mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-09-10 00:41:40 +00:00
07d6722816
Fix CVE-2026-1539,CVE-2026-1761,CVE-2026-1801,CVE-2026-2443, CVE-2026-2369,CVE-2026-1760,CVE-2025-14523,CVE-2025-32049,CVE-2026-1467 Refer: CVE-2026-1801 https://gitlab.gnome.org/GNOME/libsoup/-/issues/481 CVE-2026-1761 https://gitlab.gnome.org/GNOME/libsoup/-/issues/493 CVE-2026-2443 https://gitlab.gnome.org/GNOME/libsoup/-/issues/487 CVE-2026-1539 https://gitlab.gnome.org/GNOME/libsoup/-/issues/489 CVE-2026-2369 https://gitlab.gnome.org/GNOME/libsoup/-/issues/498 CVE-2026-1760 https://gitlab.gnome.org/GNOME/libsoup/-/issues/475 CVE-2025-14523 https://gitlab.gnome.org/GNOME/libsoup/-/issues/472 CVE-2025-32049 https://gitlab.gnome.org/GNOME/libsoup/-/issues/390 CVE-2026-1467 https://gitlab.gnome.org/GNOME/libsoup/-/issues/488 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
152 lines
4.7 KiB
Diff
152 lines
4.7 KiB
Diff
From b4f1dcb89a552fc03bfd0e65830b4f76fdc4a232 Mon Sep 17 00:00:00 2001
|
|
From: Changqing Li <changqing.li@windriver.com>
|
|
Date: Tue, 21 Apr 2026 17:10:37 +0800
|
|
Subject: [PATCH] Fix CVE-2026-1467
|
|
|
|
CVE: CVE-2026-1467
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/6dfe506618d2d5856618e5c0f85bd93386dc8012]
|
|
|
|
The original backport patch targets libsoup3. This patch has been
|
|
adapted accordingly for libsoup2, refer the openSUSE patch, see [1]
|
|
|
|
[1] https://www.suse.com/security/cve/CVE-2026-1467.html
|
|
|
|
Signed-off-by: Changqing Li <changqing.li@windriver.com>
|
|
---
|
|
libsoup/soup-auth.c | 2 +-
|
|
libsoup/soup-message.c | 5 +++-
|
|
libsoup/soup-uri.c | 60 ++++++++++++++++++++++++++++++++++++++++++
|
|
libsoup/soup-uri.h | 2 ++
|
|
4 files changed, 67 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/libsoup/soup-auth.c b/libsoup/soup-auth.c
|
|
index 1896aab..e205fe3 100644
|
|
--- a/libsoup/soup-auth.c
|
|
+++ b/libsoup/soup-auth.c
|
|
@@ -535,7 +535,7 @@ GSList *
|
|
soup_auth_get_protection_space (SoupAuth *auth, SoupURI *source_uri)
|
|
{
|
|
g_return_val_if_fail (SOUP_IS_AUTH (auth), NULL);
|
|
- g_return_val_if_fail (source_uri != NULL, NULL);
|
|
+ g_return_val_if_fail (soup_uri_is_valid (source_uri), NULL);
|
|
|
|
return SOUP_AUTH_GET_CLASS (auth)->get_protection_space (auth, source_uri);
|
|
}
|
|
diff --git a/libsoup/soup-message.c b/libsoup/soup-message.c
|
|
index da32b42..cc4f22b 100644
|
|
--- a/libsoup/soup-message.c
|
|
+++ b/libsoup/soup-message.c
|
|
@@ -1044,7 +1044,7 @@ soup_message_new (const char *method, const char *uri_string)
|
|
uri = soup_uri_new (uri_string);
|
|
if (!uri)
|
|
return NULL;
|
|
- if (!uri->host) {
|
|
+ if (!soup_uri_is_valid (uri)) {
|
|
soup_uri_free (uri);
|
|
return NULL;
|
|
}
|
|
@@ -1066,6 +1066,8 @@ soup_message_new (const char *method, const char *uri_string)
|
|
SoupMessage *
|
|
soup_message_new_from_uri (const char *method, SoupURI *uri)
|
|
{
|
|
+ g_return_val_if_fail (soup_uri_is_valid (uri), NULL);
|
|
+
|
|
return g_object_new (SOUP_TYPE_MESSAGE,
|
|
SOUP_MESSAGE_METHOD, method,
|
|
SOUP_MESSAGE_URI, uri,
|
|
@@ -1676,6 +1678,7 @@ soup_message_set_uri (SoupMessage *msg, SoupURI *uri)
|
|
SoupMessagePrivate *priv;
|
|
|
|
g_return_if_fail (SOUP_IS_MESSAGE (msg));
|
|
+ g_return_if_fail (soup_uri_is_valid (uri));
|
|
priv = soup_message_get_instance_private (msg);
|
|
|
|
if (priv->uri)
|
|
diff --git a/libsoup/soup-uri.c b/libsoup/soup-uri.c
|
|
index bdb7a17..d781ff1 100644
|
|
--- a/libsoup/soup-uri.c
|
|
+++ b/libsoup/soup-uri.c
|
|
@@ -1342,6 +1342,66 @@ soup_uri_host_equal (gconstpointer v1, gconstpointer v2)
|
|
return g_ascii_strcasecmp (one->host, two->host) == 0;
|
|
}
|
|
|
|
+static gboolean
|
|
+is_valid_character_for_host (char c)
|
|
+{
|
|
+ static const char forbidden_chars[] = { '\t', '\n', '\r', ' ', '#', '/', ':', '<', '>', '?', '@', '[', '\\', ']', '^', '|' };
|
|
+ int i;
|
|
+
|
|
+ for (i = 0; i < G_N_ELEMENTS (forbidden_chars); ++i) {
|
|
+ if (c == forbidden_chars[i])
|
|
+ return FALSE;
|
|
+ }
|
|
+
|
|
+ return TRUE;
|
|
+}
|
|
+
|
|
+static gboolean
|
|
+is_host_valid (const char* host)
|
|
+{
|
|
+ int i;
|
|
+ gboolean is_valid;
|
|
+ char *ascii_host = NULL;
|
|
+
|
|
+ if (!host || !host[0])
|
|
+ return FALSE;
|
|
+
|
|
+ if (g_hostname_is_non_ascii (host)) {
|
|
+ ascii_host = g_hostname_to_ascii (host);
|
|
+ if (!ascii_host)
|
|
+ return FALSE;
|
|
+
|
|
+ host = ascii_host;
|
|
+ }
|
|
+
|
|
+ if ((g_ascii_isdigit (host[0]) || strchr (host, ':')) && g_hostname_is_ip_address (host)) {
|
|
+ g_free (ascii_host);
|
|
+ return TRUE;
|
|
+ }
|
|
+ is_valid = TRUE;
|
|
+ for (i = 0; host[i] && is_valid; i++)
|
|
+ is_valid = is_valid_character_for_host (host[i]);
|
|
+
|
|
+ g_free (ascii_host);
|
|
+
|
|
+ return is_valid;
|
|
+}
|
|
+
|
|
+gboolean
|
|
+soup_uri_is_valid (SoupURI *uri)
|
|
+{
|
|
+ if (!uri)
|
|
+ return FALSE;
|
|
+
|
|
+ if (!is_host_valid (soup_uri_get_host (uri)))
|
|
+ return FALSE;
|
|
+
|
|
+ /* FIXME: validate other URI components? */
|
|
+
|
|
+ return TRUE;
|
|
+}
|
|
+
|
|
+
|
|
gboolean
|
|
soup_uri_is_http (SoupURI *uri, char **aliases)
|
|
{
|
|
diff --git a/libsoup/soup-uri.h b/libsoup/soup-uri.h
|
|
index 8015e4f..64099c3 100644
|
|
--- a/libsoup/soup-uri.h
|
|
+++ b/libsoup/soup-uri.h
|
|
@@ -133,6 +133,8 @@ guint soup_uri_host_hash (gconstpointer key);
|
|
SOUP_AVAILABLE_IN_2_28
|
|
gboolean soup_uri_host_equal (gconstpointer v1,
|
|
gconstpointer v2);
|
|
+SOUP_AVAILABLE_IN_2_68
|
|
+gboolean soup_uri_is_valid (SoupURI *uri);
|
|
|
|
#define SOUP_URI_IS_VALID(uri) ((uri) && (uri)->scheme && (uri)->path)
|
|
#define SOUP_URI_VALID_FOR_HTTP(uri) ((uri) && ((uri)->scheme == SOUP_URI_SCHEME_HTTP || (uri)->scheme == SOUP_URI_SCHEME_HTTPS) && (uri)->host && (uri)->path)
|
|
--
|
|
2.34.1
|
|
|