From f9c933e258e9ef2f221cca6395f8092a1c4b93dd Mon Sep 17 00:00:00 2001
From: Changqing Li <changqing.li@windriver.com>
Date: Thu, 19 Mar 2026 17:10:36 +0800
Subject: [PATCH 2/4] Fix CVE-2026-1801

This patch merges 3 upstream patches

Chery-pick the first two patches to make the context is the same as the
third patch that fix CVE-2026-1801

Upstream-Status: Backport
[https://gitlab.gnome.org/GNOME/libsoup/-/commit/1e32b5e123aa1689505472bdbfcbd897eac41977,
https://gitlab.gnome.org/GNOME/libsoup/-/commit/8a2e15c88512ae4517d2c2c887d39299725b22da,
https://gitlab.gnome.org/GNOME/libsoup/-/commit/b9a1c0663ff8ab6e79715db4b35b54f560416ddd]
CVE: CVE-2026-1801

Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
 libsoup/soup-body-input-stream.c | 66 ++++++++++++++++++++------------
 1 file changed, 41 insertions(+), 25 deletions(-)

diff --git a/libsoup/soup-body-input-stream.c b/libsoup/soup-body-input-stream.c
index 6b95884..25d9312 100644
--- a/libsoup/soup-body-input-stream.c
+++ b/libsoup/soup-body-input-stream.c
@@ -159,15 +159,18 @@ soup_body_input_stream_read_chunked (SoupBodyInputStream  *bistream,
 again:
 	switch (bistream->priv->chunked_state) {
 	case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_SIZE:
-		nread = soup_filter_input_stream_read_line (
-			fstream, metabuf, sizeof (metabuf), blocking,
-			&got_line, cancellable, error);
-		if (nread <= 0)
+		nread = soup_filter_input_stream_read_until (
+				fstream, metabuf, sizeof (metabuf),
+				"\r\n", 2, blocking, TRUE,
+				&got_line, cancellable, error);
+		if (nread < 0)
 			return nread;
-		if (!got_line) {
-			g_set_error_literal (error, G_IO_ERROR,
-					     G_IO_ERROR_PARTIAL_INPUT,
-					     _("Connection terminated unexpectedly"));
+		if (nread == 0 || !got_line) {
+			if (error && *error == NULL) {
+				g_set_error_literal (error, G_IO_ERROR,
+									G_IO_ERROR_PARTIAL_INPUT,
+									("Connection terminated unexpectedly"));
+			}
 			return -1;
 		}
 
@@ -180,9 +183,9 @@ again:
 
 	case SOUP_BODY_INPUT_STREAM_STATE_CHUNK:
 		nread = soup_body_input_stream_read_raw (
-			bistream, buffer,
-			MIN (count, bistream->priv->read_length),
-			blocking, cancellable, error);
+				bistream, buffer,
+				MIN (count, bistream->priv->read_length),
+				blocking, cancellable, error);
 		if (nread > 0) {
 			bistream->priv->read_length -= nread;
 			if (bistream->priv->read_length == 0)
@@ -191,16 +194,19 @@ again:
 		return nread;
 
 	case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_END:
-		nread = soup_filter_input_stream_read_line (
-			SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream),
-			metabuf, sizeof (metabuf), blocking,
-			&got_line, cancellable, error);
-		if (nread <= 0)
+		nread = soup_filter_input_stream_read_until (
+				SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream),
+				metabuf, sizeof (metabuf),
+				"\r\n", 2, blocking, TRUE,
+				&got_line, cancellable, error);
+		if (nread < 0)
 			return nread;
-		if (!got_line) {
-			g_set_error_literal (error, G_IO_ERROR,
-					     G_IO_ERROR_PARTIAL_INPUT,
-					     _("Connection terminated unexpectedly"));
+		if (nread == 0 || !got_line) {
+			if (error && *error == NULL) {
+				g_set_error_literal (error, G_IO_ERROR,
+				G_IO_ERROR_PARTIAL_INPUT,
+				_("Connection terminated unexpectedly"));
+			}
 			return -1;
 		}
 
@@ -208,13 +214,23 @@ again:
 		break;
 
 	case SOUP_BODY_INPUT_STREAM_STATE_TRAILERS:
-		nread = soup_filter_input_stream_read_line (
-			fstream, buffer, count, blocking,
-			&got_line, cancellable, error);
-		if (nread <= 0)
+		nread = soup_filter_input_stream_read_until (
+				fstream, metabuf, sizeof (metabuf),
+				"\r\n", 2, blocking, TRUE,
+				&got_line, cancellable, error);
+		if (nread < 0)
 			return nread;
 
-		if (strncmp (buffer, "\r\n", nread) || strncmp (buffer, "\n", nread)) {
+		if (nread == 0) {
+			if (error && *error == NULL) {
+				g_set_error_literal (error, G_IO_ERROR,
+				G_IO_ERROR_PARTIAL_INPUT,
+				_("Connection terminated unexpectedly"));
+			}
+			return -1;
+		}
+
+		if (nread == 2 && strncmp (metabuf, "\r\n", nread) == 0) {
 			bistream->priv->chunked_state = SOUP_BODY_INPUT_STREAM_STATE_DONE;
 			bistream->priv->eof = TRUE;
 		}
-- 
2.34.1

