Accepting request 1326752 from GNOME:Factory

- Add libsoup2-CVE-2026-0719.patch: Fix overflow for password
  md4sum (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493). (forwarded request 1326671 from AZhou)

OBS-URL: https://build.opensuse.org/request/show/1326752
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libsoup2?expand=0&rev=18

libsoup2-CVE-2025-14523.patch

@@ -0,0 +1,125 @@
+From ff8829d85b5903d16c4b284ccc75977af20da9ba Mon Sep 17 00:00:00 2001
+From: Alynx Zhou <alynx.zhou@gmail.com>
+Date: Thu, 8 Jan 2026 13:05:33 +0800
+Subject: [PATCH] Reject duplicate Host headers
+
+---
+ libsoup/soup-headers.c                 |  4 +++-
+ libsoup/soup-message-headers-private.h | 10 ++++++++++
+ libsoup/soup-message-headers.c         | 27 ++++++++++++++++++++------
+ 3 files changed, 34 insertions(+), 7 deletions(-)
+ create mode 100644 libsoup/soup-message-headers-private.h
+
+diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
+index cc481cfa..b58f3855 100644
+--- a/libsoup/soup-headers.c
++++ b/libsoup/soup-headers.c
+@@ -14,6 +14,7 @@
+ 
+ #include "soup-headers.h"
+ #include "soup.h"
++#include "soup-message-headers-private.h"
+ 
+ /**
+  * soup_headers_parse:
+@@ -138,7 +139,8 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest)
+ 		for (p = strchr (value, '\r'); p; p = strchr (p, '\r'))
+ 			*p = ' ';
+ 
+-		soup_message_headers_append (dest, name, value);
++		if (!soup_message_headers_append_internal (dest, name, value))
++			goto done;
+         }
+ 	success = TRUE;
+ 
+diff --git a/libsoup/soup-message-headers-private.h b/libsoup/soup-message-headers-private.h
+new file mode 100644
+index 00000000..62a4e511
+--- /dev/null
++++ b/libsoup/soup-message-headers-private.h
+@@ -0,0 +1,10 @@
++#ifndef __SOUP_MESSAGE_HEADERS_PRIVATE_H__
++#define __SOUP_MESSAGE_HEADERS_PRIVATE_H__ 1
++
++#include "soup-message-headers.h"
++
++gboolean
++soup_message_headers_append_internal (SoupMessageHeaders *hdrs,
++				      const char *name, const char *value);
++
++#endif
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index 39ad14a0..160a52dc 100644
+--- a/libsoup/soup-message-headers.c
++++ b/libsoup/soup-message-headers.c
+@@ -13,6 +13,7 @@
+ 
+ #include "soup-message-headers.h"
+ #include "soup.h"
++#include "soup-message-headers-private.h"
+ #include "soup-misc-private.h"
+ 
+ /**
+@@ -194,12 +195,20 @@ soup_message_headers_clean_connection_headers (SoupMessageHeaders *hdrs)
+ void
+ soup_message_headers_append (SoupMessageHeaders *hdrs,
+ 			     const char *name, const char *value)
++{
++	soup_message_headers_append_internal (hdrs, name, value);
++}
++
++gboolean
++soup_message_headers_append_internal (SoupMessageHeaders *hdrs,
++				      const char *name, const char *value)
+ {
+ 	SoupHeader header;
+ 	SoupHeaderSetter setter;
++	const char *interned_host = intern_header_name ("Host", NULL);
+ 
+-	g_return_if_fail (name != NULL);
+-	g_return_if_fail (value != NULL);
++	g_return_val_if_fail (name != NULL, FALSE);
++	g_return_val_if_fail (value != NULL, FALSE);
+ 
+ 	/* Setting a syntactically invalid header name or value is
+ 	 * considered to be a programming error. However, it can also
+@@ -207,26 +216,32 @@ soup_message_headers_append (SoupMessageHeaders *hdrs,
+ 	 * compiled with G_DISABLE_CHECKS.
+ 	 */
+ #ifndef G_DISABLE_CHECKS
+-	g_return_if_fail (*name && strpbrk (name, " \t\r\n:") == NULL);
+-	g_return_if_fail (strpbrk (value, "\r\n") == NULL);
++	g_return_val_if_fail (*name && strpbrk (name, " \t\r\n:") == NULL, FALSE);
++	g_return_val_if_fail (strpbrk (value, "\r\n") == NULL, FALSE);
+ #else
+ 	if (*name && strpbrk (name, " \t\r\n:")) {
+ 		g_warning ("soup_message_headers_append: Ignoring bad name '%s'", name);
+-		return;
++		return FALSE;
+ 	}
+ 	if (strpbrk (value, "\r\n")) {
+ 		g_warning ("soup_message_headers_append: Ignoring bad value '%s'", value);
+-		return;
++		return FALSE;
+ 	}
+ #endif
+ 
+ 	header.name = intern_header_name (name, &setter);
++	if (header.name == interned_host && soup_message_headers_get_one(hdrs, "Host")) {
++		g_warning ("Attempted to add duplicate Host header to a SoupMessageHeaders that already contains a Host header");
++		return FALSE;
++	}
+ 	header.value = g_strdup (value);
+ 	g_array_append_val (hdrs->array, header);
+ 	if (hdrs->concat)
+ 		g_hash_table_remove (hdrs->concat, header.name);
+ 	if (setter)
+ 		setter (hdrs, header.value);
++
++	return TRUE;
+ }
+ 
+ /**
+-- 
+2.52.0
+

libsoup2-CVE-2026-0719.patch

@@ -0,0 +1,50 @@
+diff --unified --recursive --text --new-file --color libsoup-2.74.3/libsoup/soup-auth-ntlm.c libsoup-2.74.3.new/libsoup/soup-auth-ntlm.c
+--- libsoup-2.74.3/libsoup/soup-auth-ntlm.c	2022-10-12 02:27:22.000000000 +0800
++++ libsoup-2.74.3.new/libsoup/soup-auth-ntlm.c	2026-01-12 10:26:03.168118541 +0800
+@@ -594,7 +594,7 @@
+ }
+ 
+ static void md4sum                (const unsigned char *in, 
+-				   int                  nbytes, 
++				   size_t               nbytes, 
+ 				   unsigned char        digest[16]);
+ 
+ typedef guint32 DES_KS[16][2]; /* Single-key DES key schedule */
+@@ -640,7 +640,7 @@
+ {
+ 	unsigned char *buf, *p;
+ 
+-	p = buf = g_malloc (strlen (password) * 2);
++	p = buf = g_malloc_n (strlen (password), 2);
+ 
+ 	while (*password) {
+ 		*p++ = *password++;
+@@ -1079,15 +1079,16 @@
+ #define ROT(val, n) ( ((val) << (n)) | ((val) >> (32 - (n))) )
+ 
+ static void
+-md4sum (const unsigned char *in, int nbytes, unsigned char digest[16])
++md4sum (const unsigned char *in, size_t nbytes, unsigned char digest[16])
+ {
+ 	unsigned char *M;
+ 	guint32 A, B, C, D, AA, BB, CC, DD, X[16];
+-	int pbytes, nbits = nbytes * 8, i, j;
++	size_t pbytes, nbits = nbytes * 8;
++	int i, j;
+ 
+ 	/* There is *always* padding of at least one bit. */
+ 	pbytes = ((119 - (nbytes % 64)) % 64) + 1;
+-	M = alloca (nbytes + pbytes + 8);
++	M = g_malloc (nbytes + pbytes + 8);
+ 	memcpy (M, in, nbytes);
+ 	memset (M + nbytes, 0, pbytes + 8);
+ 	M[nbytes] = 0x80;
+@@ -1187,6 +1188,8 @@
+ 	digest[13] = (D >>  8) & 0xFF;
+ 	digest[14] = (D >> 16) & 0xFF;
+ 	digest[15] = (D >> 24) & 0xFF;
++
++	g_free (M);
+ }
+ 
+ 

libsoup2-CVE-2026-1761.patch

@@ -1,12 +0,0 @@
-Index: libsoup-2.74.3/libsoup/soup-filter-input-stream.c
-===================================================================
---- libsoup-2.74.3.orig/libsoup/soup-filter-input-stream.c
-+++ libsoup-2.74.3/libsoup/soup-filter-input-stream.c
-@@ -272,6 +272,6 @@ soup_filter_input_stream_read_until (Sou
- 	if (eof && !*got_boundary)
- 		read_length = MIN (fstream->priv->buf->len, length);
- 	else
--		read_length = p - buf;
-+		read_length = MIN ((gsize)(p - buf), length);
- 	return read_from_buf (fstream, buffer, read_length);
- }

libsoup2.changes

@@ -1,9 +1,14 @@
 -------------------------------------------------------------------
-Tue Feb  3 01:52:48 UTC 2026 - Jonathan Kang <songchuan.kang@suse.com>
+Fri Jan  9 02:52:21 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
 
-- Add libsoup2-CVE-2026-1761.patch: multipart: check length of bytes
-  read soup_filter_input_stream_read_until()
-  (bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496).
+- Add libsoup2-CVE-2026-0719.patch: Fix overflow for password
+  md4sum (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493).
+
+-------------------------------------------------------------------
+Thu Jan  8 05:11:30 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
+
+- Add libsoup2-CVE-2025-14523.patch: Reject duplicated Host in
+  headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).
 
 -------------------------------------------------------------------
 Wed Jun 18 16:47:42 UTC 2025 - Michael Gorse <mgorse@suse.com>

libsoup2.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package libsoup2
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -80,8 +80,10 @@ Patch25:        libsoup-CVE-2025-4948.patch
 Patch26:        libsoup-CVE-2025-4969.patch
 # PATCH-FIX-UPSTREAM libsoup-CVE-2025-4945.patch boo#1243314 mgorse@suse.com -- add value checks for date/time parsing.
 Patch27:        libsoup-CVE-2025-4945.patch
-# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-1761.patch bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496 sckang@suse.com -- multipart: check length of bytes read soup_filter_input_stream_read_until()
-Patch28:        libsoup2-CVE-2026-1761.patch
+# PATCH-FIX-UPSTREAM libsoup2-CVE-2025-14523.patch bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491 alynx.zhou@suse.com -- Reject duplicated Host in headers
+Patch28:        libsoup2-CVE-2025-14523.patch
+# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-0719.patch bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493 alynx.zhou@suse.com -- Fix overflow for password md4sum
+Patch29:        libsoup2-CVE-2026-0719.patch
 
 BuildRequires:  glib-networking
 BuildRequires:  meson >= 0.50