From 07757b7feacfc660c6c463ff2b773c13bc42d2c9 Mon Sep 17 00:00:00 2001
From: Changqing Li <changqing.li@windriver.com>
Date: Thu, 19 Mar 2026 17:21:32 +0800
Subject: [PATCH 3/4] multipart: check length of bytes read
 soup_filter_input_stream_read_until()

We do make sure the read length is smaller than the buffer length when
the boundary is not found, but we should do the same when the boundary
is found.

Spotted in #YWH-PGM9867-149
Closes #493

Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/cfa9d90d1a5c274233554a264c56551c13d6a6f0]
CVE: CVE-2026-1761

Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
 libsoup/soup-filter-input-stream.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libsoup/soup-filter-input-stream.c b/libsoup/soup-filter-input-stream.c
index 2c30bf9..c34510b 100644
--- a/libsoup/soup-filter-input-stream.c
+++ b/libsoup/soup-filter-input-stream.c
@@ -272,6 +272,6 @@ soup_filter_input_stream_read_until (SoupFilterInputStream  *fstream,
 	if (eof && !*got_boundary)
 		read_length = MIN (fstream->priv->buf->len, length);
 	else
-		read_length = p - buf;
+		read_length = MIN ((gsize)(p - buf), length);
 	return read_from_buf (fstream, buffer, read_length);
 }
-- 
2.34.1

