mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-09-09 08:27:15 +00:00
07d6722816
Fix CVE-2026-1539,CVE-2026-1761,CVE-2026-1801,CVE-2026-2443, CVE-2026-2369,CVE-2026-1760,CVE-2025-14523,CVE-2025-32049,CVE-2026-1467 Refer: CVE-2026-1801 https://gitlab.gnome.org/GNOME/libsoup/-/issues/481 CVE-2026-1761 https://gitlab.gnome.org/GNOME/libsoup/-/issues/493 CVE-2026-2443 https://gitlab.gnome.org/GNOME/libsoup/-/issues/487 CVE-2026-1539 https://gitlab.gnome.org/GNOME/libsoup/-/issues/489 CVE-2026-2369 https://gitlab.gnome.org/GNOME/libsoup/-/issues/498 CVE-2026-1760 https://gitlab.gnome.org/GNOME/libsoup/-/issues/475 CVE-2025-14523 https://gitlab.gnome.org/GNOME/libsoup/-/issues/472 CVE-2025-32049 https://gitlab.gnome.org/GNOME/libsoup/-/issues/390 CVE-2026-1467 https://gitlab.gnome.org/GNOME/libsoup/-/issues/488 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
37 lines
1.2 KiB
Diff
37 lines
1.2 KiB
Diff
From 07757b7feacfc660c6c463ff2b773c13bc42d2c9 Mon Sep 17 00:00:00 2001
|
|
From: Changqing Li <changqing.li@windriver.com>
|
|
Date: Thu, 19 Mar 2026 17:21:32 +0800
|
|
Subject: [PATCH 3/4] multipart: check length of bytes read
|
|
soup_filter_input_stream_read_until()
|
|
|
|
We do make sure the read length is smaller than the buffer length when
|
|
the boundary is not found, but we should do the same when the boundary
|
|
is found.
|
|
|
|
Spotted in #YWH-PGM9867-149
|
|
Closes #493
|
|
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/cfa9d90d1a5c274233554a264c56551c13d6a6f0]
|
|
CVE: CVE-2026-1761
|
|
|
|
Signed-off-by: Changqing Li <changqing.li@windriver.com>
|
|
---
|
|
libsoup/soup-filter-input-stream.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/libsoup/soup-filter-input-stream.c b/libsoup/soup-filter-input-stream.c
|
|
index 2c30bf9..c34510b 100644
|
|
--- a/libsoup/soup-filter-input-stream.c
|
|
+++ b/libsoup/soup-filter-input-stream.c
|
|
@@ -272,6 +272,6 @@ soup_filter_input_stream_read_until (SoupFilterInputStream *fstream,
|
|
if (eof && !*got_boundary)
|
|
read_length = MIN (fstream->priv->buf->len, length);
|
|
else
|
|
- read_length = p - buf;
|
|
+ read_length = MIN ((gsize)(p - buf), length);
|
|
return read_from_buf (fstream, buffer, read_length);
|
|
}
|
|
--
|
|
2.34.1
|
|
|