mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-08-18 00:55:28 +00:00
07d6722816
Fix CVE-2026-1539,CVE-2026-1761,CVE-2026-1801,CVE-2026-2443, CVE-2026-2369,CVE-2026-1760,CVE-2025-14523,CVE-2025-32049,CVE-2026-1467 Refer: CVE-2026-1801 https://gitlab.gnome.org/GNOME/libsoup/-/issues/481 CVE-2026-1761 https://gitlab.gnome.org/GNOME/libsoup/-/issues/493 CVE-2026-2443 https://gitlab.gnome.org/GNOME/libsoup/-/issues/487 CVE-2026-1539 https://gitlab.gnome.org/GNOME/libsoup/-/issues/489 CVE-2026-2369 https://gitlab.gnome.org/GNOME/libsoup/-/issues/498 CVE-2026-1760 https://gitlab.gnome.org/GNOME/libsoup/-/issues/475 CVE-2025-14523 https://gitlab.gnome.org/GNOME/libsoup/-/issues/472 CVE-2025-32049 https://gitlab.gnome.org/GNOME/libsoup/-/issues/390 CVE-2026-1467 https://gitlab.gnome.org/GNOME/libsoup/-/issues/488 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
127 lines
4.1 KiB
Diff
127 lines
4.1 KiB
Diff
From f9c933e258e9ef2f221cca6395f8092a1c4b93dd Mon Sep 17 00:00:00 2001
|
|
From: Changqing Li <changqing.li@windriver.com>
|
|
Date: Thu, 19 Mar 2026 17:10:36 +0800
|
|
Subject: [PATCH 2/4] Fix CVE-2026-1801
|
|
|
|
This patch merges 3 upstream patches
|
|
|
|
Chery-pick the first two patches to make the context is the same as the
|
|
third patch that fix CVE-2026-1801
|
|
|
|
Upstream-Status: Backport
|
|
[https://gitlab.gnome.org/GNOME/libsoup/-/commit/1e32b5e123aa1689505472bdbfcbd897eac41977,
|
|
https://gitlab.gnome.org/GNOME/libsoup/-/commit/8a2e15c88512ae4517d2c2c887d39299725b22da,
|
|
https://gitlab.gnome.org/GNOME/libsoup/-/commit/b9a1c0663ff8ab6e79715db4b35b54f560416ddd]
|
|
CVE: CVE-2026-1801
|
|
|
|
Signed-off-by: Changqing Li <changqing.li@windriver.com>
|
|
---
|
|
libsoup/soup-body-input-stream.c | 66 ++++++++++++++++++++------------
|
|
1 file changed, 41 insertions(+), 25 deletions(-)
|
|
|
|
diff --git a/libsoup/soup-body-input-stream.c b/libsoup/soup-body-input-stream.c
|
|
index 6b95884..25d9312 100644
|
|
--- a/libsoup/soup-body-input-stream.c
|
|
+++ b/libsoup/soup-body-input-stream.c
|
|
@@ -159,15 +159,18 @@ soup_body_input_stream_read_chunked (SoupBodyInputStream *bistream,
|
|
again:
|
|
switch (bistream->priv->chunked_state) {
|
|
case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_SIZE:
|
|
- nread = soup_filter_input_stream_read_line (
|
|
- fstream, metabuf, sizeof (metabuf), blocking,
|
|
- &got_line, cancellable, error);
|
|
- if (nread <= 0)
|
|
+ nread = soup_filter_input_stream_read_until (
|
|
+ fstream, metabuf, sizeof (metabuf),
|
|
+ "\r\n", 2, blocking, TRUE,
|
|
+ &got_line, cancellable, error);
|
|
+ if (nread < 0)
|
|
return nread;
|
|
- if (!got_line) {
|
|
- g_set_error_literal (error, G_IO_ERROR,
|
|
- G_IO_ERROR_PARTIAL_INPUT,
|
|
- _("Connection terminated unexpectedly"));
|
|
+ if (nread == 0 || !got_line) {
|
|
+ if (error && *error == NULL) {
|
|
+ g_set_error_literal (error, G_IO_ERROR,
|
|
+ G_IO_ERROR_PARTIAL_INPUT,
|
|
+ ("Connection terminated unexpectedly"));
|
|
+ }
|
|
return -1;
|
|
}
|
|
|
|
@@ -180,9 +183,9 @@ again:
|
|
|
|
case SOUP_BODY_INPUT_STREAM_STATE_CHUNK:
|
|
nread = soup_body_input_stream_read_raw (
|
|
- bistream, buffer,
|
|
- MIN (count, bistream->priv->read_length),
|
|
- blocking, cancellable, error);
|
|
+ bistream, buffer,
|
|
+ MIN (count, bistream->priv->read_length),
|
|
+ blocking, cancellable, error);
|
|
if (nread > 0) {
|
|
bistream->priv->read_length -= nread;
|
|
if (bistream->priv->read_length == 0)
|
|
@@ -191,16 +194,19 @@ again:
|
|
return nread;
|
|
|
|
case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_END:
|
|
- nread = soup_filter_input_stream_read_line (
|
|
- SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream),
|
|
- metabuf, sizeof (metabuf), blocking,
|
|
- &got_line, cancellable, error);
|
|
- if (nread <= 0)
|
|
+ nread = soup_filter_input_stream_read_until (
|
|
+ SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream),
|
|
+ metabuf, sizeof (metabuf),
|
|
+ "\r\n", 2, blocking, TRUE,
|
|
+ &got_line, cancellable, error);
|
|
+ if (nread < 0)
|
|
return nread;
|
|
- if (!got_line) {
|
|
- g_set_error_literal (error, G_IO_ERROR,
|
|
- G_IO_ERROR_PARTIAL_INPUT,
|
|
- _("Connection terminated unexpectedly"));
|
|
+ if (nread == 0 || !got_line) {
|
|
+ if (error && *error == NULL) {
|
|
+ g_set_error_literal (error, G_IO_ERROR,
|
|
+ G_IO_ERROR_PARTIAL_INPUT,
|
|
+ _("Connection terminated unexpectedly"));
|
|
+ }
|
|
return -1;
|
|
}
|
|
|
|
@@ -208,13 +214,23 @@ again:
|
|
break;
|
|
|
|
case SOUP_BODY_INPUT_STREAM_STATE_TRAILERS:
|
|
- nread = soup_filter_input_stream_read_line (
|
|
- fstream, buffer, count, blocking,
|
|
- &got_line, cancellable, error);
|
|
- if (nread <= 0)
|
|
+ nread = soup_filter_input_stream_read_until (
|
|
+ fstream, metabuf, sizeof (metabuf),
|
|
+ "\r\n", 2, blocking, TRUE,
|
|
+ &got_line, cancellable, error);
|
|
+ if (nread < 0)
|
|
return nread;
|
|
|
|
- if (strncmp (buffer, "\r\n", nread) || strncmp (buffer, "\n", nread)) {
|
|
+ if (nread == 0) {
|
|
+ if (error && *error == NULL) {
|
|
+ g_set_error_literal (error, G_IO_ERROR,
|
|
+ G_IO_ERROR_PARTIAL_INPUT,
|
|
+ _("Connection terminated unexpectedly"));
|
|
+ }
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (nread == 2 && strncmp (metabuf, "\r\n", nread) == 0) {
|
|
bistream->priv->chunked_state = SOUP_BODY_INPUT_STREAM_STATE_DONE;
|
|
bistream->priv->eof = TRUE;
|
|
}
|
|
--
|
|
2.34.1
|
|
|