mgorse/libsoup2
SHA256
1
0
Fork 0
forked from pool/libsoup2
Code Pull Requests Activity

Compare commits

base: mgorse:factory
Branches Tags
mgorse:factory mgorse:slfo-1.2 mgorse:slfo-main pool:factory pool:slfo-main pool:slfo-1.2
..
compare: mgorse:slfo-1.2
Branches Tags
mgorse:slfo-1.2 mgorse:slfo-main mgorse:factory pool:factory pool:slfo-main pool:slfo-1.2

2 Commits
factory ... slfo-1.2

Author SHA256 Message Date
Mike Gorse
0013e04354 CVE fixes 2026-02-08 16:46:18 -06:00
Adrian Schröter
f9953a3144 Sync changes to SLFO-1.2 branch 2025-08-20 09:43:40 +02:00
4 changed files with 116 additions and 4 deletions
Expand all files Collapse all files

77
libsoup2-CVE-2026-0716.patch Normal file
View File

@@ -0,0 +1,77 @@
diff -urp libsoup-2.74.3.orig/libsoup/soup-websocket-connection.c libsoup-2.74.3/libsoup/soup-websocket-connection.c
--- libsoup-2.74.3.orig/libsoup/soup-websocket-connection.c 2022-10-11 13:27:22.000000000 -0500
+++ libsoup-2.74.3/libsoup/soup-websocket-connection.c 2026-02-06 12:46:44.372111863 -0600
@@ -1064,6 +1064,12 @@ process_frame (SoupWebsocketConnection *
payload += 4;
at += 4;
+ /* at has a maximum value of 10 + 4 = 14 */
+ if (payload_len > G_MAXSIZE - 14) {
+ bad_data_error_and_close (self);
+ return FALSE;
+ }
+
if (len < at + payload_len)
return FALSE; /* need more data */
diff -urp libsoup-2.74.3.orig/tests/websocket-test.c libsoup-2.74.3/tests/websocket-test.c
--- libsoup-2.74.3.orig/tests/websocket-test.c 2022-10-11 13:27:22.000000000 -0500
+++ libsoup-2.74.3/tests/websocket-test.c 2026-02-06 12:46:44.372679228 -0600
@@ -1861,6 +1861,41 @@ test_cookies_in_response (Test *test,
soup_cookie_free (cookie);
}
+static void
+test_cve_2026_0716 (Test *test,
+ gconstpointer unused)
+{
+ GError *error = NULL;
+ GIOStream *io;
+ gsize written;
+ const char *frame;
+ gboolean close_event = FALSE;
+
+ g_signal_handlers_disconnect_by_func (test->server, on_error_not_reached, NULL);
+ g_signal_connect (test->server, "error", G_CALLBACK (on_error_copy), &error);
+ g_signal_connect (test->client, "closed", G_CALLBACK (on_close_set_flag), &close_event);
+
+ io = soup_websocket_connection_get_io_stream (test->client);
+
+ soup_websocket_connection_set_max_incoming_payload_size (test->server, 0);
+
+ // Malicious masked frame header (10-byte header + 4-byte mask) */
+ frame = "\x82\xff\xff\xff\xff\xff\xff\xff\xff\xf6\xaa\xbb\xcc\xdd";
+ if (!g_output_stream_write_all (g_io_stream_get_output_stream (io),
+ frame, 14, &written, NULL, NULL))
+ g_assert_cmpstr ("This code", ==, "should not be reached");
+ g_assert_cmpuint (written, ==, 14);
+
+ WAIT_UNTIL (error != NULL);
+ g_assert_error (error, SOUP_WEBSOCKET_ERROR, SOUP_WEBSOCKET_CLOSE_BAD_DATA);
+ g_clear_error (&error);
+
+ WAIT_UNTIL (soup_websocket_connection_get_state (test->client) == SOUP_WEBSOCKET_STATE_CLOSED);
+ g_assert_true (close_event);
+
+ g_assert_cmpuint (soup_websocket_connection_get_close_code (test->client), ==, SOUP_WEBSOCKET_CLOSE_BAD_DATA);
+}
+
int
main (int argc,
char *argv[])
@@ -2094,6 +2129,15 @@ main (int argc,
test_cookies_in_response,
teardown_soup_connection);
+ g_test_add ("/websocket/direct/cve-2026-0716", Test, NULL,
+ setup_direct_connection,
+ test_cve_2026_0716,
+ teardown_direct_connection);
+ g_test_add ("/websocket/soup/cve-2026-0716", Test, NULL,
+ setup_soup_connection,
+ test_cve_2026_0716,
+ teardown_soup_connection);
+
ret = g_test_run ();
test_cleanup ();

12
libsoup2-CVE-2026-1761.patch Normal file
View File

@@ -0,0 +1,12 @@
Index: libsoup-2.74.3/libsoup/soup-filter-input-stream.c
===================================================================
--- libsoup-2.74.3.orig/libsoup/soup-filter-input-stream.c
+++ libsoup-2.74.3/libsoup/soup-filter-input-stream.c
@@ -272,6 +272,6 @@ soup_filter_input_stream_read_until (Sou
if (eof && !*got_boundary)
read_length = MIN (fstream->priv->buf->len, length);
else
- read_length = p - buf;
+ read_length = MIN ((gsize)(p - buf), length);
return read_from_buf (fstream, buffer, read_length);
}

25
libsoup2.changes
View File

@@ -1,14 +1,33 @@
-------------------------------------------------------------------
Fri Jan 9 02:52:21 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
Fri Feb 6 19:18:44 UTC 2026 - Michael Gorse <mgorse@suse.com>
- Add libsoup2-CVE-2026-0716.patch: Fix out-of-bounds read for
websocket (bsc#1256418, CVE-2026-0716, glgo#GNOME/libsoup!494).
-------------------------------------------------------------------
Tue Feb 3 01:52:48 UTC 2026 - Jonathan Kang <songchuan.kang@suse.com>
- Add libsoup2-CVE-2026-1761.patch: multipart: check length of bytes
read soup_filter_input_stream_read_until()
(bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496).
-------------------------------------------------------------------
Tue Jan 13 03:15:10 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
- Add libsoup2-CVE-2026-0719.patch: Fix overflow for password
md4sum (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493).
-------------------------------------------------------------------
Thu Jan 8 05:11:30 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
Thu Jan 8 06:07:38 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
- Refresh libsoup2-CVE-2025-14523.patch: Follow the update of
upstream (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).
-------------------------------------------------------------------
Tue Jan 6 08:25:34 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
- Add libsoup2-CVE-2025-14523.patch: Reject duplicated Host in
headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).
headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!489).
-------------------------------------------------------------------
Wed Jun 18 16:47:42 UTC 2025 - Michael Gorse <mgorse@suse.com>

6
libsoup2.spec
View File

@@ -1,7 +1,7 @@
#
# spec file for package libsoup2
#
# Copyright (c) 2026 SUSE LLC
# Copyright (c) 2025 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -84,6 +84,10 @@ Patch27: libsoup-CVE-2025-4945.patch
Patch28: libsoup2-CVE-2025-14523.patch
# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-0719.patch bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493 alynx.zhou@suse.com -- Fix overflow for password md4sum
Patch29: libsoup2-CVE-2026-0719.patch
# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-1761.patch bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496 sckang@suse.com -- multipart: check length of bytes read soup_filter_input_stream_read_until()
Patch30: libsoup2-CVE-2026-1761.patch
# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-0716.patch bsc#1256418, CVE-2026-0716, glgo#GNOME/libsoup!494 mgorse@suse.com -- Fix out-of-bounds read for websocket
Patch31: libsoup2-CVE-2026-0716.patch
BuildRequires: glib-networking
BuildRequires: meson >= 0.50