summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVijay Anusuri <vanusuri@mvista.com>2025-06-13 11:14:47 +0530
committerSteve Sakoman <steve@sakoman.com>2025-06-20 08:06:29 -0700
commit07f522869ca5ca98735e64c234e25b0b00558075 (patch)
treeedeed4947fc5f1c50cdcb9c02ed624f0a2f17c55
parentf49fc9966d78a7273ff2ec07b3f3762b83f2d97c (diff)
downloadpoky-07f522869ca5ca98735e64c234e25b0b00558075.tar.gz
libsoup: Fix CVE-2025-2784
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/242a10fbb12dbdc12d254bd8fc8669a0ac055304 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/c415ad0b6771992e66c70edf373566c6e247089d] https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/435 (From OE-Core rev: b51135e1f7eaa20c97e54f5c52b98963819127e9) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-support/libsoup/libsoup/CVE-2025-2784-1.patch73
-rw-r--r--meta/recipes-support/libsoup/libsoup/CVE-2025-2784-2.patch140
-rw-r--r--meta/recipes-support/libsoup/libsoup_3.0.7.bb2
3 files changed, 215 insertions, 0 deletions
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-2784-1.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-2784-1.patch
new file mode 100644
index 0000000000..d46886c57f
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-2784-1.patch
@@ -0,0 +1,73 @@
1From 242a10fbb12dbdc12d254bd8fc8669a0ac055304 Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Wed, 5 Feb 2025 14:39:42 -0600
4Subject: [PATCH] sniffer: Fix potential overflow
5
6Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/242a10fbb12dbdc12d254bd8fc8669a0ac055304]
7CVE: CVE-2025-2784
8Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
9---
10 libsoup/content-sniffer/soup-content-sniffer.c | 2 +-
11 tests/meson.build | 4 +++-
12 tests/sniffing-test.c | 5 +++++
13 tests/soup-tests.gresource.xml | 1 +
14 4 files changed, 10 insertions(+), 2 deletions(-)
15
16diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
17index d7c46c8..648ea04 100644
18--- a/libsoup/content-sniffer/soup-content-sniffer.c
19+++ b/libsoup/content-sniffer/soup-content-sniffer.c
20@@ -666,7 +666,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, GBytes *buffer)
21 pos = 3;
22
23 look_for_tag:
24- if (pos > resource_length)
25+ if (pos >= resource_length)
26 goto text_html;
27
28 if (skip_insignificant_space (resource, &pos, resource_length))
29diff --git a/tests/meson.build b/tests/meson.build
30index 7851e57..450becb 100644
31--- a/tests/meson.build
32+++ b/tests/meson.build
33@@ -92,7 +92,9 @@ tests = [
34 {'name': 'session'},
35 {'name': 'server-auth'},
36 {'name': 'server'},
37- {'name': 'sniffing'},
38+ {'name': 'sniffing',
39+ 'depends': [test_resources],
40+ },
41 {'name': 'socket'},
42 {'name': 'ssl',
43 'dependencies': [gnutls_dep],
44diff --git a/tests/sniffing-test.c b/tests/sniffing-test.c
45index 6116719..b542817 100644
46--- a/tests/sniffing-test.c
47+++ b/tests/sniffing-test.c
48@@ -512,6 +512,11 @@ main (int argc, char **argv)
49 "type/text_html; charset=UTF-8/test.html => text/html; charset=UTF-8",
50 do_sniffing_test);
51
52+ /* Test hitting skip_insignificant_space() with number of bytes equaling resource_length. */
53+ g_test_add_data_func ("/sniffing/whitespace",
54+ "type/text_html/whitespace.html => text/html",
55+ do_sniffing_test);
56+
57 /* Test that disabling the sniffer works correctly */
58 g_test_add_data_func ("/sniffing/disabled",
59 "/text_or_binary/home.gif",
60diff --git a/tests/soup-tests.gresource.xml b/tests/soup-tests.gresource.xml
61index 9c08d17..cbef1d4 100644
62--- a/tests/soup-tests.gresource.xml
63+++ b/tests/soup-tests.gresource.xml
64@@ -25,5 +25,6 @@
65 <file>resources/text.txt</file>
66 <file>resources/text_binary.txt</file>
67 <file>resources/tux.webp</file>
68+ <file>resources/whitespace.html</file>
69 </gresource>
70 </gresources>
71--
722.25.1
73
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-2784-2.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-2784-2.patch
new file mode 100644
index 0000000000..5ac837f9b8
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-2784-2.patch
@@ -0,0 +1,140 @@
1From c415ad0b6771992e66c70edf373566c6e247089d Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Tue, 18 Feb 2025 14:29:50 -0600
4Subject: [PATCH] sniffer: Add better coverage of skip_insignificant_space()
5
6Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/c415ad0b6771992e66c70edf373566c6e247089d]
7CVE: CVE-2025-2784
8Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
9---
10 .../content-sniffer/soup-content-sniffer.c | 10 ++--
11 tests/sniffing-test.c | 53 +++++++++++++++++--
12 tests/soup-tests.gresource.xml | 1 -
13 3 files changed, 53 insertions(+), 11 deletions(-)
14
15diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
16index 648ea04..ebe8f6d 100644
17--- a/libsoup/content-sniffer/soup-content-sniffer.c
18+++ b/libsoup/content-sniffer/soup-content-sniffer.c
19@@ -635,8 +635,11 @@ sniff_text_or_binary (SoupContentSniffer *sniffer, GBytes *buffer)
20 }
21
22 static gboolean
23-skip_insignificant_space (const char *resource, int *pos, int resource_length)
24+skip_insignificant_space (const char *resource, gsize *pos, gsize resource_length)
25 {
26+ if (*pos >= resource_length)
27+ return TRUE;
28+
29 while ((resource[*pos] == '\x09') ||
30 (resource[*pos] == '\x20') ||
31 (resource[*pos] == '\x0A') ||
32@@ -656,7 +659,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, GBytes *buffer)
33 gsize resource_length;
34 const char *resource = g_bytes_get_data (buffer, &resource_length);
35 resource_length = MIN (512, resource_length);
36- int pos = 0;
37+ gsize pos = 0;
38
39 if (resource_length < 3)
40 goto text_html;
41@@ -666,9 +669,6 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, GBytes *buffer)
42 pos = 3;
43
44 look_for_tag:
45- if (pos >= resource_length)
46- goto text_html;
47-
48 if (skip_insignificant_space (resource, &pos, resource_length))
49 goto text_html;
50
51diff --git a/tests/sniffing-test.c b/tests/sniffing-test.c
52index b542817..7857732 100644
53--- a/tests/sniffing-test.c
54+++ b/tests/sniffing-test.c
55@@ -342,6 +342,52 @@ test_disabled (gconstpointer data)
56 g_uri_unref (uri);
57 }
58
59+static const gsize MARKUP_LENGTH = strlen ("<!--") + strlen ("-->");
60+
61+static void
62+do_skip_whitespace_test (void)
63+{
64+ SoupContentSniffer *sniffer = soup_content_sniffer_new ();
65+ SoupMessage *msg = soup_message_new (SOUP_METHOD_GET, "http://example.org");
66+ const char *test_cases[] = {
67+ "",
68+ "<rdf:RDF",
69+ "<rdf:RDFxmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"",
70+ "<rdf:RDFxmlns=\"http://purl.org/rss/1.0/\"",
71+ };
72+
73+ soup_message_headers_set_content_type (soup_message_get_response_headers (msg), "text/html", NULL);
74+
75+ for (guint i = 0; i < G_N_ELEMENTS (test_cases); i++) {
76+ const char *trailing_data = test_cases[i];
77+ gsize leading_zeros = 512 - MARKUP_LENGTH - strlen (trailing_data);
78+ gsize testsize = MARKUP_LENGTH + leading_zeros + strlen (trailing_data);
79+ guint8 *data = g_malloc0 (testsize);
80+ guint8 *p = data;
81+ char *content_type;
82+ GBytes *buffer;
83+
84+ // Format of <!--[0x00 * $leading_zeros]-->$trailing_data
85+ memcpy (p, "<!--", strlen ("<!--"));
86+ p += strlen ("<!--");
87+ p += leading_zeros;
88+ memcpy (p, "-->", strlen ("-->"));
89+ p += strlen ("-->");
90+ if (strlen (trailing_data))
91+ memcpy (p, trailing_data, strlen (trailing_data));
92+ // Purposefully not NUL terminated.
93+
94+ buffer = g_bytes_new_take (g_steal_pointer (&data), testsize);
95+ content_type = soup_content_sniffer_sniff (sniffer, msg, buffer, NULL);
96+
97+ g_free (content_type);
98+ g_bytes_unref (buffer);
99+ }
100+
101+ g_object_unref (msg);
102+ g_object_unref (sniffer);
103+}
104+
105 int
106 main (int argc, char **argv)
107 {
108@@ -512,16 +558,13 @@ main (int argc, char **argv)
109 "type/text_html; charset=UTF-8/test.html => text/html; charset=UTF-8",
110 do_sniffing_test);
111
112- /* Test hitting skip_insignificant_space() with number of bytes equaling resource_length. */
113- g_test_add_data_func ("/sniffing/whitespace",
114- "type/text_html/whitespace.html => text/html",
115- do_sniffing_test);
116-
117 /* Test that disabling the sniffer works correctly */
118 g_test_add_data_func ("/sniffing/disabled",
119 "/text_or_binary/home.gif",
120 test_disabled);
121
122+ g_test_add_func ("/sniffing/whitespace", do_skip_whitespace_test);
123+
124 ret = g_test_run ();
125
126 g_uri_unref (base_uri);
127diff --git a/tests/soup-tests.gresource.xml b/tests/soup-tests.gresource.xml
128index cbef1d4..9c08d17 100644
129--- a/tests/soup-tests.gresource.xml
130+++ b/tests/soup-tests.gresource.xml
131@@ -25,6 +25,5 @@
132 <file>resources/text.txt</file>
133 <file>resources/text_binary.txt</file>
134 <file>resources/tux.webp</file>
135- <file>resources/whitespace.html</file>
136 </gresource>
137 </gresources>
138--
1392.25.1
140
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index 87ffb34f7d..74110b21c3 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -30,6 +30,8 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
30 file://CVE-2025-32912-1.patch \ 30 file://CVE-2025-32912-1.patch \
31 file://CVE-2025-32912-2.patch \ 31 file://CVE-2025-32912-2.patch \
32 file://CVE-2025-32914.patch \ 32 file://CVE-2025-32914.patch \
33 file://CVE-2025-2784-1.patch \
34 file://CVE-2025-2784-2.patch \
33 " 35 "
34SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8" 36SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
35 37
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-09-04 02:20:06 +0000