From 242a10fbb12dbdc12d254bd8fc8669a0ac055304 Mon Sep 17 00:00:00 2001
From: Patrick Griffis <pgriffis@igalia.com>
Date: Wed, 5 Feb 2025 14:39:42 -0600
Subject: [PATCH] sniffer: Fix potential overflow

Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsoup2.4/tree/debian/patches/CVE-2025-2784-1.patch?h=ubuntu/focal-security
Upstream commit https://gitlab.gnome.org/GNOME/libsoup/-/commit/242a10fbb12dbdc12d254bd8fc8669a0ac055304]
CVE: CVE-2025-2784
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 libsoup/content-sniffer/soup-content-sniffer.c |   2 +-
 tests/meson.build                              |   4 +++-
 tests/resources/whitespace.html                | Bin 0 -> 512 bytes
 tests/sniffing-test.c                          |   5 +++++
 tests/soup-tests.gresource.xml                 |   1 +
 5 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 tests/resources/whitespace.html

--- libsoup2.4-2.70.0.orig/libsoup/soup-content-sniffer.c
+++ libsoup2.4-2.70.0/libsoup/soup-content-sniffer.c
@@ -642,7 +642,7 @@ sniff_feed_or_html (SoupContentSniffer *
 		pos = 3;
 
  look_for_tag:
-	if (pos > resource_length)
+	if (pos >= resource_length)
 		goto text_html;
 
 	if (skip_insignificant_space (resource, &pos, resource_length))
--- libsoup2.4-2.70.0.orig/tests/sniffing-test.c
+++ libsoup2.4-2.70.0/tests/sniffing-test.c
@@ -601,6 +601,11 @@ main (int argc, char **argv)
 			      "type/text_html; charset=UTF-8/test.html => text/html; charset=UTF-8",
 			      do_sniffing_test);
 
+        /* Test hitting skip_insignificant_space() with number of bytes equaling resource_length. */
+	g_test_add_data_func ("/sniffing/whitespace",
+			      "type/text_html/whitespace.html => text/html",
+			      do_sniffing_test);
+
 	/* Test that disabling the sniffer works correctly */
 	g_test_add_data_func ("/sniffing/disabled",
 			      "/text_or_binary/home.gif",
--- libsoup2.4-2.70.0.orig/tests/soup-tests.gresource.xml
+++ libsoup2.4-2.70.0/tests/soup-tests.gresource.xml
@@ -25,5 +25,6 @@
     <file>resources/text.txt</file>
     <file>resources/text_binary.txt</file>
     <file>resources/tux.webp</file>
+    <file>resources/whitespace.html</file>
   </gresource>
 </gresources>
