summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch')
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch229
1 files changed, 229 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch
new file mode 100644
index 0000000000..64e87cb1ec
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch
@@ -0,0 +1,229 @@
1From c574e659c41c18fad3973bbaa3b3ec75664b3137 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 5 Feb 2026 16:20:02 +0800
4Subject: [PATCH 1/2] websocket: add a way to restrict the total message size
5
6Otherwise a client could send small packages smaller than
7total-incoming-payload-size but still to break the server
8with a big allocation
9
10Fixes: #390
11
12Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/db87805ab565d67533dfed2cb409dbfd63c7fdce]
13CVE: CVE-2025-32049
14
15libsoup2 is not maintained, the patch is backported from libsoup3, and
16change accordingly
17
18Signed-off-by: Changqing Li <changqing.li@windriver.com>
19---
20 libsoup/soup-websocket-connection.c | 104 ++++++++++++++++++++++++++--
21 libsoup/soup-websocket-connection.h | 7 ++
22 2 files changed, 107 insertions(+), 4 deletions(-)
23
24diff --git a/libsoup/soup-websocket-connection.c b/libsoup/soup-websocket-connection.c
25index 9d5f4f8..3dad477 100644
26--- a/libsoup/soup-websocket-connection.c
27+++ b/libsoup/soup-websocket-connection.c
28@@ -85,7 +85,8 @@ enum {
29 PROP_STATE,
30 PROP_MAX_INCOMING_PAYLOAD_SIZE,
31 PROP_KEEPALIVE_INTERVAL,
32- PROP_EXTENSIONS
33+ PROP_EXTENSIONS,
34+ PROP_MAX_TOTAL_MESSAGE_SIZE,
35 };
36
37 enum {
38@@ -120,6 +121,7 @@ struct _SoupWebsocketConnectionPrivate {
39 char *origin;
40 char *protocol;
41 guint64 max_incoming_payload_size;
42+ guint64 max_total_message_size;
43 guint keepalive_interval;
44
45 gushort peer_close_code;
46@@ -152,6 +154,7 @@ struct _SoupWebsocketConnectionPrivate {
47 };
48
49 #define MAX_INCOMING_PAYLOAD_SIZE_DEFAULT 128 * 1024
50+#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT 128 * 1024
51 #define READ_BUFFER_SIZE 1024
52 #define MASK_LENGTH 4
53
54@@ -664,7 +667,7 @@ bad_data_error_and_close (SoupWebsocketConnection *self)
55 }
56
57 static void
58-too_big_error_and_close (SoupWebsocketConnection *self,
59+too_big_incoming_payload_error_and_close (SoupWebsocketConnection *self,
60 guint64 payload_len)
61 {
62 GError *error;
63@@ -680,6 +683,23 @@ too_big_error_and_close (SoupWebsocketConnection *self,
64 emit_error_and_close (self, error, TRUE);
65 }
66
67+static void
68+too_big_message_error_and_close (SoupWebsocketConnection *self,
69+ guint64 len)
70+{
71+ GError *error;
72+
73+ error = g_error_new_literal (SOUP_WEBSOCKET_ERROR,
74+ SOUP_WEBSOCKET_CLOSE_TOO_BIG,
75+ self->pv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ?
76+ "Received WebSocket payload from the client larger than configured max-total-message-size" :
77+ "Received WebSocket payload from the server larger than configured max-total-message-size");
78+ g_debug ("%s received message of size %" G_GUINT64_FORMAT " or greater, but max supported size is %" G_GUINT64_FORMAT,
79+ self->pv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ? "server" : "client",
80+ len, self->pv->max_total_message_size);
81+ emit_error_and_close (self, error, TRUE);
82+}
83+
84 static void
85 close_connection (SoupWebsocketConnection *self,
86 gushort code,
87@@ -913,6 +933,12 @@ process_contents (SoupWebsocketConnection *self,
88 switch (pv->message_opcode) {
89 case 0x01:
90 case 0x02:
91+ /* Safety valve */
92+ if (pv->max_total_message_size > 0 &&
93+ (pv->message_data->len + payload_len) > pv->max_total_message_size) {
94+ too_big_message_error_and_close (self, (pv->message_data->len + payload_len));
95+ return;
96+ }
97 g_byte_array_append (pv->message_data, payload, payload_len);
98 break;
99 default:
100@@ -1050,7 +1076,7 @@ process_frame (SoupWebsocketConnection *self)
101 /* Safety valve */
102 if (self->pv->max_incoming_payload_size > 0 &&
103 payload_len >= self->pv->max_incoming_payload_size) {
104- too_big_error_and_close (self, payload_len);
105+ too_big_incoming_payload_error_and_close (self, payload_len);
106 return FALSE;
107 }
108
109@@ -1357,6 +1383,10 @@ soup_websocket_connection_get_property (GObject *object,
110 g_value_set_pointer (value, pv->extensions);
111 break;
112
113+ case PROP_MAX_TOTAL_MESSAGE_SIZE:
114+ g_value_set_uint64 (value, pv->max_total_message_size);
115+ break;
116+
117 default:
118 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
119 break;
120@@ -1410,6 +1440,10 @@ soup_websocket_connection_set_property (GObject *object,
121 pv->extensions = g_value_get_pointer (value);
122 break;
123
124+ case PROP_MAX_TOTAL_MESSAGE_SIZE:
125+ pv->max_total_message_size = g_value_get_uint64 (value);
126+ break;
127+
128 default:
129 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
130 break;
131@@ -1631,7 +1665,24 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass)
132 G_PARAM_READWRITE |
133 G_PARAM_CONSTRUCT_ONLY |
134 G_PARAM_STATIC_STRINGS));
135-
136+ /**
137+ * SoupWebsocketConnection:max-total-message-size:
138+ *
139+ * The total message size for incoming packets.
140+ *
141+ * The protocol expects or 0 to not limit it.
142+ *
143+ */
144+ g_object_class_install_property (gobject_class, PROP_MAX_TOTAL_MESSAGE_SIZE,
145+ g_param_spec_uint64 ("max-total-message-size",
146+ "Max total message size",
147+ "Max total message size ",
148+ 0,
149+ G_MAXUINT64,
150+ MAX_TOTAL_MESSAGE_SIZE_DEFAULT,
151+ G_PARAM_READWRITE |
152+ G_PARAM_CONSTRUCT |
153+ G_PARAM_STATIC_STRINGS));
154 /**
155 * SoupWebsocketConnection::message:
156 * @self: the WebSocket
157@@ -2145,6 +2196,51 @@ soup_websocket_connection_set_max_incoming_payload_size (SoupWebsocketConnection
158 }
159 }
160
161+/**
162+ * soup_websocket_connection_get_max_total_message_size:
163+ * @self: the WebSocket
164+ *
165+ * Gets the maximum total message size allowed for packets.
166+ *
167+ * Returns: the maximum total message size.
168+ *
169+ */
170+guint64
171+soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self)
172+{
173+ SoupWebsocketConnectionPrivate *pv;
174+
175+ g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), MAX_TOTAL_MESSAGE_SIZE_DEFAULT);
176+ pv = self->pv;
177+
178+ return pv->max_total_message_size;
179+}
180+
181+/**
182+ * soup_websocket_connection_set_max_total_message_size:
183+ * @self: the WebSocket
184+ * @max_total_message_size: the maximum total message size
185+ *
186+ * Sets the maximum total message size allowed for packets.
187+ *
188+ * It does not limit the outgoing packet size.
189+ *
190+ */
191+void
192+soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self,
193+ guint64 max_total_message_size)
194+{
195+ SoupWebsocketConnectionPrivate *pv;
196+
197+ g_return_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self));
198+ pv = self->pv;
199+
200+ if (pv->max_total_message_size != max_total_message_size) {
201+ pv->max_total_message_size = max_total_message_size;
202+ g_object_notify (G_OBJECT (self), "max-total-message-size");
203+ }
204+}
205+
206 /**
207 * soup_websocket_connection_get_keepalive_interval:
208 * @self: the WebSocket
209diff --git a/libsoup/soup-websocket-connection.h b/libsoup/soup-websocket-connection.h
210index f82d723..d2a60e9 100644
211--- a/libsoup/soup-websocket-connection.h
212+++ b/libsoup/soup-websocket-connection.h
213@@ -136,6 +136,13 @@ SOUP_AVAILABLE_IN_2_58
214 void soup_websocket_connection_set_keepalive_interval (SoupWebsocketConnection *self,
215 guint interval);
216
217+SOUP_AVAILABLE_IN_2_72
218+guint64 soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self);
219+
220+SOUP_AVAILABLE_IN_2_72
221+void soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self,
222+ guint64 max_total_message_size);
223+
224 G_END_DECLS
225
226 #endif /* __SOUP_WEBSOCKET_CONNECTION_H__ */
227--
2282.34.1
229
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-16 11:11:53 +0000