summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch')
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch151
1 files changed, 151 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
new file mode 100644
index 0000000000..a1a130ee3a
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
@@ -0,0 +1,151 @@
1From b4f1dcb89a552fc03bfd0e65830b4f76fdc4a232 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Tue, 21 Apr 2026 17:10:37 +0800
4Subject: [PATCH] Fix CVE-2026-1467
5
6CVE: CVE-2026-1467
7Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/6dfe506618d2d5856618e5c0f85bd93386dc8012]
8
9The original backport patch targets libsoup3. This patch has been
10adapted accordingly for libsoup2, refer the openSUSE patch, see [1]
11
12[1] https://www.suse.com/security/cve/CVE-2026-1467.html
13
14Signed-off-by: Changqing Li <changqing.li@windriver.com>
15---
16 libsoup/soup-auth.c | 2 +-
17 libsoup/soup-message.c | 5 +++-
18 libsoup/soup-uri.c | 60 ++++++++++++++++++++++++++++++++++++++++++
19 libsoup/soup-uri.h | 2 ++
20 4 files changed, 67 insertions(+), 2 deletions(-)
21
22diff --git a/libsoup/soup-auth.c b/libsoup/soup-auth.c
23index 1896aab..e205fe3 100644
24--- a/libsoup/soup-auth.c
25+++ b/libsoup/soup-auth.c
26@@ -535,7 +535,7 @@ GSList *
27 soup_auth_get_protection_space (SoupAuth *auth, SoupURI *source_uri)
28 {
29 g_return_val_if_fail (SOUP_IS_AUTH (auth), NULL);
30- g_return_val_if_fail (source_uri != NULL, NULL);
31+ g_return_val_if_fail (soup_uri_is_valid (source_uri), NULL);
32
33 return SOUP_AUTH_GET_CLASS (auth)->get_protection_space (auth, source_uri);
34 }
35diff --git a/libsoup/soup-message.c b/libsoup/soup-message.c
36index da32b42..cc4f22b 100644
37--- a/libsoup/soup-message.c
38+++ b/libsoup/soup-message.c
39@@ -1044,7 +1044,7 @@ soup_message_new (const char *method, const char *uri_string)
40 uri = soup_uri_new (uri_string);
41 if (!uri)
42 return NULL;
43- if (!uri->host) {
44+ if (!soup_uri_is_valid (uri)) {
45 soup_uri_free (uri);
46 return NULL;
47 }
48@@ -1066,6 +1066,8 @@ soup_message_new (const char *method, const char *uri_string)
49 SoupMessage *
50 soup_message_new_from_uri (const char *method, SoupURI *uri)
51 {
52+ g_return_val_if_fail (soup_uri_is_valid (uri), NULL);
53+
54 return g_object_new (SOUP_TYPE_MESSAGE,
55 SOUP_MESSAGE_METHOD, method,
56 SOUP_MESSAGE_URI, uri,
57@@ -1676,6 +1678,7 @@ soup_message_set_uri (SoupMessage *msg, SoupURI *uri)
58 SoupMessagePrivate *priv;
59
60 g_return_if_fail (SOUP_IS_MESSAGE (msg));
61+ g_return_if_fail (soup_uri_is_valid (uri));
62 priv = soup_message_get_instance_private (msg);
63
64 if (priv->uri)
65diff --git a/libsoup/soup-uri.c b/libsoup/soup-uri.c
66index bdb7a17..d781ff1 100644
67--- a/libsoup/soup-uri.c
68+++ b/libsoup/soup-uri.c
69@@ -1342,6 +1342,66 @@ soup_uri_host_equal (gconstpointer v1, gconstpointer v2)
70 return g_ascii_strcasecmp (one->host, two->host) == 0;
71 }
72
73+static gboolean
74+is_valid_character_for_host (char c)
75+{
76+ static const char forbidden_chars[] = { '\t', '\n', '\r', ' ', '#', '/', ':', '<', '>', '?', '@', '[', '\\', ']', '^', '|' };
77+ int i;
78+
79+ for (i = 0; i < G_N_ELEMENTS (forbidden_chars); ++i) {
80+ if (c == forbidden_chars[i])
81+ return FALSE;
82+ }
83+
84+ return TRUE;
85+}
86+
87+static gboolean
88+is_host_valid (const char* host)
89+{
90+ int i;
91+ gboolean is_valid;
92+ char *ascii_host = NULL;
93+
94+ if (!host || !host[0])
95+ return FALSE;
96+
97+ if (g_hostname_is_non_ascii (host)) {
98+ ascii_host = g_hostname_to_ascii (host);
99+ if (!ascii_host)
100+ return FALSE;
101+
102+ host = ascii_host;
103+ }
104+
105+ if ((g_ascii_isdigit (host[0]) || strchr (host, ':')) && g_hostname_is_ip_address (host)) {
106+ g_free (ascii_host);
107+ return TRUE;
108+ }
109+ is_valid = TRUE;
110+ for (i = 0; host[i] && is_valid; i++)
111+ is_valid = is_valid_character_for_host (host[i]);
112+
113+ g_free (ascii_host);
114+
115+ return is_valid;
116+}
117+
118+gboolean
119+soup_uri_is_valid (SoupURI *uri)
120+{
121+ if (!uri)
122+ return FALSE;
123+
124+ if (!is_host_valid (soup_uri_get_host (uri)))
125+ return FALSE;
126+
127+ /* FIXME: validate other URI components? */
128+
129+ return TRUE;
130+}
131+
132+
133 gboolean
134 soup_uri_is_http (SoupURI *uri, char **aliases)
135 {
136diff --git a/libsoup/soup-uri.h b/libsoup/soup-uri.h
137index 8015e4f..64099c3 100644
138--- a/libsoup/soup-uri.h
139+++ b/libsoup/soup-uri.h
140@@ -133,6 +133,8 @@ guint soup_uri_host_hash (gconstpointer key);
141 SOUP_AVAILABLE_IN_2_28
142 gboolean soup_uri_host_equal (gconstpointer v1,
143 gconstpointer v2);
144+SOUP_AVAILABLE_IN_2_68
145+gboolean soup_uri_is_valid (SoupURI *uri);
146
147 #define SOUP_URI_IS_VALID(uri) ((uri) && (uri)->scheme && (uri)->path)
148 #define SOUP_URI_VALID_FOR_HTTP(uri) ((uri) && ((uri)->scheme == SOUP_URI_SCHEME_HTTP || (uri)->scheme == SOUP_URI_SCHEME_HTTPS) && (uri)->host && (uri)->path)
149--
1502.34.1
151
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-30 18:16:58 +0000