Add libsoup2-CVE-2026-1761.patch

libsoup2-CVE-2026-1761.patch

@@ -0,0 +1,12 @@
+Index: libsoup-2.74.3/libsoup/soup-filter-input-stream.c
+===================================================================
+--- libsoup-2.74.3.orig/libsoup/soup-filter-input-stream.c
++++ libsoup-2.74.3/libsoup/soup-filter-input-stream.c
+@@ -272,6 +272,6 @@ soup_filter_input_stream_read_until (Sou
+ 	if (eof && !*got_boundary)
+ 		read_length = MIN (fstream->priv->buf->len, length);
+ 	else
+-		read_length = p - buf;
++		read_length = MIN ((gsize)(p - buf), length);
+ 	return read_from_buf (fstream, buffer, read_length);
+ }

libsoup2.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Tue Feb  3 01:52:48 UTC 2026 - Jonathan Kang <songchuan.kang@suse.com>
+
+- Add libsoup2-CVE-2026-1761.patch: multipart: check length of bytes
+  read soup_filter_input_stream_read_until()
+  (bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496).
+
 -------------------------------------------------------------------
 Wed Jun 18 16:47:42 UTC 2025 - Michael Gorse <mgorse@suse.com>
 

libsoup2.spec

@@ -80,6 +80,8 @@ Patch25:        libsoup-CVE-2025-4948.patch
 Patch26:        libsoup-CVE-2025-4969.patch
 # PATCH-FIX-UPSTREAM libsoup-CVE-2025-4945.patch boo#1243314 mgorse@suse.com -- add value checks for date/time parsing.
 Patch27:        libsoup-CVE-2025-4945.patch
+# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-1761.patch bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496 sckang@suse.com -- multipart: check length of bytes read soup_filter_input_stream_read_until()
+Patch28:        libsoup2-CVE-2026-1761.patch
 
 BuildRequires:  glib-networking
 BuildRequires:  meson >= 0.50