meta-openembedded/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch

From c574e659c41c18fad3973bbaa3b3ec75664b3137 Mon Sep 17 00:00:00 2001
From: Changqing Li <changqing.li@windriver.com>
Date: Thu, 5 Feb 2026 16:20:02 +0800
Subject: [PATCH 1/2] websocket: add a way to restrict the total message size

Otherwise a client could send small packages smaller than
total-incoming-payload-size but still to break the server
with a big allocation

Fixes: #390

Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/db87805ab565d67533dfed2cb409dbfd63c7fdce]
CVE: CVE-2025-32049

libsoup2 is not maintained, the patch is backported from libsoup3, and
change accordingly

Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
 libsoup/soup-websocket-connection.c | 104 ++++++++++++++++++++++++++--
 libsoup/soup-websocket-connection.h |   7 ++
 2 files changed, 107 insertions(+), 4 deletions(-)

diff --git a/libsoup/soup-websocket-connection.c b/libsoup/soup-websocket-connection.c
index 9d5f4f8..3dad477 100644
--- a/libsoup/soup-websocket-connection.c
+++ b/libsoup/soup-websocket-connection.c
@@ -85,7 +85,8 @@ enum {
 	PROP_STATE,
 	PROP_MAX_INCOMING_PAYLOAD_SIZE,
 	PROP_KEEPALIVE_INTERVAL,
-	PROP_EXTENSIONS
+	PROP_EXTENSIONS,
+	PROP_MAX_TOTAL_MESSAGE_SIZE,
 };
 
 enum {
@@ -120,6 +121,7 @@ struct _SoupWebsocketConnectionPrivate {
 	char *origin;
 	char *protocol;
 	guint64 max_incoming_payload_size;
+	guint64 max_total_message_size;
 	guint keepalive_interval;
 
 	gushort peer_close_code;
@@ -152,6 +154,7 @@ struct _SoupWebsocketConnectionPrivate {
 };
 
 #define MAX_INCOMING_PAYLOAD_SIZE_DEFAULT   128 * 1024
+#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT   128 * 1024
 #define READ_BUFFER_SIZE 1024
 #define MASK_LENGTH 4
 
@@ -664,7 +667,7 @@ bad_data_error_and_close (SoupWebsocketConnection *self)
 }
 
 static void
-too_big_error_and_close (SoupWebsocketConnection *self,
+too_big_incoming_payload_error_and_close (SoupWebsocketConnection *self,
                          guint64 payload_len)
 {
 	GError *error;
@@ -680,6 +683,23 @@ too_big_error_and_close (SoupWebsocketConnection *self,
 	emit_error_and_close (self, error, TRUE);
 }
 
+static void
+too_big_message_error_and_close (SoupWebsocketConnection *self,
+                                 guint64 len)
+{
+	GError *error;
+
+	error = g_error_new_literal (SOUP_WEBSOCKET_ERROR,
+				     SOUP_WEBSOCKET_CLOSE_TOO_BIG,
+				     self->pv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ?
+				     "Received WebSocket payload from the client larger than configured max-total-message-size" :
+				     "Received WebSocket payload from the server larger than configured max-total-message-size");
+	g_debug ("%s received message of size %" G_GUINT64_FORMAT " or greater, but max supported size is %" G_GUINT64_FORMAT,
+	         self->pv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ? "server" : "client",
+	         len, self->pv->max_total_message_size);
+	emit_error_and_close (self, error, TRUE);
+}
+
 static void
 close_connection (SoupWebsocketConnection *self,
                   gushort                  code,
@@ -913,6 +933,12 @@ process_contents (SoupWebsocketConnection *self,
 		switch (pv->message_opcode) {
 		case 0x01:
 		case 0x02:
+			/* Safety valve */
+			if (pv->max_total_message_size > 0 &&
+			    (pv->message_data->len + payload_len) > pv->max_total_message_size) {
+				too_big_message_error_and_close (self, (pv->message_data->len + payload_len));
+				return;
+			}
 			g_byte_array_append (pv->message_data, payload, payload_len);
 			break;
 		default:
@@ -1050,7 +1076,7 @@ process_frame (SoupWebsocketConnection *self)
 	/* Safety valve */
 	if (self->pv->max_incoming_payload_size > 0 &&
 	    payload_len >= self->pv->max_incoming_payload_size) {
-		too_big_error_and_close (self, payload_len);
+		too_big_incoming_payload_error_and_close (self, payload_len);
 		return FALSE;
 	}
 
@@ -1357,6 +1383,10 @@ soup_websocket_connection_get_property (GObject *object,
 		g_value_set_pointer (value, pv->extensions);
 		break;
 
+	case PROP_MAX_TOTAL_MESSAGE_SIZE:
+		g_value_set_uint64 (value, pv->max_total_message_size);
+		break;
+
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -1410,6 +1440,10 @@ soup_websocket_connection_set_property (GObject *object,
 		pv->extensions = g_value_get_pointer (value);
 		break;
 
+	case PROP_MAX_TOTAL_MESSAGE_SIZE:
+		pv->max_total_message_size = g_value_get_uint64 (value);
+		break;
+
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
 		break;
@@ -1631,7 +1665,24 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass)
                                                                G_PARAM_READWRITE |
                                                                G_PARAM_CONSTRUCT_ONLY |
                                                                G_PARAM_STATIC_STRINGS));
-
+	/**
+	 * SoupWebsocketConnection:max-total-message-size:
+	 *
+	 * The total message size for incoming packets.
+	 *
+	 * The protocol expects or 0 to not limit it.
+	 *
+	 */
+	g_object_class_install_property (gobject_class, PROP_MAX_TOTAL_MESSAGE_SIZE,
+					g_param_spec_uint64 ("max-total-message-size",
+					                     "Max total message size",
+					                     "Max total message size ",
+					                     0,
+					                     G_MAXUINT64,
+					                     MAX_TOTAL_MESSAGE_SIZE_DEFAULT,
+					                     G_PARAM_READWRITE |
+					                     G_PARAM_CONSTRUCT |
+					                     G_PARAM_STATIC_STRINGS));
 	/**
 	 * SoupWebsocketConnection::message:
 	 * @self: the WebSocket
@@ -2145,6 +2196,51 @@ soup_websocket_connection_set_max_incoming_payload_size (SoupWebsocketConnection
 	}
 }
 
+/**
+ * soup_websocket_connection_get_max_total_message_size:
+ * @self: the WebSocket
+ *
+ * Gets the maximum total message size allowed for packets.
+ *
+ * Returns: the maximum total message size.
+ *
+ */
+guint64
+soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self)
+{
+   SoupWebsocketConnectionPrivate *pv;
+
+   g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), MAX_TOTAL_MESSAGE_SIZE_DEFAULT);
+   pv = self->pv;
+
+   return pv->max_total_message_size;
+}
+
+/**
+ * soup_websocket_connection_set_max_total_message_size:
+ * @self: the WebSocket
+ * @max_total_message_size: the maximum total message size
+ *
+ * Sets the maximum total message size allowed for packets.
+ *
+ * It does not limit the outgoing packet size.
+ *
+ */
+void
+soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self,
+                                                      guint64                  max_total_message_size)
+{
+   SoupWebsocketConnectionPrivate *pv;
+
+   g_return_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self));
+   pv = self->pv;
+
+   if (pv->max_total_message_size != max_total_message_size) {
+       pv->max_total_message_size = max_total_message_size;
+       g_object_notify (G_OBJECT (self), "max-total-message-size");
+   }
+}
+
 /**
  * soup_websocket_connection_get_keepalive_interval:
  * @self: the WebSocket
diff --git a/libsoup/soup-websocket-connection.h b/libsoup/soup-websocket-connection.h
index f82d723..d2a60e9 100644
--- a/libsoup/soup-websocket-connection.h
+++ b/libsoup/soup-websocket-connection.h
@@ -136,6 +136,13 @@ SOUP_AVAILABLE_IN_2_58
 void                soup_websocket_connection_set_keepalive_interval (SoupWebsocketConnection *self,
                                                                       guint                    interval);
 
+SOUP_AVAILABLE_IN_2_72
+guint64             soup_websocket_connection_get_max_total_message_size    (SoupWebsocketConnection *self);
+
+SOUP_AVAILABLE_IN_2_72
+void                soup_websocket_connection_set_max_total_message_size    (SoupWebsocketConnection *self,
+                                                                             guint64                  max_total_message_size);
+
 G_END_DECLS
 
 #endif /* __SOUP_WEBSOCKET_CONNECTION_H__ */
-- 
2.34.1