Skip to content

Commit bf092fc

Browse files
CBL-Mariner-Botkgodara912Kshitiz GodaraPawelWMS
authored
[AUTO-CHERRYPICK] Patch libsoup for CVE-2025-2784 [HIGH], CVE-2025-32050, CVE-2025-32051, CVE-2025-32052, CVE-2025-46420, CVE-2025-46421 [MEDIUM] - branch 3.0-dev (#13681)
Co-authored-by: kgodara912 <kshigodara@outlook.com> Co-authored-by: Kshitiz Godara <kgodara@microsoft.com> Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
1 parent 7afe536 commit bf092fc

7 files changed

Lines changed: 444 additions & 1 deletion

File tree

‎SPECS/libsoup/CVE-2025-2784.patch‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
From 0cd5cb7d61ec22b60ce21f84f91a1d8da930eff6 Mon Sep 17 00:00:00 2001
2+
From: Kshitiz Godara <kgodara@microsoft.com>
3+
Date: Sun, 4 May 2025 12:46:20 +0000
4+
Subject: [PATCH 1/6] Combined two patches to address CVE-2025-2784
5+
6+
Upstream references:
7+
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/435/diffs
8+
https://gitlab.gnome.org/GNOME/libsoup/-/commit/c415ad0b6771992e66c70edf373566c6e247089d
9+
---
10+
.../content-sniffer/soup-content-sniffer.c | 10 ++--
11+
tests/meson.build | 4 +-
12+
tests/sniffing-test.c | 48 +++++++++++++++++++
13+
3 files changed, 56 insertions(+), 6 deletions(-)
14+
15+
diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
16+
index 2351c3f..150d285 100644
17+
--- a/libsoup/content-sniffer/soup-content-sniffer.c
18+
+++ b/libsoup/content-sniffer/soup-content-sniffer.c
19+
@@ -638,8 +638,11 @@ sniff_text_or_binary (SoupContentSniffer *sniffer, GBytes *buffer)
20+
}
21+
22+
static gboolean
23+
-skip_insignificant_space (const char *resource, int *pos, int resource_length)
24+
+skip_insignificant_space (const char *resource, gsize *pos, gsize resource_length)
25+
{
26+
+ if (*pos >= resource_length)
27+
+ return TRUE;
28+
+
29+
while ((resource[*pos] == '\x09') ||
30+
(resource[*pos] == '\x20') ||
31+
(resource[*pos] == '\x0A') ||
32+
@@ -659,7 +662,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, GBytes *buffer)
33+
gsize resource_length;
34+
const char *resource = g_bytes_get_data (buffer, &resource_length);
35+
resource_length = MIN (512, resource_length);
36+
- int pos = 0;
37+
+ gsize pos = 0;
38+
39+
if (resource_length < 3)
40+
goto text_html;
41+
@@ -669,9 +672,6 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, GBytes *buffer)
42+
pos = 3;
43+
44+
look_for_tag:
45+
- if (pos > resource_length)
46+
- goto text_html;
47+
-
48+
if (skip_insignificant_space (resource, &pos, resource_length))
49+
goto text_html;
50+
51+
diff --git a/tests/meson.build b/tests/meson.build
52+
index 9bf88be..b4112ec 100644
53+
--- a/tests/meson.build
54+
+++ b/tests/meson.build
55+
@@ -94,7 +94,9 @@ tests = [
56+
{'name': 'session'},
57+
{'name': 'server-auth'},
58+
{'name': 'server'},
59+
- {'name': 'sniffing'},
60+
+ {'name': 'sniffing',
61+
+ 'depends': [test_resources],
62+
+ },
63+
{'name': 'ssl',
64+
'dependencies': [gnutls_dep],
65+
'depends': mock_pkcs11_module,
66+
diff --git a/tests/sniffing-test.c b/tests/sniffing-test.c
67+
index 6116719..7857732 100644
68+
--- a/tests/sniffing-test.c
69+
+++ b/tests/sniffing-test.c
70+
@@ -342,6 +342,52 @@ test_disabled (gconstpointer data)
71+
g_uri_unref (uri);
72+
}
73+
74+
+static const gsize MARKUP_LENGTH = strlen ("<!--") + strlen ("-->");
75+
+
76+
+static void
77+
+do_skip_whitespace_test (void)
78+
+{
79+
+ SoupContentSniffer *sniffer = soup_content_sniffer_new ();
80+
+ SoupMessage *msg = soup_message_new (SOUP_METHOD_GET, "http://example.org");
81+
+ const char *test_cases[] = {
82+
+ "",
83+
+ "<rdf:RDF",
84+
+ "<rdf:RDFxmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"",
85+
+ "<rdf:RDFxmlns=\"http://purl.org/rss/1.0/\"",
86+
+ };
87+
+
88+
+ soup_message_headers_set_content_type (soup_message_get_response_headers (msg), "text/html", NULL);
89+
+
90+
+ for (guint i = 0; i < G_N_ELEMENTS (test_cases); i++) {
91+
+ const char *trailing_data = test_cases[i];
92+
+ gsize leading_zeros = 512 - MARKUP_LENGTH - strlen (trailing_data);
93+
+ gsize testsize = MARKUP_LENGTH + leading_zeros + strlen (trailing_data);
94+
+ guint8 *data = g_malloc0 (testsize);
95+
+ guint8 *p = data;
96+
+ char *content_type;
97+
+ GBytes *buffer;
98+
+
99+
+ // Format of <!--[0x00 * $leading_zeros]-->$trailing_data
100+
+ memcpy (p, "<!--", strlen ("<!--"));
101+
+ p += strlen ("<!--");
102+
+ p += leading_zeros;
103+
+ memcpy (p, "-->", strlen ("-->"));
104+
+ p += strlen ("-->");
105+
+ if (strlen (trailing_data))
106+
+ memcpy (p, trailing_data, strlen (trailing_data));
107+
+ // Purposefully not NUL terminated.
108+
+
109+
+ buffer = g_bytes_new_take (g_steal_pointer (&data), testsize);
110+
+ content_type = soup_content_sniffer_sniff (sniffer, msg, buffer, NULL);
111+
+
112+
+ g_free (content_type);
113+
+ g_bytes_unref (buffer);
114+
+ }
115+
+
116+
+ g_object_unref (msg);
117+
+ g_object_unref (sniffer);
118+
+}
119+
+
120+
int
121+
main (int argc, char **argv)
122+
{
123+
@@ -517,6 +563,8 @@ main (int argc, char **argv)
124+
"/text_or_binary/home.gif",
125+
test_disabled);
126+
127+
+ g_test_add_func ("/sniffing/whitespace", do_skip_whitespace_test);
128+
+
129+
ret = g_test_run ();
130+
131+
g_uri_unref (base_uri);
132+
--
133+
2.45.3
134+

‎SPECS/libsoup/CVE-2025-32050.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From 2825634dd081a3af1800d6967ba0991f3def3347 Mon Sep 17 00:00:00 2001
2+
From: Patrick Griffis <pgriffis@igalia.com>
3+
Date: Mon, 28 Oct 2024 12:29:48 -0500
4+
Subject: [PATCH 3/6] Fix using int instead of size_t for strcspn return
5+
6+
Upstream reference:
7+
https://gitlab.gnome.org/GNOME/libsoup/-/commit/9bb0a55de55c6940ced811a64fbca82fe93a9323
8+
---
9+
libsoup/soup-headers.c | 2 +-
10+
1 file changed, 1 insertion(+), 1 deletion(-)
11+
12+
diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
13+
index 8382b8f..4468415 100644
14+
--- a/libsoup/soup-headers.c
15+
+++ b/libsoup/soup-headers.c
16+
@@ -907,7 +907,7 @@ append_param_quoted (GString *string,
17+
const char *name,
18+
const char *value)
19+
{
20+
- int len;
21+
+ gsize len;
22+
23+
g_string_append (string, name);
24+
g_string_append (string, "=\"");
25+
--
26+
2.45.3
27+

‎SPECS/libsoup/CVE-2025-32051.patch‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
From 206e54eb90bdc53faed29e04d26373433b6605f6 Mon Sep 17 00:00:00 2001
2+
From: Patrick Griffis <pgriffis@igalia.com>
3+
Date: Fri, 22 Nov 2024 13:39:51 -0600
4+
Subject: [PATCH 4/6] soup_uri_decode_data_uri(): Handle URIs with a path
5+
starting with //
6+
7+
Upstream reference:
8+
https://gitlab.gnome.org/GNOME/libsoup/-/commit/79cfd65c9bd8024cd45dd725c284766329873709
9+
https://gitlab.gnome.org/GNOME/libsoup/-/commit/0713ba4a719da938dc8facc89fca99cd0aa3069f
10+
---
11+
libsoup/soup-uri-utils.c | 11 +++++++++++
12+
1 file changed, 11 insertions(+)
13+
14+
diff --git a/libsoup/soup-uri-utils.c b/libsoup/soup-uri-utils.c
15+
index be2b79b..ad70fe6 100644
16+
--- a/libsoup/soup-uri-utils.c
17+
+++ b/libsoup/soup-uri-utils.c
18+
@@ -286,6 +286,7 @@ soup_uri_decode_data_uri (const char *uri,
19+
gboolean base64 = FALSE;
20+
char *uri_string;
21+
GBytes *bytes;
22+
+ const char *path;
23+
24+
g_return_val_if_fail (uri != NULL, NULL);
25+
26+
@@ -300,9 +301,19 @@ soup_uri_decode_data_uri (const char *uri,
27+
28+
if (content_type)
29+
*content_type = NULL;
30+
+ /* g_uri_to_string() is picky about paths that start with `//` and will assert. */
31+
+ path = g_uri_get_path (soup_uri);
32+
+ if (path[0] == '/' && path[1] == '/') {
33+
+ g_uri_unref (soup_uri);
34+
+ return NULL;
35+
+ }
36+
+
37+
38+
uri_string = g_uri_to_string (soup_uri);
39+
g_uri_unref (soup_uri);
40+
+ if (!uri_string)
41+
+ return NULL;
42+
+
43+
44+
start = uri_string + 5;
45+
comma = strchr (start, ',');
46+
--
47+
2.45.3
48+

‎SPECS/libsoup/CVE-2025-32052.patch‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
From 81ae25238849867f6197e22ec42f5bb4dcb7b8ad Mon Sep 17 00:00:00 2001
2+
From: Patrick Griffis <pgriffis@igalia.com>
3+
Date: Sat, 16 Nov 2024 12:07:30 -0600
4+
Subject: [PATCH 2/6] Fix heap buffer overflow in soup_content_sniffer_sniff
5+
6+
Co-Author: Ar Jun <pkillarjun@protonmail.com>
7+
8+
Upstream reference:
9+
https://gitlab.gnome.org/GNOME/libsoup/-/commit/f182429e5b1fc034050510da20c93256c4fa9652
10+
---
11+
libsoup/content-sniffer/soup-content-sniffer.c | 2 +-
12+
1 file changed, 1 insertion(+), 1 deletion(-)
13+
14+
diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
15+
index 150d285..a772c7c 100644
16+
--- a/libsoup/content-sniffer/soup-content-sniffer.c
17+
+++ b/libsoup/content-sniffer/soup-content-sniffer.c
18+
@@ -529,7 +529,7 @@ sniff_unknown (SoupContentSniffer *sniffer, GBytes *buffer,
19+
guint index_pattern = 0;
20+
gboolean skip_row = FALSE;
21+
22+
- while ((index_stream < resource_length) &&
23+
+ while ((index_stream < resource_length - 1) &&
24+
(index_pattern <= type_row->pattern_length)) {
25+
/* Skip insignificant white space ("WS" in the spec) */
26+
if (type_row->pattern[index_pattern] == ' ') {
27+
--
28+
2.45.3
29+

‎SPECS/libsoup/CVE-2025-46420.patch‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
From 909a9c40197d53bb331830d959ec86b97721d64f Mon Sep 17 00:00:00 2001
2+
From: Patrick Griffis <pgriffis@igalia.com>
3+
Date: Thu, 26 Dec 2024 18:31:42 -0600
4+
Subject: [PATCH 5/6] soup_header_parse_quality_list: Fix leak
5+
6+
When iterating over the parsed list we now steal the allocated strings that we want and then free_full the list which may contain remaining strings.
7+
8+
Upstream reference:
9+
https://gitlab.gnome.org/GNOME/libsoup/-/commit/c9083869ec2a3037e6df4bd86b45c419ba295f8e
10+
---
11+
libsoup/soup-headers.c | 11 +++++------
12+
1 file changed, 5 insertions(+), 6 deletions(-)
13+
14+
diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
15+
index 4468415..d28ddff 100644
16+
--- a/libsoup/soup-headers.c
17+
+++ b/libsoup/soup-headers.c
18+
@@ -530,7 +530,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
19+
GSList *unsorted;
20+
QualityItem *array;
21+
GSList *sorted, *iter;
22+
- char *item, *semi;
23+
+ char *semi;
24+
const char *param, *equal, *value;
25+
double qval;
26+
int n;
27+
@@ -543,9 +543,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
28+
unsorted = soup_header_parse_list (header);
29+
array = g_new0 (QualityItem, g_slist_length (unsorted));
30+
for (iter = unsorted, n = 0; iter; iter = iter->next) {
31+
- item = iter->data;
32+
qval = 1.0;
33+
- for (semi = strchr (item, ';'); semi; semi = strchr (semi + 1, ';')) {
34+
+ for (semi = strchr (iter->data, ';'); semi; semi = strchr (semi + 1, ';')) {
35+
param = skip_lws (semi + 1);
36+
if (*param != 'q')
37+
continue;
38+
@@ -577,15 +576,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
39+
if (qval == 0.0) {
40+
if (unacceptable) {
41+
*unacceptable = g_slist_prepend (*unacceptable,
42+
- item);
43+
+ g_steal_pointer (&iter->data));
44+
}
45+
} else {
46+
- array[n].item = item;
47+
+ array[n].item = g_steal_pointer (&iter->data);
48+
array[n].qval = qval;
49+
n++;
50+
}
51+
}
52+
- g_slist_free (unsorted);
53+
+ g_slist_free_full (unsorted, g_free);
54+
55+
qsort (array, n, sizeof (QualityItem), sort_by_qval);
56+
sorted = NULL;
57+
--
58+
2.45.3
59+

0 commit comments

Comments
 (0)