3 files changed, 118 insertions, 0 deletions
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch
new file mode 100644
index 0000000000..4e1d8212f5
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch
@@ -0,0 +1,72 @@
+From 7b4ef0e004ece3a308ccfaa714c284f4c96ade34 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Fri, 27 Dec 2024 17:53:50 -0600
+Subject: [PATCH] soup_message_headers_get_content_disposition: Fix NULL deref
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/7b4ef0e004ece3a308ccfaa714c284f4c96ade34]
+CVE: CVE-2025-32911 CVE-2025-32913 #Dependency Patch
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/soup-message-headers.c | 13 +++++++++----
+ tests/header-parsing-test.c    | 14 ++++++++++++++
+ 2 files changed, 23 insertions(+), 4 deletions(-)
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index 56cc1e9d..04f4c302 100644
+--- a/libsoup/soup-message-headers.c
+++ b/libsoup/soup-message-headers.c
+@@ -1660,10 +1660,15 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders  *hdrs,
+         */
+        if (params && g_hash_table_lookup_extended (*params, "filename",
+                                                    &orig_key, &orig_value)) {
+-               char *filename = strrchr (orig_value, '/');
+-
+-               if (filename)
+-                       g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
+                if (orig_value) {
+                        char *filename = strrchr (orig_value, '/');
+
+                        if (filename)
+                                g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
+                } else {
+                        /* filename with no value isn't valid. */
+                        g_hash_table_remove (*params, "filename");
+                }
+        }
+        return TRUE;
+ }
+diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
+index 5e423d2b..d0b360c8 100644
+--- a/tests/header-parsing-test.c
+++ b/tests/header-parsing-test.c
+@@ -1039,6 +1039,7 @@ do_param_list_tests (void)
+ #define RFC5987_TEST_HEADER_FALLBACK "attachment; filename*=Unknown''t%FF%FF%FFst.txt; filename=\"test.txt\""
+ #define RFC5987_TEST_HEADER_NO_TYPE  "filename=\"test.txt\""
+ #define RFC5987_TEST_HEADER_NO_TYPE_2  "filename=\"test.txt\"; foo=bar"
+#define RFC5987_TEST_HEADER_EMPTY_FILENAME ";filename"
+ 
+ static void
+ do_content_disposition_tests (void)
+@@ -1139,6 +1140,19 @@ do_content_disposition_tests (void)
+         g_assert_cmpstr (parameter2, ==, "bar");
+        g_hash_table_destroy (params);
+ 
+        /* Empty filename */
+        soup_message_headers_clear (hdrs);
+        soup_message_headers_append (hdrs, "Content-Disposition",
+                                    RFC5987_TEST_HEADER_EMPTY_FILENAME);
+       if (!soup_message_headers_get_content_disposition (hdrs,
+                                                          &disposition,
+                                                          &params)) {
+               soup_test_assert (FALSE, "empty filename decoding FAILED");
+               return;
+       }
+        g_assert_false (g_hash_table_contains (params, "filename"));
+       g_hash_table_destroy (params);
+
+        soup_message_headers_unref (hdrs);
+ 
+        /* Ensure that soup-multipart always quotes filename */
+-- 
+GitLab
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch
new file mode 100644
index 0000000000..5d9f33c736
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch
@@ -0,0 +1,44 @@
+From f4a761fb66512fff59798765e8ac5b9e57dceef0 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Fri, 27 Dec 2024 18:00:39 -0600
+Subject: [PATCH] soup_message_headers_get_content_disposition: strdup
+ truncated filenames
+This table frees the strings it contains.
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/f4a761fb66512fff59798765e8ac5b9e57dceef0]
+CVE: CVE-2025-32911 CVE-2025-32913
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/soup-message-headers.c | 2 +-
+ tests/header-parsing-test.c    | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index 04f4c302..ee7a3cb1 100644
+--- a/libsoup/soup-message-headers.c
+++ b/libsoup/soup-message-headers.c
+@@ -1664,7 +1664,7 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders  *hdrs,
+                         char *filename = strrchr (orig_value, '/');
+ 
+                         if (filename)
+-                                g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
+                                g_hash_table_insert (*params, g_strdup (orig_key), g_strdup (filename + 1));
+                 } else {
+                         /* filename with no value isn't valid. */
+                         g_hash_table_remove (*params, "filename");
+diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
+index d0b360c8..07ea2866 100644
+--- a/tests/header-parsing-test.c
+++ b/tests/header-parsing-test.c
+@@ -1150,6 +1150,7 @@ do_content_disposition_tests (void)
+                soup_test_assert (FALSE, "empty filename decoding FAILED");
+                return;
+        }
+        g_free (disposition);
+         g_assert_false (g_hash_table_contains (params, "filename"));
+        g_hash_table_destroy (params);
+ 
+-- 
+GitLab
diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
index afba5ac12d..167163b91f 100644
--- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
@@ -22,6 +22,8 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
           file://CVE-2025-32910-2.patch \
           file://CVE-2025-32910-3.patch \
           file://CVE-2025-32909.patch \
+           file://CVE-2025-32911_CVE-2025-32913-1.patch \
+           file://CVE-2025-32911_CVE-2025-32913-2.patch \
          "
 SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"

diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch new file mode 100644 index 0000000000..4e1d8212f5 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch
@@ -0,0 +1,72 @@
		1	From 7b4ef0e004ece3a308ccfaa714c284f4c96ade34 Mon Sep 17 00:00:00 2001
		2	From: Patrick Griffis <pgriffis@igalia.com>
		3	Date: Fri, 27 Dec 2024 17:53:50 -0600
		4	Subject: [PATCH] soup_message_headers_get_content_disposition: Fix NULL deref
		5
		6	Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/7b4ef0e004ece3a308ccfaa714c284f4c96ade34]
		7	CVE: CVE-2025-32911 CVE-2025-32913 #Dependency Patch
		8	Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
		9	---
		10	libsoup/soup-message-headers.c \| 13 +++++++++----
		11	tests/header-parsing-test.c \| 14 ++++++++++++++
		12	2 files changed, 23 insertions(+), 4 deletions(-)
		13
		14	diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
		15	index 56cc1e9d..04f4c302 100644
		16	--- a/libsoup/soup-message-headers.c
		17	+++ b/libsoup/soup-message-headers.c
		18	@@ -1660,10 +1660,15 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders *hdrs,
		19	*/
		20	if (params && g_hash_table_lookup_extended (*params, "filename",
		21	&orig_key, &orig_value)) {
		22	- char *filename = strrchr (orig_value, '/');
		23	-
		24	- if (filename)
		25	- g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
		26	+ if (orig_value) {
		27	+ char *filename = strrchr (orig_value, '/');
		28	+
		29	+ if (filename)
		30	+ g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
		31	+ } else {
		32	+ /* filename with no value isn't valid. */
		33	+ g_hash_table_remove (*params, "filename");
		34	+ }
		35	}
		36	return TRUE;
		37	}
		38	diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
		39	index 5e423d2b..d0b360c8 100644
		40	--- a/tests/header-parsing-test.c
		41	+++ b/tests/header-parsing-test.c
		42	@@ -1039,6 +1039,7 @@ do_param_list_tests (void)
		43	#define RFC5987_TEST_HEADER_FALLBACK "attachment; filename*=Unknown''t%FF%FF%FFst.txt; filename=\"test.txt\""
		44	#define RFC5987_TEST_HEADER_NO_TYPE "filename=\"test.txt\""
		45	#define RFC5987_TEST_HEADER_NO_TYPE_2 "filename=\"test.txt\"; foo=bar"
		46	+#define RFC5987_TEST_HEADER_EMPTY_FILENAME ";filename"
		47
		48	static void
		49	do_content_disposition_tests (void)
		50	@@ -1139,6 +1140,19 @@ do_content_disposition_tests (void)
		51	g_assert_cmpstr (parameter2, ==, "bar");
		52	g_hash_table_destroy (params);
		53
		54	+ /* Empty filename */
		55	+ soup_message_headers_clear (hdrs);
		56	+ soup_message_headers_append (hdrs, "Content-Disposition",
		57	+ RFC5987_TEST_HEADER_EMPTY_FILENAME);
		58	+ if (!soup_message_headers_get_content_disposition (hdrs,
		59	+ &disposition,
		60	+ &params)) {
		61	+ soup_test_assert (FALSE, "empty filename decoding FAILED");
		62	+ return;
		63	+ }
		64	+ g_assert_false (g_hash_table_contains (params, "filename"));
		65	+ g_hash_table_destroy (params);
		66	+
		67	soup_message_headers_unref (hdrs);
		68
		69	/* Ensure that soup-multipart always quotes filename */
		70	--
		71	GitLab
		72


diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch new file mode 100644 index 0000000000..5d9f33c736 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch
@@ -0,0 +1,44 @@
		1	From f4a761fb66512fff59798765e8ac5b9e57dceef0 Mon Sep 17 00:00:00 2001
		2	From: Patrick Griffis <pgriffis@igalia.com>
		3	Date: Fri, 27 Dec 2024 18:00:39 -0600
		4	Subject: [PATCH] soup_message_headers_get_content_disposition: strdup
		5	truncated filenames
		6
		7	This table frees the strings it contains.
		8
		9	Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/f4a761fb66512fff59798765e8ac5b9e57dceef0]
		10	CVE: CVE-2025-32911 CVE-2025-32913
		11	Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
		12	---
		13	libsoup/soup-message-headers.c \| 2 +-
		14	tests/header-parsing-test.c \| 1 +
		15	2 files changed, 2 insertions(+), 1 deletion(-)
		16
		17	diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
		18	index 04f4c302..ee7a3cb1 100644
		19	--- a/libsoup/soup-message-headers.c
		20	+++ b/libsoup/soup-message-headers.c
		21	@@ -1664,7 +1664,7 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders *hdrs,
		22	char *filename = strrchr (orig_value, '/');
		23
		24	if (filename)
		25	- g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
		26	+ g_hash_table_insert (*params, g_strdup (orig_key), g_strdup (filename + 1));
		27	} else {
		28	/* filename with no value isn't valid. */
		29	g_hash_table_remove (*params, "filename");
		30	diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
		31	index d0b360c8..07ea2866 100644
		32	--- a/tests/header-parsing-test.c
		33	+++ b/tests/header-parsing-test.c
		34	@@ -1150,6 +1150,7 @@ do_content_disposition_tests (void)
		35	soup_test_assert (FALSE, "empty filename decoding FAILED");
		36	return;
		37	}
		38	+ g_free (disposition);
		39	g_assert_false (g_hash_table_contains (params, "filename"));
		40	g_hash_table_destroy (params);
		41
		42	--
		43	GitLab
		44


diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb b/meta/recipes-support/libsoup/libsoup_3.4.4.bb index afba5ac12d..167163b91f 100644 --- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb +++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
@@ -22,6 +22,8 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
22	file://CVE-2025-32910-2.patch \	22	file://CVE-2025-32910-2.patch \
23	file://CVE-2025-32910-3.patch \	23	file://CVE-2025-32910-3.patch \
24	file://CVE-2025-32909.patch \	24	file://CVE-2025-32909.patch \
		25	file://CVE-2025-32911_CVE-2025-32913-1.patch \
		26	file://CVE-2025-32911_CVE-2025-32913-2.patch \
25	"	27	"
26	SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"	28	SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
27		29