|
| 1 | +From 5bfcf8157597f2d327050114fb37ff600004dbcf Mon Sep 17 00:00:00 2001 |
| 2 | +From: Milan Crha <mcrha@redhat.com> |
| 3 | +Date: Tue, 15 Apr 2025 09:03:00 +0200 |
| 4 | +Subject: [PATCH] multipart: Fix read out of buffer bounds under |
| 5 | + soup_multipart_new_from_message() |
| 6 | + |
| 7 | +This is CVE-2025-32914, special crafted input can cause read out of buffer bounds |
| 8 | +of the body argument. |
| 9 | + |
| 10 | +Closes #436 |
| 11 | +--- |
| 12 | + libsoup/soup-multipart.c | 2 +- |
| 13 | + tests/multipart-test.c | 58 ++++++++++++++++++++++++++++++++++++++++ |
| 14 | + 2 files changed, 59 insertions(+), 1 deletion(-) |
| 15 | + |
| 16 | +diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c |
| 17 | +index 2421c91f8..102ce3722 100644 |
| 18 | +--- a/libsoup/soup-multipart.c |
| 19 | ++++ b/libsoup/soup-multipart.c |
| 20 | +@@ -173,7 +173,7 @@ soup_multipart_new_from_message (SoupMessageHeaders *headers, |
| 21 | + return NULL; |
| 22 | + } |
| 23 | + |
| 24 | +- split = strstr (start, "\r\n\r\n"); |
| 25 | ++ split = g_strstr_len (start, body_end - start, "\r\n\r\n"); |
| 26 | + if (!split || split > end) { |
| 27 | + soup_multipart_free (multipart); |
| 28 | + return NULL; |
| 29 | +diff --git a/tests/multipart-test.c b/tests/multipart-test.c |
| 30 | +index 2c0e7e969..f5b986889 100644 |
| 31 | +--- a/tests/multipart-test.c |
| 32 | ++++ b/tests/multipart-test.c |
| 33 | +@@ -471,6 +471,62 @@ test_multipart (gconstpointer data) |
| 34 | + loop = NULL; |
| 35 | + } |
| 36 | + |
| 37 | ++static void |
| 38 | ++test_multipart_bounds_good (void) |
| 39 | ++{ |
| 40 | ++ #define TEXT "line1\r\nline2" |
| 41 | ++ SoupMultipart *multipart; |
| 42 | ++ SoupMessageHeaders *headers, *set_headers = NULL; |
| 43 | ++ GBytes *bytes, *set_bytes = NULL; |
| 44 | ++ const char *raw_data = "--123\r\nContent-Type: text/plain;\r\n\r\n" TEXT "\r\n--123--\r\n"; |
| 45 | ++ gboolean success; |
| 46 | ++ |
| 47 | ++ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART); |
| 48 | ++ soup_message_headers_append (headers, "Content-Type", "multipart/mixed; boundary=\"123\""); |
| 49 | ++ |
| 50 | ++ bytes = g_bytes_new (raw_data, strlen (raw_data)); |
| 51 | ++ |
| 52 | ++ multipart = soup_multipart_new_from_message (headers, bytes); |
| 53 | ++ |
| 54 | ++ g_assert_nonnull (multipart); |
| 55 | ++ g_assert_cmpint (soup_multipart_get_length (multipart), ==, 1); |
| 56 | ++ success = soup_multipart_get_part (multipart, 0, &set_headers, &set_bytes); |
| 57 | ++ g_assert_true (success); |
| 58 | ++ g_assert_nonnull (set_headers); |
| 59 | ++ g_assert_nonnull (set_bytes); |
| 60 | ++ g_assert_cmpint (strlen (TEXT), ==, g_bytes_get_size (set_bytes)); |
| 61 | ++ g_assert_cmpstr ("text/plain", ==, soup_message_headers_get_content_type (set_headers, NULL)); |
| 62 | ++ g_assert_cmpmem (TEXT, strlen (TEXT), g_bytes_get_data (set_bytes, NULL), g_bytes_get_size (set_bytes)); |
| 63 | ++ |
| 64 | ++ soup_message_headers_unref (headers); |
| 65 | ++ g_bytes_unref (bytes); |
| 66 | ++ |
| 67 | ++ soup_multipart_free (multipart); |
| 68 | ++ |
| 69 | ++ #undef TEXT |
| 70 | ++} |
| 71 | ++ |
| 72 | ++static void |
| 73 | ++test_multipart_bounds_bad (void) |
| 74 | ++{ |
| 75 | ++ SoupMultipart *multipart; |
| 76 | ++ SoupMessageHeaders *headers; |
| 77 | ++ GBytes *bytes; |
| 78 | ++ const char *raw_data = "--123\r\nContent-Type: text/plain;\r\nline1\r\nline2\r\n--123--\r\n"; |
| 79 | ++ |
| 80 | ++ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART); |
| 81 | ++ soup_message_headers_append (headers, "Content-Type", "multipart/mixed; boundary=\"123\""); |
| 82 | ++ |
| 83 | ++ bytes = g_bytes_new (raw_data, strlen (raw_data)); |
| 84 | ++ |
| 85 | ++ /* it did read out of raw_data/bytes bounds */ |
| 86 | ++ multipart = soup_multipart_new_from_message (headers, bytes); |
| 87 | ++ g_assert_null (multipart); |
| 88 | ++ |
| 89 | ++ soup_message_headers_unref (headers); |
| 90 | ++ g_bytes_unref (bytes); |
| 91 | ++} |
| 92 | ++ |
| 93 | + int |
| 94 | + main (int argc, char **argv) |
| 95 | + { |
| 96 | +@@ -498,6 +554,8 @@ main (int argc, char **argv) |
| 97 | + g_test_add_data_func ("/multipart/sync", GINT_TO_POINTER (SYNC_MULTIPART), test_multipart); |
| 98 | + g_test_add_data_func ("/multipart/async", GINT_TO_POINTER (ASYNC_MULTIPART), test_multipart); |
| 99 | + g_test_add_data_func ("/multipart/async-small-reads", GINT_TO_POINTER (ASYNC_MULTIPART_SMALL_READS), test_multipart); |
| 100 | ++ g_test_add_func ("/multipart/bounds-good", test_multipart_bounds_good); |
| 101 | ++ g_test_add_func ("/multipart/bounds-bad", test_multipart_bounds_bad); |
| 102 | + |
| 103 | + ret = g_test_run (); |
| 104 | + |
| 105 | +-- |
| 106 | +GitLab |
| 107 | + |
0 commit comments