summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch')
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch153
1 files changed, 153 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch
new file mode 100644
index 0000000000..a5547132a2
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch
@@ -0,0 +1,153 @@
1From 0fca37e0fce479284e62091ffb9b7d6caff1c7e4 Mon Sep 17 00:00:00 2001
2From: Carlos Garcia Campos <cgarcia@igalia.com>
3Date: Thu, 29 Jan 2026 16:43:28 +0100
4Subject: [PATCH] server: close the connection after responsing a request
5 containing Content-Length and Transfer-Encoding
6
7Closes #475
8
9Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/6224df5a471e9040a99dd3dc2e91817a701b1bf6]
10CVE: CVE-2026-1760
11
12Signed-off-by: Changqing Li <changqing.li@windriver.com>
13---
14 libsoup/soup-message-headers.c | 86 +++++++++++++++-----------------
15 libsoup/soup-message-server-io.c | 8 +++
16 2 files changed, 49 insertions(+), 45 deletions(-)
17
18diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
19index 535cf14..06d9600 100644
20--- a/libsoup/soup-message-headers.c
21+++ b/libsoup/soup-message-headers.c
22@@ -666,38 +666,13 @@ clear_special_headers (SoupMessageHeaders *hdrs)
23 static void
24 transfer_encoding_setter (SoupMessageHeaders *hdrs, const char *value)
25 {
26- if (value) {
27- /* "identity" is a wrong value according to RFC errata 408,
28- * and RFC 7230 does not list it as valid transfer-coding.
29- * Nevertheless, the obsolete RFC 2616 stated "identity"
30- * as valid, so we can't handle it as unrecognized here
31- * for compatibility reasons.
32- */
33- if (g_ascii_strcasecmp (value, "chunked") == 0)
34- hdrs->encoding = SOUP_ENCODING_CHUNKED;
35- else if (g_ascii_strcasecmp (value, "identity") != 0)
36- hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
37- } else
38- hdrs->encoding = -1;
39+ hdrs->encoding = -1;
40 }
41
42 static void
43 content_length_setter (SoupMessageHeaders *hdrs, const char *value)
44 {
45- /* Transfer-Encoding trumps Content-Length */
46- if (hdrs->encoding == SOUP_ENCODING_CHUNKED)
47- return;
48-
49- if (value) {
50- char *end;
51-
52- hdrs->content_length = g_ascii_strtoull (value, &end, 10);
53- if (*end)
54- hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
55- else
56- hdrs->encoding = SOUP_ENCODING_CONTENT_LENGTH;
57- } else
58- hdrs->encoding = -1;
59+ hdrs->encoding = -1;
60 }
61
62 /**
63@@ -730,29 +705,50 @@ SoupEncoding
64 soup_message_headers_get_encoding (SoupMessageHeaders *hdrs)
65 {
66 const char *header;
67+ const char *content_length;
68+ const char *transfer_encoding;
69
70 if (hdrs->encoding != -1)
71 return hdrs->encoding;
72
73- /* If Transfer-Encoding was set, hdrs->encoding would already
74- * be set. So we don't need to check that possibility.
75- */
76- header = soup_message_headers_get_one (hdrs, "Content-Length");
77- if (header) {
78- content_length_setter (hdrs, header);
79- if (hdrs->encoding != -1)
80- return hdrs->encoding;
81- }
82+ /* Transfer-Encoding is checked first because it overrides the Content-Length */
83+ transfer_encoding = soup_message_headers_get_one (hdrs, "Transfer-Encoding");
84+ if (transfer_encoding) {
85+ /* "identity" is a wrong value according to RFC errata 408,
86+ * and RFC 7230 does not list it as valid transfer-coding.
87+ * Nevertheless, the obsolete RFC 2616 stated "identity"
88+ * as valid, so we can't handle it as unrecognized here
89+ * for compatibility reasons.
90+ */
91+ if (g_ascii_strcasecmp (transfer_encoding, "chunked") == 0)
92+ hdrs->encoding = SOUP_ENCODING_CHUNKED;
93+ else if (g_ascii_strcasecmp (transfer_encoding, "identity") != 0)
94+ hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
95+ } else {
96+ content_length = soup_message_headers_get_one (hdrs, "Content-Length");
97+ if (content_length) {
98+ char *end;
99+
100+ hdrs->content_length = g_ascii_strtoull (content_length, &end, 10);
101+ if (*end)
102+ hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
103+ else
104+ hdrs->encoding = SOUP_ENCODING_CONTENT_LENGTH;
105+ }
106+ }
107+
108+ if (hdrs->encoding == -1) {
109+ /* Per RFC 2616 4.4, a response body that doesn't indicate its
110+ * encoding otherwise is terminated by connection close, and a
111+ * request that doesn't indicate otherwise has no body. Note
112+ * that SoupMessage calls soup_message_headers_set_encoding()
113+ * to override the response body default for our own
114+ * server-side messages.
115+ */
116+ hdrs->encoding = (hdrs->type == SOUP_MESSAGE_HEADERS_RESPONSE) ?
117+ SOUP_ENCODING_EOF : SOUP_ENCODING_NONE;
118+ }
119
120- /* Per RFC 2616 4.4, a response body that doesn't indicate its
121- * encoding otherwise is terminated by connection close, and a
122- * request that doesn't indicate otherwise has no body. Note
123- * that SoupMessage calls soup_message_headers_set_encoding()
124- * to override the response body default for our own
125- * server-side messages.
126- */
127- hdrs->encoding = (hdrs->type == SOUP_MESSAGE_HEADERS_RESPONSE) ?
128- SOUP_ENCODING_EOF : SOUP_ENCODING_NONE;
129 return hdrs->encoding;
130 }
131
132diff --git a/libsoup/soup-message-server-io.c b/libsoup/soup-message-server-io.c
133index 71e943b..df5eafc 100644
134--- a/libsoup/soup-message-server-io.c
135+++ b/libsoup/soup-message-server-io.c
136@@ -80,6 +80,14 @@ parse_request_headers (SoupMessage *msg, char *headers, guint headers_len,
137 return SOUP_STATUS_BAD_REQUEST;
138 }
139
140+ /* A server MAY reject a request that contains both Content-Length and
141+ * Transfer-Encoding or process such a request in accordance with the
142+ * Transfer-Encoding alone. Regardless, the server MUST close the connection
143+ * after responding to such a request to avoid the potential attacks
144+ */
145+ if (*encoding == SOUP_ENCODING_CHUNKED && soup_message_headers_get_one (msg->request_headers, "Content-Length"))
146+ soup_message_headers_replace (msg->request_headers, "Connection", "close");
147+
148 /* Generate correct context for request */
149 req_host = soup_message_headers_get_one (msg->request_headers, "Host");
150 if (req_host && strchr (req_host, '/')) {
151--
1522.34.1
153
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-30 18:15:44 +0000