup/soup-message-headers.c | 2 +-
- tests/header-parsing-test.c    | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
-index a577169..81e7cea 100644
--- a/libsoup/soup-message-headers.c
-+++ b/libsoup/soup-message-headers.c
-@@ -1458,7 +1458,7 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders  *hdrs,
-                         char *filename = strrchr (orig_value, '/');
- 
-                         if (filename)
-                                g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
-+                                g_hash_table_insert (*params, g_strdup (orig_key), g_strdup (filename + 1));
-                 } else {
-                         /* filename with no value isn't valid. */
-                         g_hash_table_remove (*params, "filename");
-diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
-index 8e433ca..06e525c 100644
--- a/tests/header-parsing-test.c
-+++ b/tests/header-parsing-test.c
-@@ -1163,6 +1163,7 @@ do_content_disposition_tests (void)
- 		soup_test_assert (FALSE, "empty filename decoding FAILED");
- 		return;
- 	}
-+        g_free (disposition);
-         g_assert_false (g_hash_table_contains (params, "filename"));
- 	g_hash_table_destroy (params);
- 
--- a/libsoup-CVE-2025-32914.patch
+++ b/libsoup-CVE-2025-32914.patch
@@ -1,12 +0,0 @@
-diff -urp libsoup-2.74.3.orig/libsoup/soup-multipart.c libsoup-2.74.3/libsoup/soup-multipart.c
--- libsoup-2.74.3.orig/libsoup/soup-multipart.c	2022-10-11 13:27:22.000000000 -0500
-+++ libsoup-2.74.3/libsoup/soup-multipart.c	2025-04-29 16:02:06.960901147 -0500
-@@ -181,7 +181,7 @@ soup_multipart_new_from_message (SoupMes
- 			return NULL;
- 		}
- 
-		split = strstr (start, "\r\n\r\n");
-+		split = g_strstr_len (start, body_end - start, "\r\n\r\n");
- 		if (!split || split > end) {
- 			soup_multipart_free (multipart);
- 			soup_buffer_free (flattened);
--- a/libsoup-CVE-2025-46421.patch
+++ b/libsoup-CVE-2025-46421.patch
@@ -1,15 +0,0 @@
-diff -urp libsoup-2.74.3.orig/libsoup/soup-session.c libsoup-2.74.3/libsoup/soup-session.c
--- libsoup-2.74.3.orig/libsoup/soup-session.c	2025-04-15 11:39:01.552307999 -0500
-+++ libsoup-2.74.3/libsoup/soup-session.c	2025-04-29 15:07:05.873681389 -0500
-@@ -1189,6 +1189,11 @@ soup_session_redirect_message (SoupSessi
- 						   SOUP_ENCODING_NONE);
- 	}
- 
-+        if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
-+                soup_message_headers_remove (msg->request_headers, "Authorization");
-+                soup_message_set_auth (msg, NULL);
-+        }
-+
- 	soup_message_set_uri (msg, new_uri);
- 	soup_uri_free (new_uri);
- 
--- a/libsoup-CVE-2025-4945.patch
+++ b/libsoup-CVE-2025-4945.patch
@@ -1,97 +0,0 @@
-Backport of https://gitlab.gnome.org/GNOME/libsoup/-/commit/8988379984e33dcc7d3aa58551db13e48755959f
-
-diff -urp libsoup-2.74.3.orig/libsoup/soup-date.c libsoup-2.74.3/libsoup/soup-date.c
--- libsoup-2.74.3.orig/libsoup/soup-date.c	2022-10-11 13:27:22.000000000 -0500
-+++ libsoup-2.74.3/libsoup/soup-date.c	2025-06-18 11:56:02.916383979 -0500
-@@ -284,7 +284,7 @@ parse_day (SoupDate *date, const char **
- 	while (*end == ' ' || *end == '-')
- 		end++;
- 	*date_string = end;
-	return TRUE;
-+	return date->day >= 1 && date->day <= 31;
- }
- 
- static inline gboolean
-@@ -324,7 +324,7 @@ parse_year (SoupDate *date, const char *
- 	while (*end == ' ' || *end == '-')
- 		end++;
- 	*date_string = end;
-	return TRUE;
-+	return date->year > 0 && date->year < 9999;
- }
- 
- static inline gboolean
-@@ -348,7 +348,7 @@ parse_time (SoupDate *date, const char *
- 	while (*p == ' ')
- 		p++;
- 	*date_string = p;
-	return TRUE;
-+	return date->hour >= 0 && date->hour < 24 && date->minute >= 0 && date->minute < 60 && date->second >= 0 && date->second < 60;
- }
- 
- static inline gboolean
-@@ -361,9 +361,14 @@ parse_timezone (SoupDate *date, const ch
- 		gulong val;
- 		int sign = (**date_string == '+') ? -1 : 1;
- 		val = strtoul (*date_string + 1, (char **)date_string, 10);
-		if (**date_string == ':')
-			val = 60 * val + strtoul (*date_string + 1, (char **)date_string, 10);
-		else
-+		if (val > 9999)
-+			return FALSE;
-+		if (**date_string == ':') {
-+			gulong val2 = strtoul (*date_string + 1, (char **)date_string, 10);
-+			if (val > 99 || val2 > 99)
-+				return FALSE;
-+			val = 60 * val + val2;
-+		} else
- 			val =  60 * (val / 100) + (val % 100);
- 		date->offset = sign * val;
- 		date->utc = (sign == -1) && !val;
-@@ -407,7 +412,8 @@ parse_textual_date (SoupDate *date, cons
- 		if (!parse_month (date, &date_string) ||
- 		    !parse_day (date, &date_string) ||
- 		    !parse_time (date, &date_string) ||
-		    !parse_year (date, &date_string))
-+		    !parse_year (date, &date_string) ||
-+		    !g_date_valid_dmy (date->day, date->month, date->year))
- 			return FALSE;
- 
- 		/* There shouldn't be a timezone, but check anyway */
-@@ -419,7 +425,8 @@ parse_textual_date (SoupDate *date, cons
- 		if (!parse_day (date, &date_string) ||
- 		    !parse_month (date, &date_string) ||
- 		    !parse_year (date, &date_string) ||
-		    !parse_time (date, &date_string))
-+		    !parse_time (date, &date_string) ||
-+		    !g_date_valid_dmy (date->day, date->month, date->year))
- 			return FALSE;
- 
- 		/* This time there *should* be a timezone, but we
-diff -urp libsoup-2.74.3.orig/tests/cookies-test.c libsoup-2.74.3/tests/cookies-test.c
--- libsoup-2.74.3.orig/tests/cookies-test.c	2022-10-11 13:27:22.000000000 -0500
-+++ libsoup-2.74.3/tests/cookies-test.c	2025-06-18 11:13:49.363862484 -0500
-@@ -389,6 +389,15 @@ send_callback (GObject *source_object,
- }
- 
- static void
-+do_cookies_parsing_int32_overflow (void)
-+{
-+	SoupCookie *cookie = soup_cookie_parse ("Age=1;expires=3Mar9    999:9:9+ 999999999-age=main=gne=", NULL);
-+	g_assert_nonnull (cookie);
-+	g_assert_null (soup_cookie_get_expires (cookie));
-+	soup_cookie_free (cookie);
-+}
-+
-+static void
- do_remove_feature_test (void)
- {
- 	SoupSession *session;
-@@ -434,6 +443,7 @@ main (int argc, char **argv)
- 	g_test_add_func ("/cookies/accept-policy-subdomains", do_cookies_subdomain_policy_test);
- 	g_test_add_func ("/cookies/parsing", do_cookies_parsing_test);
- 	g_test_add_func ("/cookies/parsing/no-path-null-origin", do_cookies_parsing_nopath_nullorigin);
-+	g_test_add_func ("/cookies/parsing/int32-overflow", do_cookies_parsing_int32_overflow);
- 	g_test_add_func ("/cookies/get-cookies/empty-host", do_get_cookies_empty_host_test);
- 	g_test_add_func ("/cookies/remove-feature", do_remove_feature_test);
- 	g_test_add_func ("/cookies/secure-cookies", do_cookies_strict_secure_test);
--- a/libsoup-CVE-2025-4948.patch
+++ b/libsoup-CVE-2025-4948.patch
@@ -1,12 +0,0 @@
-diff -urp libsoup-2.74.3.orig/libsoup/soup-multipart.c libsoup-2.74.3/libsoup/soup-multipart.c
--- libsoup-2.74.3.orig/libsoup/soup-multipart.c	2025-05-27 13:32:43.436993764 -0500
-+++ libsoup-2.74.3/libsoup/soup-multipart.c	2025-05-27 19:38:53.415327739 -0500
-@@ -214,7 +214,7 @@ soup_multipart_new_from_message (SoupMes
- 		 */
- 		part_body = soup_buffer_new_subbuffer (flattened,
- 						       split - flattened->data,
-						       end - 2 - split);
-+						       end - 2 >= split ? end - 2 - split : 0);
- 		g_ptr_array_add (multipart->bodies, part_body);
- 
- 		start = end;
--- a/libsoup-CVE-2025-4969.patch
+++ b/libsoup-CVE-2025-4969.patch
@@ -1,12 +0,0 @@
-diff -urp libsoup-2.74.3.orig/libsoup/soup-multipart.c libsoup-2.74.3/libsoup/soup-multipart.c
--- libsoup-2.74.3.orig/libsoup/soup-multipart.c	2025-05-28 16:24:14.538950644 -0500
-+++ libsoup-2.74.3/libsoup/soup-multipart.c	2025-05-28 16:24:23.770369983 -0500
-@@ -108,7 +108,7 @@ find_boundary (const char *start, const
- 			continue;
- 
- 		/* Check that it's at start of line */
-		if (!(b == start || (b[-1] == '\n' && b[-2] == '\r')))
-+		if (!(b == start || (b - start >= 2 && b[-1] == '\n' && b[-2] == '\r')))
- 			continue;
- 
- 		/* Check for "--" or "\r\n" after boundary */
--- a/libsoup2.changes
+++ b/libsoup2.changes
@@ -1,72 +1,3 @@
-------------------------------------------------------------------
-Wed Jun 18 16:47:42 UTC 2025 - Michael Gorse <mgorse@suse.com>
-
- Add libsoup-CVE-2025-4945.patch: add value checks for date/time
-  parsing (boo#1243314 CVE-2025-4945).
-
-------------------------------------------------------------------
-Wed May 28 21:28:03 UTC 2025 - Michael Gorse <mgorse@suse.com>
-
- Add more CVE fixes:
-  + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
-    CVE-2025-32913 CVE-2025-32911)
-  + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
-  + libsoup-CVE-2025-32906.patch (boo#1241263 CVE-2025-32906)
-  + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
-  + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
-  + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
-  + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
-
-------------------------------------------------------------------
-Tue Apr 29 17:04:13 UTC 2025 - Michael Gorse <mgorse@suse.com>
-
- Add more CVE fixes:
-  + c9083869.patch (boo#1241686 CVE-2025-46420)
-  + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
-  + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)
-  + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
-
-------------------------------------------------------------------
-Fri Apr 18 21:38:24 UTC 2025 - Michael Gorse <mgorse@suse.com>
-
- Add more CVE fixes:
-  + ef6c4bf6.patch (boo#1240750 CVE-2025-2784)
-  + 96c22b67.patch (boo#1240750 CVE-2025-2784)
-  + 19124679.patch (boo#1240752 CVE-2025-32050)
-  + a5b86bfc.patch (boo#1240756 CVE-2025-32052)
-  + 5739a090.patch (boo#1240757 CVE-2025-32053)
-
-------------------------------------------------------------------
-Fri Apr  4 19:42:40 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
-
- Increase test timeout for all arches except x86_64 and run tests
-  again should they fail the first time, the testsuite is flaky.
-
-------------------------------------------------------------------
-Wed Apr  2 15:03:50 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
-
- Increase test timeout on s390x. The http2-body-stream test can be
-  slow and sometimes times out in our builds.
-
-------------------------------------------------------------------
-Wed Nov 13 19:51:03 UTC 2024 - Michael Gorse <mgorse@suse.com>
-
- Add 4c9e75c6.patch: fix an intermittent test failure
-  (glgo#GNOME/libsoup#399).
-
-------------------------------------------------------------------
-Tue Nov 12 23:21:48 UTC 2024 - Michael Gorse <mgorse@suse.com>
-
- Add 04df03bc.patch: strictly don't allow NUL bytes in headers
-  (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
- Add libsoup-CVE-2024-52532.patch: websocket: Process the frame as
-  soon as we read data (boo#1233287 CVE-2024-52532).
- Add 29b96fab.patch: websocket-test: disconnect error copy after
-  the test ends (glgo#GNOME/libsoup#391).
- Add a35222dd.patch: be more robust against invalid input when
-  parsing params (boo#1233292 CVE-2024-52531
-  glgo#GNOME/libsoup!407).
-
 -------------------------------------------------------------------
 Thu Dec 14 12:42:08 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>

@@ -2897,7 +2828,7 @@ Tue Oct 21 19:28:57 EST 2008 - mboman@suse.de
  + Updated generated documentation

 -------------------------------------------------------------------
-Fri Oct  3 15:28:27 EST 2008 - mboman@suse.de
+Fri Oct  3 15:28:27 WST 2008 - mboman@suse.de

 - Update to version 2.24.0.1:
  + Reverted part of the fix for bgo#528882, which caused the DAAP
--- a/libsoup2.spec
+++ b/libsoup2.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package libsoup2
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2023 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -36,50 +36,6 @@ Patch3:         https://gitlab.gnome.org/GNOME/libsoup/-/commit/4d12c3e5.patch
 Patch4:         https://gitlab.gnome.org/GNOME/libsoup/-/commit/48b3b611.patch
 # PATCH-FIX-UPSTREAM ced3c5d8.patch -- Fix build with libxml2-2.12.0 and clang-17
 Patch5:         https://gitlab.gnome.org/GNOME/libsoup/-/commit/ced3c5d8.patch
-# PATCH-FIX-UPSTREAM 04df03bc.patch boo#1233285 mgorse@suse.com -- strictly don't allow NUL bytes in headers.
-Patch6:         https://gitlab.gnome.org/GNOME/libsoup/-/commit/04df03bc.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2024-52532.patch boo#1233287 mgorse@suse.com -- process the frame as soon as we read data.
-Patch7:         libsoup-CVE-2024-52532.patch
-# PATCH-FIX-UPSTREAM 29b96fab.patch boo#1233287 mgorse@suse.com -- websocket-test: disconnect error copy after the test ends.
-Patch8:         https://gitlab.gnome.org/GNOME/libsoup/-/commit/29b96fab.patch
-# PATCH-FIX-UPSTREAM a35222dd.patch boo#1233292 mgorse@suse.com -- be more robust against invalid input when parsing params.
-Patch9:         https://gitlab.gnome.org/GNOME/libsoup/-/commit/a35222dd.patch
-# PATCH-FIX-UPSTREAM 4c9e75c6.patch boo#1233287 mgorse@suse.com -- fix an intermittent test failure.
-Patch10:        https://gitlab.gnome.org/GNOME/libsoup/-/commit/4c9e75c6.patch
-# PATCH-FIX-UPSTREAM ef6c4bf6.patch boo#1240750 mgorse@suse.com -- fix a potential overflow.
-Patch11:        https://gitlab.gnome.org/GNOME/libsoup/-/commit/ef6c4bf6.patch
-# PATCH-FIX-UPSTREAM 96c22b67.patch boo#1240750 mgorse@suse.com -- add better coverage of skip_insignificant_space.
-Patch12:        https://gitlab.gnome.org/GNOME/libsoup/-/commit/96c22b67.patch
-# PATCH-FIX-UPSTREAM 19124679.patch boo#1240752 mgorse@suse.com -- Fix using int instead of size_t for strcspn return.
-Patch13:        https://gitlab.gnome.org/GNOME/libsoup/-/commit/19124679.patch
-# PATCH-FIX-UPSTREAM a5b86bfc.patch boo#1240756 mgorse@suse.com -- fix heap buffer overflow in soup_content_sniffer_sniff.
-Patch14:        https://gitlab.gnome.org/GNOME/libsoup/-/commit/a5b86bfc.patch
-# PATCH-FIX-UPSTREAM 5739a090.patch boo#1240757 mgorse@suse.com -- fix heap buffer overflow in soup_content_sniffer.c:sniff_feed_or_html
-Patch15:        https://gitlab.gnome.org/GNOME/libsoup/-/commit/5739a090.patch
-# PATCH-FIX-UPSTREAM c9083869.patch boo#1241686 mgorse@suse.com -- fix leak in soup_header_parse_quality_list.
-Patch16:        https://gitlab.gnome.org/GNOME/libsoup/-/commit/c9083869.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-32914.patch boo#1241164 mgorse@suse.com -- fix read out of buffer bounds under soup_multipart_new_from_message.
-Patch17:        libsoup-CVE-2025-32914.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-32907.patch boo#1241222 mgorse@suse.com -- correct merge of ranges.
-Patch18:        libsoup-CVE-2025-32907.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-46421.patch boo#1241688 mgorse@suse.com -- strip authentication credentials on cross-origin redirect.
-Patch19:        libsoup-CVE-2025-46421.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-32913.patch boo#1241162 mgorse@suse.com -- fix NULL deref in soup_message_headers_get_content_disposition.
-Patch20:        libsoup-CVE-2025-32913.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-32910.patch boo#1241252 mgorse@suse.com -- fix NULL deref with missing realm in authenticate header.
-Patch21:        libsoup-CVE-2025-32910.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-32912.patch boo#1241214 mgorse@suse.com -- fix NULL pointer deref in SoupAuthDigest.
-Patch22:        libsoup-CVE-2025-32912.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-32906.patch boo#1241263 mgorse@suse.com -- fix an out-of-bounds read parsing headers.
-Patch23:        libsoup-CVE-2025-32906.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-32909.patch boo#1241226 mgorse@suse.com -- handle sniffing resource shorter than 4 bytes.
-Patch24:        libsoup-CVE-2025-32909.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-4948.patch boo#1243332 mgorse@suse.com -- verify boundary limits for multipart body.
-Patch25:        libsoup-CVE-2025-4948.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-4969.patch boo#1243423 mgorse@suse.com -- soup-multipart: Verify array bounds before accessing its members.
-Patch26:        libsoup-CVE-2025-4969.patch
-# PATCH-FIX-UPSTREAM libsoup-CVE-2025-4945.patch boo#1243314 mgorse@suse.com -- add value checks for date/time parsing.
-Patch27:        libsoup-CVE-2025-4945.patch

 BuildRequires:  glib-networking
 BuildRequires:  meson >= 0.50
@@ -180,21 +136,17 @@ Features:
    %{nil}
 %meson_build

+%check
+# Run the regression tests using GnuTLS NORMAL priority
+export G_TLS_GNUTLS_PRIORITY=NORMAL
+%meson_test
+
 %install
 %meson_install
 %find_lang %{_name} %{?no_lang_C}

 %ldconfig_scriptlets -n %{_name}-2_4-1

-%check
-# Run the regression tests using GnuTLS NORMAL priority
-export G_TLS_GNUTLS_PRIORITY=NORMAL
-%ifnarch x86_64
-%meson_test -t 5  || (%meson_test -t 5)
-%else
-%meson_test || (%meson_test)
-%endif
-
 %files -n %{_name}-2_4-1
 %license COPYING
 %doc NEWS