summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-gnome/recipes-gnome/gnome-software/gnome-software_48.2.bb (renamed from meta-gnome/recipes-gnome/gnome-software/gnome-software_48.0.bb)2
-rw-r--r--meta-oe/recipes-devtools/suitesparse/suitesparse_5.10.1.bb14
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/0001-CVE-2025-32911.patch2
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52530.patch150
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-1.patch39
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-2.patch133
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-2784.patch56
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32050.patch29
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32052.patch32
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32053.patch39
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32906.patch71
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch39
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32909.patch38
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-1.patch32
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-2.patch94
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-3.patch28
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32912.patch32
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32914.patch35
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch38
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46420.patch61
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch47
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch38
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch37
-rw-r--r--meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb24
24 files changed, 1092 insertions, 18 deletions
diff --git a/meta-gnome/recipes-gnome/gnome-software/gnome-software_48.0.bb b/meta-gnome/recipes-gnome/gnome-software/gnome-software_48.2.bb
index 8dae95dddb..00efac5b4f 100644
--- a/meta-gnome/recipes-gnome/gnome-software/gnome-software_48.0.bb
+++ b/meta-gnome/recipes-gnome/gnome-software/gnome-software_48.2.bb
@@ -28,7 +28,7 @@ RDEPENDS:${PN} = "iso-codes"
28 28
29EXTRA_OEMESON += "-Dtests=false" 29EXTRA_OEMESON += "-Dtests=false"
30 30
31SRC_URI[archive.sha256sum] = "e607af554e838fd6d07c1631f634b20e8bd4e6adf16fc7535c4520874af544f7" 31SRC_URI[archive.sha256sum] = "abfd30643a86c65f4886b6765eb3bb6215c9ea09817d6bd165c50056890822c9"
32 32
33PACKAGECONFIG ?= "flatpak" 33PACKAGECONFIG ?= "flatpak"
34PACKAGECONFIG[flatpak] = "-Dflatpak=true,-Dflatpak=false,flatpak ostree" 34PACKAGECONFIG[flatpak] = "-Dflatpak=true,-Dflatpak=false,flatpak ostree"
diff --git a/meta-oe/recipes-devtools/suitesparse/suitesparse_5.10.1.bb b/meta-oe/recipes-devtools/suitesparse/suitesparse_5.10.1.bb
index 13e6fd066c..b113145808 100644
--- a/meta-oe/recipes-devtools/suitesparse/suitesparse_5.10.1.bb
+++ b/meta-oe/recipes-devtools/suitesparse/suitesparse_5.10.1.bb
@@ -14,20 +14,6 @@ DEPENDS = "cmake-native lapack gmp mpfr chrpath-native"
14PROVIDES = "mongoose graphblas" 14PROVIDES = "mongoose graphblas"
15RPROVIDES:${PN} = "mongoose graphblas" 15RPROVIDES:${PN} = "mongoose graphblas"
16 16
17# The values of $CC, $CXX, and $LD that Bitbake uses have spaces in them which
18# causes problems when the SuiteSparse Makefiles try to pass these values on
19# the command line. To get around this problem, set these variables to only the
20# program name and prepend the rest of the value onto the corresponding FLAGS
21# variable.
22CFLAGS:prepend := "${@" ".join(d.getVar('CC').split()[1:])} "
23export CC := "${@d.getVar('CC').split()[0]}"
24
25CXXFLAGS:prepend := "${@" ".join(d.getVar('CXX').split()[1:])} "
26export CXX := "${@d.getVar('CXX').split()[0]}"
27
28LDFLAGS:prepend := "${@" ".join(d.getVar('LD').split()[1:])} "
29export LD := "${@d.getVar('LD').split()[0]}"
30
31export CMAKE_OPTIONS = " \ 17export CMAKE_OPTIONS = " \
32 -DCMAKE_INSTALL_PREFIX=${D}${prefix} \ 18 -DCMAKE_INSTALL_PREFIX=${D}${prefix} \
33 -DCMAKE_INSTALL_LIBDIR=${baselib} \ 19 -DCMAKE_INSTALL_LIBDIR=${baselib} \
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/0001-CVE-2025-32911.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/0001-CVE-2025-32911.patch
index 9ef0643837..d75594bb4f 100644
--- a/meta-oe/recipes-support/libsoup/libsoup-2.4/0001-CVE-2025-32911.patch
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/0001-CVE-2025-32911.patch
@@ -3,7 +3,7 @@ From: Changqing Li <changqing.li@windriver.com>
3Date: Wed, 30 Apr 2025 14:59:55 +0800 3Date: Wed, 30 Apr 2025 14:59:55 +0800
4Subject: [PATCH] CVE-2025-32911 4Subject: [PATCH] CVE-2025-32911
5 5
6CVE: CVE-2025-32911 6CVE: CVE-2025-32911 CVE-2025-32913
7Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/422/commits] 7Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/422/commits]
8 8
9Signed-off-by: Changqing Li <changqing.li@windriver.com> 9Signed-off-by: Changqing Li <changqing.li@windriver.com>
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52530.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52530.patch
new file mode 100644
index 0000000000..04713850e1
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52530.patch
@@ -0,0 +1,150 @@
1From 4a2bb98e03d79146c729dca52c8d6edc635218ff Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Mon, 8 Jul 2024 12:33:15 -0500
4Subject: [PATCH] headers: Strictly don't allow NUL bytes
5
6In the past (2015) this was allowed for some problematic sites. However Chromium also does not allow NUL bytes in either header names or values these days. So this should no longer be a problem.
7
8CVE: CVE-2024-52530
9Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/402/diffs?commit_id=04df03bc092ac20607f3e150936624d4f536e68b]
10
11Signed-off-by: Changqing Li <changqing.li@windriver.com>
12---
13 libsoup/soup-headers.c | 15 +++------
14 tests/header-parsing-test.c | 62 +++++++++++++++++--------------------
15 2 files changed, 32 insertions(+), 45 deletions(-)
16
17diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
18index eec28ad..e5d3c03 100644
19--- a/libsoup/soup-headers.c
20+++ b/libsoup/soup-headers.c
21@@ -50,13 +50,14 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest)
22 * ignorable trailing whitespace.
23 */
24
25+ /* No '\0's are allowed */
26+ if (memchr (str, '\0', len))
27+ return FALSE;
28+
29 /* Skip over the Request-Line / Status-Line */
30 headers_start = memchr (str, '\n', len);
31 if (!headers_start)
32 return FALSE;
33- /* No '\0's in the Request-Line / Status-Line */
34- if (memchr (str, '\0', headers_start - str))
35- return FALSE;
36
37 /* We work on a copy of the headers, which we can write '\0's
38 * into, so that we don't have to individually g_strndup and
39@@ -68,14 +69,6 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest)
40 headers_copy[copy_len] = '\0';
41 value_end = headers_copy;
42
43- /* There shouldn't be any '\0's in the headers already, but
44- * this is the web we're talking about.
45- */
46- while ((p = memchr (headers_copy, '\0', copy_len))) {
47- memmove (p, p + 1, copy_len - (p - headers_copy));
48- copy_len--;
49- }
50-
51 while (*(value_end + 1)) {
52 name = value_end + 1;
53 name_end = strchr (name, ':');
54diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
55index 752196e..c1d3b33 100644
56--- a/tests/header-parsing-test.c
57+++ b/tests/header-parsing-test.c
58@@ -358,24 +358,6 @@ static struct RequestTest {
59 }
60 },
61
62- { "NUL in header name", "760832",
63- "GET / HTTP/1.1\r\nHost\x00: example.com\r\n", 36,
64- SOUP_STATUS_OK,
65- "GET", "/", SOUP_HTTP_1_1,
66- { { "Host", "example.com" },
67- { NULL }
68- }
69- },
70-
71- { "NUL in header value", "760832",
72- "GET / HTTP/1.1\r\nHost: example\x00" "com\r\n", 35,
73- SOUP_STATUS_OK,
74- "GET", "/", SOUP_HTTP_1_1,
75- { { "Host", "examplecom" },
76- { NULL }
77- }
78- },
79-
80 /************************/
81 /*** INVALID REQUESTS ***/
82 /************************/
83@@ -448,6 +430,21 @@ static struct RequestTest {
84 SOUP_STATUS_EXPECTATION_FAILED,
85 NULL, NULL, -1,
86 { { NULL } }
87+ },
88+
89+ // https://gitlab.gnome.org/GNOME/libsoup/-/issues/377
90+ { "NUL in header name", NULL,
91+ "GET / HTTP/1.1\r\nHost\x00: example.com\r\n", 36,
92+ SOUP_STATUS_BAD_REQUEST,
93+ NULL, NULL, -1,
94+ { { NULL } }
95+ },
96+
97+ { "NUL in header value", NULL,
98+ "HTTP/1.1 200 OK\r\nFoo: b\x00" "ar\r\n", 28,
99+ SOUP_STATUS_BAD_REQUEST,
100+ NULL, NULL, -1,
101+ { { NULL } }
102 }
103 };
104 static const int num_reqtests = G_N_ELEMENTS (reqtests);
105@@ -620,22 +617,6 @@ static struct ResponseTest {
106 { NULL } }
107 },
108
109- { "NUL in header name", "760832",
110- "HTTP/1.1 200 OK\r\nF\x00oo: bar\r\n", 28,
111- SOUP_HTTP_1_1, SOUP_STATUS_OK, "OK",
112- { { "Foo", "bar" },
113- { NULL }
114- }
115- },
116-
117- { "NUL in header value", "760832",
118- "HTTP/1.1 200 OK\r\nFoo: b\x00" "ar\r\n", 28,
119- SOUP_HTTP_1_1, SOUP_STATUS_OK, "OK",
120- { { "Foo", "bar" },
121- { NULL }
122- }
123- },
124-
125 /********************************/
126 /*** VALID CONTINUE RESPONSES ***/
127 /********************************/
128@@ -768,6 +749,19 @@ static struct ResponseTest {
129 { { NULL }
130 }
131 },
132+
133+ // https://gitlab.gnome.org/GNOME/libsoup/-/issues/377
134+ { "NUL in header name", NULL,
135+ "HTTP/1.1 200 OK\r\nF\x00oo: bar\r\n", 28,
136+ -1, 0, NULL,
137+ { { NULL } }
138+ },
139+
140+ { "NUL in header value", "760832",
141+ "HTTP/1.1 200 OK\r\nFoo: b\x00" "ar\r\n", 28,
142+ -1, 0, NULL,
143+ { { NULL } }
144+ },
145 };
146 static const int num_resptests = G_N_ELEMENTS (resptests);
147
148--
1492.34.1
150
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-1.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-1.patch
new file mode 100644
index 0000000000..9de0310c8d
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-1.patch
@@ -0,0 +1,39 @@
1From 8331e681c85c3b1893d8d5193783f631bfc07acb Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Fri, 16 May 2025 13:42:08 +0800
4Subject: [PATCH] tests: Add test for passing invalid UTF-8 to
5 soup_header_parse_semi_param_list()
6
7CVE: CVE-2024-52531
8Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=825fda3425546847b42ad5270544e9388ff349fe]
9
10Signed-off-by: Changqing Li <changqing.li@windriver.com>
11---
12 tests/header-parsing-test.c | 11 +++++++++++
13 1 file changed, 11 insertions(+)
14
15diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
16index b811115..cfcc003 100644
17--- a/tests/header-parsing-test.c
18+++ b/tests/header-parsing-test.c
19@@ -836,6 +836,17 @@ static struct ParamListTest {
20 { "filename", "t\xC3\xA9st.txt" },
21 },
22 },
23+
24+/* This tests invalid UTF-8 data which *should* never be passed here but it was designed to be robust against it. */
25+ { TRUE,
26+ "invalid*=\x69\x27\x27\x93\x93\x93\x93\xff\x61\x61\x61\x61\x61\x61\x61\x62\x63\x64\x65\x0a; filename*=iso-8859-1''\x69\x27\x27\x93\x93\x93\x93\xff\x61\x61\x61\x61\x61\x61\x61\x62\x63\x64\x65\x0a; foo",
27+ {
28+ { "filename", "i''\302\223\302\223\302\223\302\223\303\277aaaaaaabcde" },
29+ { "invalid", "\302\223\302\223\302\223\302\223\303\277aaaaaaabcde" },
30+ { "foo", NULL },
31+ },
32+ }
33+
34 };
35 static const int num_paramlisttests = G_N_ELEMENTS (paramlisttests);
36
37--
382.34.1
39
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-2.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-2.patch
new file mode 100644
index 0000000000..740c28c016
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-2.patch
@@ -0,0 +1,133 @@
1From 12523a592f1216450d18706bcf6c16e0f1ab0ce0 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Fri, 16 May 2025 13:52:37 +0800
4Subject: [PATCH] headers: Be more robust against invalid input when
5 parsing params
6
7If you pass invalid input to a function such as soup_header_parse_param_list_strict()
8it can cause an overflow if it decodes the input to UTF-8.
9
10This should never happen with valid UTF-8 input which libsoup's client API
11ensures, however it's server API does not currently.
12
13CVE: CVE-2024-52531
14Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=a35222dd0bfab2ac97c10e86b95f762456628283]
15
16Signed-off-by: Changqing Li <changqing.li@windriver.com>
17---
18 libsoup/soup-headers.c | 45 +++++++++++++++++++++---------------------
19 1 file changed, 23 insertions(+), 22 deletions(-)
20
21diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
22index 67905b2..39e8d34 100644
23--- a/libsoup/soup-headers.c
24+++ b/libsoup/soup-headers.c
25@@ -642,8 +642,9 @@ soup_header_contains (const char *header, const char *token)
26 }
27
28 static void
29-decode_quoted_string (char *quoted_string)
30+decode_quoted_string_inplace (GString *quoted_gstring)
31 {
32+ char *quoted_string = quoted_gstring->str;
33 char *src, *dst;
34
35 src = quoted_string + 1;
36@@ -657,10 +658,11 @@ decode_quoted_string (char *quoted_string)
37 }
38
39 static gboolean
40-decode_rfc5987 (char *encoded_string)
41+decode_rfc5987_inplace (GString *encoded_gstring)
42 {
43 char *q, *decoded;
44 gboolean iso_8859_1 = FALSE;
45+ const char *encoded_string = encoded_gstring->str;
46
47 q = strchr (encoded_string, '\'');
48 if (!q)
49@@ -689,14 +691,7 @@ decode_rfc5987 (char *encoded_string)
50 decoded = utf8;
51 }
52
53- /* If encoded_string was UTF-8, then each 3-character %-escape
54- * will be converted to a single byte, and so decoded is
55- * shorter than encoded_string. If encoded_string was
56- * iso-8859-1, then each 3-character %-escape will be
57- * converted into at most 2 bytes in UTF-8, and so it's still
58- * shorter.
59- */
60- strcpy (encoded_string, decoded);
61+ g_string_assign (encoded_gstring, decoded);
62 g_free (decoded);
63 return TRUE;
64 }
65@@ -706,15 +701,16 @@ parse_param_list (const char *header, char delim, gboolean strict)
66 {
67 GHashTable *params;
68 GSList *list, *iter;
69- char *item, *eq, *name_end, *value;
70- gboolean override, duplicated;
71
72 params = g_hash_table_new_full (soup_str_case_hash,
73 soup_str_case_equal,
74- g_free, NULL);
75+ g_free, g_free);
76
77 list = parse_list (header, delim);
78 for (iter = list; iter; iter = iter->next) {
79+ char *item, *eq, *name_end;
80+ gboolean override, duplicated;
81+ GString *parsed_value = NULL;
82 item = iter->data;
83 override = FALSE;
84
85@@ -729,19 +725,19 @@ parse_param_list (const char *header, char delim, gboolean strict)
86
87 *name_end = '\0';
88
89- value = (char *)skip_lws (eq + 1);
90+ parsed_value = g_string_new ((char *)skip_lws (eq + 1));
91
92 if (name_end[-1] == '*' && name_end > item + 1) {
93 name_end[-1] = '\0';
94- if (!decode_rfc5987 (value)) {
95+ if (!decode_rfc5987_inplace (parsed_value)) {
96+ g_string_free (parsed_value, TRUE);
97 g_free (item);
98 continue;
99 }
100 override = TRUE;
101- } else if (*value == '"')
102- decode_quoted_string (value);
103- } else
104- value = NULL;
105+ } else if (parsed_value->str[0] == '"')
106+ decode_quoted_string_inplace (parsed_value);
107+ }
108
109 duplicated = g_hash_table_lookup_extended (params, item, NULL, NULL);
110
111@@ -749,11 +745,16 @@ parse_param_list (const char *header, char delim, gboolean strict)
112 soup_header_free_param_list (params);
113 params = NULL;
114 g_slist_foreach (iter, (GFunc)g_free, NULL);
115+ if (parsed_value)
116+ g_string_free (parsed_value, TRUE);
117 break;
118- } else if (override || !duplicated)
119- g_hash_table_replace (params, item, value);
120- else
121+ } else if (override || !duplicated) {
122+ g_hash_table_replace (params, item, parsed_value ? g_string_free (parsed_value, FALSE) : NULL);
123+ } else {
124+ if (parsed_value)
125+ g_string_free (parsed_value, TRUE);
126 g_free (item);
127+ }
128 }
129
130 g_slist_free (list);
131--
1322.34.1
133
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-2784.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-2784.patch
new file mode 100644
index 0000000000..106f907168
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-2784.patch
@@ -0,0 +1,56 @@
1From 2eacbd762332795e00692ddab2515c6da23198d3 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Mon, 12 May 2025 14:06:41 +0800
4Subject: [PATCH] sniffer: Add better coverage of skip_insignificant_space()
5
6CVE: CVE-2025-2784
7Upstream-Status: Backport
8[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/435/diffs?commit_id=242a10fbb12dbdc12d254bd8fc8669a0ac055304;
9 https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/442/diffs?commit_id=c415ad0b6771992e66c70edf373566c6e247089d]
10
11Test code is not added since it uses some functions not defined in
12version 2.74. These tests are not used now, so just ignore them.
13
14Signed-off-by: Changqing Li <changqing.li@windriver.com>
15---
16 libsoup/soup-content-sniffer.c | 9 +++----
17 1 files changed, 3 insertions(+), 4 deletions(-)
18
19diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
20index 5f2896e..9554636 100644
21--- a/libsoup/soup-content-sniffer.c
22+++ b/libsoup/soup-content-sniffer.c
23@@ -612,8 +612,10 @@ sniff_text_or_binary (SoupContentSniffer *sniffer, SoupBuffer *buffer)
24 }
25
26 static gboolean
27-skip_insignificant_space (const char *resource, int *pos, int resource_length)
28+skip_insignificant_space (const char *resource, gsize *pos, gsize resource_length)
29 {
30+ if (*pos >= resource_length)
31+ return TRUE;
32 while ((resource[*pos] == '\x09') ||
33 (resource[*pos] == '\x20') ||
34 (resource[*pos] == '\x0A') ||
35@@ -632,7 +634,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, SoupBuffer *buffer)
36 {
37 const char *resource = (const char *)buffer->data;
38 int resource_length = MIN (512, buffer->length);
39- int pos = 0;
40+ gsize pos = 0;
41
42 if (resource_length < 3)
43 goto text_html;
44@@ -642,9 +644,6 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, SoupBuffer *buffer)
45 pos = 3;
46
47 look_for_tag:
48- if (pos > resource_length)
49- goto text_html;
50-
51 if (skip_insignificant_space (resource, &pos, resource_length))
52 goto text_html;
53
54--
552.34.1
56
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32050.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32050.patch
new file mode 100644
index 0000000000..c032846ef0
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32050.patch
@@ -0,0 +1,29 @@
1From 5709dfffb6fdc5b66ce001bf82a755ad8ad1d992 Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Mon, 28 Oct 2024 12:29:48 -0500
4Subject: [PATCH] Fix using int instead of size_t for strcspn return
5
6CVE: CVE-2025-32050
7Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/9bb0a55de55c6940ced811a64fbca82fe93a9323]
8
9Signed-off-by: Changqing Li <changqing.li@windriver.com>
10---
11 libsoup/soup-headers.c | 2 +-
12 1 file changed, 1 insertion(+), 1 deletion(-)
13
14diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
15index 9707ca0..67905b2 100644
16--- a/libsoup/soup-headers.c
17+++ b/libsoup/soup-headers.c
18@@ -902,7 +902,7 @@ append_param_quoted (GString *string,
19 const char *name,
20 const char *value)
21 {
22- int len;
23+ gsize len;
24
25 g_string_append (string, name);
26 g_string_append (string, "=\"");
27--
282.34.1
29
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32052.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32052.patch
new file mode 100644
index 0000000000..34bc8113a4
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32052.patch
@@ -0,0 +1,32 @@
1From f4a67a9a3033586edaee715d40d5992e02d32893 Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Sat, 16 Nov 2024 12:07:30 -0600
4Subject: [PATCH] Fix heap buffer overflow in soup_content_sniffer_sniff
5
6Co-Author: Ar Jun <pkillarjun@protonmail.com>
7
8CVE: CVE-2025-32052
9Upstream-Status: Backport
10[https://gitlab.gnome.org/GNOME/libsoup/-/commit/f182429e5b1fc034050510da20c93256c4fa9652#500da7cfde649872c49169be34b03a1c42a53ddb]
11
12Signed-off-by: Changqing Li <changqing.li@windriver.com>
13---
14 libsoup/soup-content-sniffer.c | 2 +-
15 1 file changed, 1 insertion(+), 1 deletion(-)
16
17diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
18index 9554636..eac9e7b 100644
19--- a/libsoup/soup-content-sniffer.c
20+++ b/libsoup/soup-content-sniffer.c
21@@ -504,7 +504,7 @@ sniff_unknown (SoupContentSniffer *sniffer, SoupBuffer *buffer,
22 guint index_pattern = 0;
23 gboolean skip_row = FALSE;
24
25- while ((index_stream < resource_length) &&
26+ while ((index_stream < resource_length - 1) &&
27 (index_pattern <= type_row->pattern_length)) {
28 /* Skip insignificant white space ("WS" in the spec) */
29 if (type_row->pattern[index_pattern] == ' ') {
30--
312.34.1
32
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32053.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32053.patch
new file mode 100644
index 0000000000..0d829d6200
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32053.patch
@@ -0,0 +1,39 @@
1From d9bcffd6cd5e8ec32889a594f7348d67a5101b3a Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Mon, 12 May 2025 13:58:42 +0800
4Subject: [PATCH] Fix heap buffer overflow in
5 soup-content-sniffer.c:sniff_feed_or_html()
6
7CVE: CVE-2025-32053
8Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/eaed42ca8d40cd9ab63764e3d63641180505f40a]
9
10Signed-off-by: Changqing Li <changqing.li@windriver.com>
11---
12 libsoup/soup-content-sniffer.c | 4 ++--
13 1 file changed, 2 insertions(+), 2 deletions(-)
14
15diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
16index 967ec61..5f2896e 100644
17--- a/libsoup/soup-content-sniffer.c
18+++ b/libsoup/soup-content-sniffer.c
19@@ -620,7 +620,7 @@ skip_insignificant_space (const char *resource, int *pos, int resource_length)
20 (resource[*pos] == '\x0D')) {
21 *pos = *pos + 1;
22
23- if (*pos > resource_length)
24+ if (*pos >= resource_length)
25 return TRUE;
26 }
27
28@@ -682,7 +682,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, SoupBuffer *buffer)
29 do {
30 pos++;
31
32- if (pos > resource_length)
33+ if ((pos + 1) > resource_length)
34 goto text_html;
35 } while (resource[pos] != '>');
36
37--
382.34.1
39
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32906.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32906.patch
new file mode 100644
index 0000000000..c33ebf8056
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32906.patch
@@ -0,0 +1,71 @@
1From 4b8809cca4bbcbf9514314d86227f985362258b0 Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Wed, 12 Feb 2025 11:30:02 -0600
4Subject: [PATCH] headers: Handle parsing only newlines
5
6Closes #404
7Closes #407
8
9CVE: CVE-2025-32906
10Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/af5b9a4a3945c52b940d5ac181ef51bb12011f1f]
11
12Signed-off-by: Changqing Li <changqing.li@windriver.com>
13---
14 libsoup/soup-headers.c | 4 ++--
15 tests/header-parsing-test.c | 11 +++++++++++
16 2 files changed, 13 insertions(+), 2 deletions(-)
17
18diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
19index e5d3c03..87bb3dc 100644
20--- a/libsoup/soup-headers.c
21+++ b/libsoup/soup-headers.c
22@@ -185,7 +185,7 @@ soup_headers_parse_request (const char *str,
23 /* RFC 2616 4.1 "servers SHOULD ignore any empty line(s)
24 * received where a Request-Line is expected."
25 */
26- while ((*str == '\r' || *str == '\n') && len > 0) {
27+ while (len > 0 && (*str == '\r' || *str == '\n')) {
28 str++;
29 len--;
30 }
31@@ -369,7 +369,7 @@ soup_headers_parse_response (const char *str,
32 * after a response, which we then see prepended to the next
33 * response on that connection.
34 */
35- while ((*str == '\r' || *str == '\n') && len > 0) {
36+ while (len > 0 && (*str == '\r' || *str == '\n')) {
37 str++;
38 len--;
39 }
40diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
41index c1d3b33..b811115 100644
42--- a/tests/header-parsing-test.c
43+++ b/tests/header-parsing-test.c
44@@ -6,6 +6,10 @@ typedef struct {
45 const char *name, *value;
46 } Header;
47
48+static char only_newlines[] = {
49+ '\n', '\n', '\n', '\n'
50+};
51+
52 static struct RequestTest {
53 const char *description;
54 const char *bugref;
55@@ -445,6 +449,13 @@ static struct RequestTest {
56 SOUP_STATUS_BAD_REQUEST,
57 NULL, NULL, -1,
58 { { NULL } }
59+ },
60+
61+ { "Only newlines", NULL,
62+ only_newlines, sizeof (only_newlines),
63+ SOUP_STATUS_BAD_REQUEST,
64+ NULL, NULL, -1,
65+ { { NULL } }
66 }
67 };
68 static const int num_reqtests = G_N_ELEMENTS (reqtests);
69--
702.34.1
71
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch
new file mode 100644
index 0000000000..41dd3ff3f4
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch
@@ -0,0 +1,39 @@
1From 8158b4084dcba2a233dfcb7359c53ab2840148f7 Mon Sep 17 00:00:00 2001
2From: Milan Crha <mcrha@redhat.com>
3Date: Tue, 15 Apr 2025 12:17:39 +0200
4Subject: [PATCH 1/2] soup-message-headers: Correct merge of ranges
5
6It had been skipping every second range, which generated an array
7of a lot of insane ranges, causing large memory usage by the server.
8
9Closes #428
10
11Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452>
12
13CVE: CVE-2025-32907
14Upstream-Status: Backport
15[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452/diffs?commit_id=9bb92f7a685e31e10e9e8221d0342280432ce836]
16
17Test part not applied since test codes use some functions not in this
18version
19
20Signed-off-by: Changqing Li <changqing.li@windriver.com>
21---
22 libsoup/soup-message-headers.c | 1 +
23 1 files changed, 1 insertions(+)
24
25diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
26index 78b2455..00b9763 100644
27--- a/libsoup/soup-message-headers.c
28+++ b/libsoup/soup-message-headers.c
29@@ -1024,6 +1024,7 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders *hdrs,
30 if (cur->start <= prev->end) {
31 prev->end = MAX (prev->end, cur->end);
32 g_array_remove_index (array, i);
33+ i--;
34 }
35 }
36 }
37--
382.34.1
39
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32909.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32909.patch
new file mode 100644
index 0000000000..2f5366348d
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32909.patch
@@ -0,0 +1,38 @@
1From e6e088e62c10ab91fa2f2ad5c122332aa7cde97c Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Mon, 12 May 2025 16:55:37 +0800
4Subject: [PATCH] content-sniffer: Handle sniffing resource shorter than
5 4 bytes
6
7CVE: CVE-2025-32909
8Upstream-Status: Backport
9[https://gitlab.gnome.org/GNOME/libsoup/-/commit/ba4c3a6f988beff59e45801ab36067293d24ce92]
10
11Signed-off-by: Changqing Li <changqing.li@windriver.com>
12---
13 libsoup/soup-content-sniffer.c | 7 ++++++-
14 1 file changed, 6 insertions(+), 1 deletion(-)
15
16diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
17index eac9e7b..73d2245 100644
18--- a/libsoup/soup-content-sniffer.c
19+++ b/libsoup/soup-content-sniffer.c
20@@ -227,9 +227,14 @@ sniff_mp4 (SoupContentSniffer *sniffer, SoupBuffer *buffer)
21 {
22 const char *resource = (const char *)buffer->data;
23 guint resource_length = MIN (512, buffer->length);
24- guint32 box_size = *((guint32*)resource);
25+ guint32 box_size;
26 guint i;
27
28+ if (resource_length < sizeof (guint32))
29+ return FALSE;
30+
31+ box_size = *((guint32*)resource);
32+
33 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
34 box_size = ((box_size >> 24) |
35 ((box_size << 8) & 0x00FF0000) |
36--
372.34.1
38
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-1.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-1.patch
new file mode 100644
index 0000000000..c1dc6860f2
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-1.patch
@@ -0,0 +1,32 @@
1From a7e711d0f162c6edc8acad2a96981d4890784ea3 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Mon, 12 May 2025 17:02:55 +0800
4Subject: [PATCH] auth-digest: Handle missing realm/nonce in authenticate
5 header
6
7CVE: CVE-2025-32910
8Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/417/diffs?commit_id=e40df6d48a1cbab56f5d15016cc861a503423cfe]
9
10Signed-off-by: Changqing Li <changqing.li@windriver.com>
11---
12 libsoup/soup-auth-digest.c | 3 +++
13 1 files changed, 3 insertions(+)
14
15diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
16index e8ba990..0ab3499 100644
17--- a/libsoup/soup-auth-digest.c
18+++ b/libsoup/soup-auth-digest.c
19@@ -142,6 +142,9 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
20 guint qop_options;
21 gboolean ok = TRUE;
22
23+ if (!soup_auth_get_realm (auth))
24+ return FALSE;
25+
26 g_free (priv->domain);
27 g_free (priv->nonce);
28 g_free (priv->opaque);
29
30--
312.34.1
32
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-2.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-2.patch
new file mode 100644
index 0000000000..019a35e3be
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-2.patch
@@ -0,0 +1,94 @@
1From eccfca1074fc485a0b60dfb9c8385429a226bf73 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Fri, 16 May 2025 13:19:38 +0800
4Subject: [PATCH] auth-digest: Handle missing nonce
5
6CVE: CVE-2025-32910
7Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/417/diffs?commit_id=405a8a34597a44bd58c4759e7d5e23f02c3b556a]
8
9Signed-off-by: Changqing Li <changqing.li@windriver.com>
10---
11 libsoup/soup-auth-digest.c | 45 ++++++++++++++++++++++++++++----------
12 1 files changed, 28 insertions(+), 10 deletions(-)
13
14diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
15index 0ab3499..10a8591 100644
16--- a/libsoup/soup-auth-digest.c
17+++ b/libsoup/soup-auth-digest.c
18@@ -132,6 +132,19 @@ soup_auth_digest_get_qop (SoupAuthDigestQop qop)
19 return g_string_free (out, FALSE);
20 }
21
22+static gboolean
23+validate_params (SoupAuthDigest *auth_digest)
24+{
25+ SoupAuthDigestPrivate *priv = soup_auth_digest_get_instance_private (auth_digest);
26+
27+ if (priv->qop || priv->algorithm == SOUP_AUTH_DIGEST_ALGORITHM_MD5_SESS) {
28+ if (!priv->nonce)
29+ return FALSE;
30+ }
31+
32+ return TRUE;
33+}
34+
35 static gboolean
36 soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
37 GHashTable *auth_params)
38@@ -169,17 +182,22 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
39 if (priv->algorithm == -1)
40 ok = FALSE;
41
42- stale = g_hash_table_lookup (auth_params, "stale");
43- if (stale && !g_ascii_strcasecmp (stale, "TRUE") && *priv->hex_urp)
44- recompute_hex_a1 (priv);
45- else {
46- g_free (priv->user);
47- priv->user = NULL;
48- g_free (priv->cnonce);
49- priv->cnonce = NULL;
50- memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
51- memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
52- }
53+ if (!validate_params (auth_digest))
54+ ok = FALSE;
55+
56+ if (ok) {
57+ stale = g_hash_table_lookup (auth_params, "stale");
58+ if (stale && !g_ascii_strcasecmp (stale, "TRUE") && *priv->hex_urp)
59+ recompute_hex_a1 (priv);
60+ else {
61+ g_free (priv->user);
62+ priv->user = NULL;
63+ g_free (priv->cnonce);
64+ priv->cnonce = NULL;
65+ memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
66+ memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
67+ }
68+ }
69
70 return ok;
71 }
72@@ -359,6 +377,8 @@ soup_auth_digest_compute_response (const char *method,
73 if (qop) {
74 char tmp[9];
75
76+ g_assert (cnonce);
77+
78 g_snprintf (tmp, 9, "%.8x", nc);
79 g_checksum_update (checksum, (guchar *)tmp, strlen (tmp));
80 g_checksum_update (checksum, (guchar *)":", 1);
81@@ -422,6 +442,9 @@ soup_auth_digest_get_authorization (SoupAuth *auth, SoupMessage *msg)
82 g_return_val_if_fail (uri != NULL, NULL);
83 url = soup_uri_to_string (uri, TRUE);
84
85+ g_assert (priv->nonce);
86+ g_assert (!priv->qop || priv->cnonce);
87+
88 soup_auth_digest_compute_response (msg->method, url, priv->hex_a1,
89 priv->qop, priv->nonce,
90 priv->cnonce, priv->nc,
91
92--
932.34.1
94
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-3.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-3.patch
new file mode 100644
index 0000000000..bdf4d64ca3
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32910-3.patch
@@ -0,0 +1,28 @@
1From 74c95d54fe42041fe161cb74c76d942ffd37a5dd Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Fri, 16 May 2025 13:21:43 +0800
4Subject: [PATCH] auth-digest: Fix leak
5
6CVE: CVE-2025-32910
7Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/417/diffs?commit_id=ea16eeacb052e423eb5c3b0b705e5eab34b13832]
8
9Signed-off-by: Changqing Li <changqing.li@windriver.com>
10---
11 libsoup/soup-auth-digest.c | 1 +
12 1 file changed, 1 insertion(+)
13
14diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
15index 10a8591..6d965d2 100644
16--- a/libsoup/soup-auth-digest.c
17+++ b/libsoup/soup-auth-digest.c
18@@ -66,6 +66,7 @@ soup_auth_digest_finalize (GObject *object)
19 g_free (priv->nonce);
20 g_free (priv->domain);
21 g_free (priv->cnonce);
22+ g_free (priv->opaque);
23
24 memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
25 memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
26--
272.34.1
28
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32912.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32912.patch
new file mode 100644
index 0000000000..b3ce9d8bc3
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32912.patch
@@ -0,0 +1,32 @@
1From 0984dddb11daf14fdf5ca24077cd0ebda796439a Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Fri, 16 May 2025 13:25:32 +0800
4Subject: [PATCH] auth-digest: Handle missing nonce
5
6CVE: CVE-2025-32912
7Upstream-Status: Backport
8[https://gitlab.gnome.org/GNOME/libsoup/-/commit/cd077513f267e43ce4b659eb18a1734d8a369992?merge_request_iid=434
9https://gitlab.gnome.org/GNOME/libsoup/-/commit/910ebdcd3dd82386717a201c13c834f3a63eed7f]
10
11Signed-off-by: Changqing Li <changqing.li@windriver.com>
12---
13 libsoup/soup-auth-digest.c | 2 +-
14 1 files changed, 1 insertions(+), 1 deletion(-)
15
16diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
17index 6d965d2..f1621ec 100644
18--- a/libsoup/soup-auth-digest.c
19+++ b/libsoup/soup-auth-digest.c
20@@ -156,7 +156,7 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
21 guint qop_options;
22 gboolean ok = TRUE;
23
24- if (!soup_auth_get_realm (auth))
25+ if (!soup_auth_get_realm (auth) || !g_hash_table_lookup (auth_params, "nonce"))
26 return FALSE;
27
28 g_free (priv->domain);
29
30--
312.34.1
32
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32914.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32914.patch
new file mode 100644
index 0000000000..9f3bb21a25
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32914.patch
@@ -0,0 +1,35 @@
1From ac844b9fc7945c38ea21fb7cf1a49a5c226d7c9c Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Mon, 12 May 2025 16:17:20 +0800
4Subject: [PATCH] Resolve "(CVE-2025-32914) (#YWH-PGM9867-23) OOB Read on
5 libsoup through function "soup_multipart_new_from_message" in
6 soup-multipart.c leads to crash or exit of process"
7
8CVE: CVE-2025-32914
9Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/450/diffs?commit_id=5bfcf8157597f2d327050114fb37ff600004dbcf]
10
11Test code are not added since some functions not aligned with version
122.74.3
13
14Signed-off-by: Changqing Li <changqing.li@windriver.com>
15---
16 libsoup/soup-multipart.c | 2 +-
17 1 files changed, 1 insertions(+), 1 deletion(-)
18
19diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
20index a7e550f..dd93973 100644
21--- a/libsoup/soup-multipart.c
22+++ b/libsoup/soup-multipart.c
23@@ -181,7 +181,7 @@ soup_multipart_new_from_message (SoupMessageHeaders *headers,
24 return NULL;
25 }
26
27- split = strstr (start, "\r\n\r\n");
28+ split = g_strstr_len (start, body_end - start, "\r\n\r\n");
29 if (!split || split > end) {
30 soup_multipart_free (multipart);
31 soup_buffer_free (flattened);
32
33--
342.34.1
35
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch
new file mode 100644
index 0000000000..874f62e7ad
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch
@@ -0,0 +1,38 @@
1From 52a0f9234d384b9dab368835b22e5a5a01542168 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Fri, 16 May 2025 14:16:10 +0800
4Subject: [PATCH] auth-digest: fix crash in
5 soup_auth_digest_get_protection_space()
6
7We need to validate the Domain parameter in the WWW-Authenticate header.
8
9Unfortunately this crash only occurs when listening on default ports 80
10and 443, so there's no good way to test for this. The test would require
11running as root.
12
13Fixes #440
14
15CVE: CVE-2025-4476
16Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e64c221f9c7d09b48b610c5626b3b8c400f0907c?merge_request_iid=457]
17
18Signed-off-by: Changqing Li <changqing.li@windriver.com>
19---
20 libsoup/soup-auth-digest.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
24index f1621ec..a2dc560 100644
25--- a/libsoup/soup-auth-digest.c
26+++ b/libsoup/soup-auth-digest.c
27@@ -229,7 +229,7 @@ soup_auth_digest_get_protection_space (SoupAuth *auth, SoupURI *source_uri)
28 uri = soup_uri_new (d);
29 if (uri && uri->scheme == source_uri->scheme &&
30 uri->port == source_uri->port &&
31- !strcmp (uri->host, source_uri->host))
32+ !g_strcmp0 (uri->host, source_uri->host))
33 dir = g_strdup (uri->path);
34 else
35 dir = NULL;
36--
372.34.1
38
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46420.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46420.patch
new file mode 100644
index 0000000000..c970661694
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46420.patch
@@ -0,0 +1,61 @@
1From 81e03c538d6a102406114567f4f1c468033ce2e4 Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Thu, 26 Dec 2024 18:31:42 -0600
4Subject: [PATCH] soup_header_parse_quality_list: Fix leak
5
6When iterating over the parsed list we now steal the allocated strings that we want and then free_full the list which may contain remaining strings.
7
8CVE: CVE-2025-46420
9Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/421/diffs?commit_id=c9083869ec2a3037e6df4bd86b45c419ba295f8e]
10
11 Signed-off-by: Changqing Li <changqing.li@windriver.com>
12---
13 libsoup/soup-headers.c | 11 +++++------
14 1 file changed, 5 insertions(+), 6 deletions(-)
15
16diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
17index 87bb3dc..9707ca0 100644
18--- a/libsoup/soup-headers.c
19+++ b/libsoup/soup-headers.c
20@@ -528,7 +528,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
21 GSList *unsorted;
22 QualityItem *array;
23 GSList *sorted, *iter;
24- char *item, *semi;
25+ char *semi;
26 const char *param, *equal, *value;
27 double qval;
28 int n;
29@@ -541,9 +541,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
30 unsorted = soup_header_parse_list (header);
31 array = g_new0 (QualityItem, g_slist_length (unsorted));
32 for (iter = unsorted, n = 0; iter; iter = iter->next) {
33- item = iter->data;
34 qval = 1.0;
35- for (semi = strchr (item, ';'); semi; semi = strchr (semi + 1, ';')) {
36+ for (semi = strchr (iter->data, ';'); semi; semi = strchr (semi + 1, ';')) {
37 param = skip_lws (semi + 1);
38 if (*param != 'q')
39 continue;
40@@ -575,15 +574,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
41 if (qval == 0.0) {
42 if (unacceptable) {
43 *unacceptable = g_slist_prepend (*unacceptable,
44- item);
45+ g_steal_pointer (&iter->data));
46 }
47 } else {
48- array[n].item = item;
49+ array[n].item = g_steal_pointer (&iter->data);
50 array[n].qval = qval;
51 n++;
52 }
53 }
54- g_slist_free (unsorted);
55+ g_slist_free_full (unsorted, g_free);
56
57 qsort (array, n, sizeof (QualityItem), sort_by_qval);
58 sorted = NULL;
59--
602.34.1
61
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch
new file mode 100644
index 0000000000..3318093400
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch
@@ -0,0 +1,47 @@
1From 5eb225f02bb35de56cfeedd87bde716bf1cb750b Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Wed, 5 Feb 2025 16:18:10 -0600
4Subject: [PATCH] session: Strip authentication credentails on
5 cross-origin redirect
6
7This should match the behavior of Firefox and Safari but not of Chromium.
8
9CVE: CVE-2025-46421
10Upstream-Status: Backport
11[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/436/diffs?commit_id=3e5c26415811f19e7737238bb23305ffaf96f66b]
12
13Test code not added since it included some headers not in version 2.74.3
14
15Signed-off-by: Changqing Li <changqing.li@windriver.com>
16---
17 libsoup/soup-session.c | 8 ++++-
18 2 files changed, 85 insertions(+), 1 deletion(-)
19
20diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
21index 83421ef..8d6ac61 100644
22--- a/libsoup/soup-session.c
23+++ b/libsoup/soup-session.c
24@@ -1189,12 +1189,18 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg)
25 SOUP_ENCODING_NONE);
26 }
27
28+ /* Strip all credentials on cross-origin redirect. */
29+ if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
30+ soup_message_headers_remove (msg->request_headers, "Authorization");
31+ soup_message_set_auth (msg, NULL);
32+ }
33+
34 soup_message_set_uri (msg, new_uri);
35 soup_uri_free (new_uri);
36
37 soup_session_requeue_message (session, msg);
38 return TRUE;
39-}
40+}
41
42 static void
43 redirect_handler (SoupMessage *msg, gpointer user_data)
44
45--
462.34.1
47
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch
new file mode 100644
index 0000000000..b15b8c763d
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch
@@ -0,0 +1,38 @@
1From dfdc9b3cc73e6fe88cc12792ba00e14642572339 Mon Sep 17 00:00:00 2001
2From: Milan Crha <mcrha@redhat.com>
3Date: Thu, 15 May 2025 17:49:11 +0200
4Subject: [PATCH] soup-multipart: Verify boundary limits for multipart body
5
6It could happen that the boundary started at a place which resulted into
7a negative number, which in an unsigned integer is a very large value.
8Check the body size is not a negative value before setting it.
9
10Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
11
12Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/463>
13
14CVE: CVE-2025-4948
15Upstream-Status: Backport
16[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/463/diffs?commit_id=f2f28afe0b3b2b3009ab67d6874457ec6bac70c0]
17
18Signed-off-by: Changqing Li <changqing.li@windriver.com>
19---
20 libsoup/soup-multipart.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
24index dd93973..ce2fc10 100644
25--- a/libsoup/soup-multipart.c
26+++ b/libsoup/soup-multipart.c
27@@ -214,7 +214,7 @@ soup_multipart_new_from_message (SoupMessageHeaders *headers,
28 */
29 part_body = soup_buffer_new_subbuffer (flattened,
30 split - flattened->data,
31- end - 2 - split);
32+ end - 2 >= split ? end - 2 - split : 0);
33 g_ptr_array_add (multipart->bodies, part_body);
34
35 start = end;
36--
372.34.1
38
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch
new file mode 100644
index 0000000000..7bc3e8da99
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch
@@ -0,0 +1,37 @@
1From a7d0c58608ed830bedfb6b92aea11e00feb55aa9 Mon Sep 17 00:00:00 2001
2From: Milan Crha <mcrha@redhat.com>
3Date: Mon, 19 May 2025 17:48:27 +0200
4Subject: [PATCH] soup-multipart: Verify array bounds before accessing its
5 members
6
7The boundary could be at a place which, calculated, pointed
8before the beginning of the array. Check the bounds, to avoid
9read out of the array bounds.
10
11Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/447
12
13CVE: CVE-2025-4969
14Upstream-Status: Backport
15[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/467/diffs?commit_id=b5b4dd10d4810f0c87b4eaffe88504f06e502f33]
16
17Signed-off-by: Changqing Li <changqing.li@windriver.com>
18---
19 libsoup/soup-multipart.c | 2 +-
20 1 file changed, 1 insertion(+), 1 deletion(-)
21
22diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
23index ce2fc10..a29cdf0 100644
24--- a/libsoup/soup-multipart.c
25+++ b/libsoup/soup-multipart.c
26@@ -108,7 +108,7 @@ find_boundary (const char *start, const char *end,
27 continue;
28
29 /* Check that it's at start of line */
30- if (!(b == start || (b[-1] == '\n' && b[-2] == '\r')))
31+ if (!(b == start || (b - start >= 2 && b[-1] == '\n' && b[-2] == '\r')))
32 continue;
33
34 /* Check for "--" or "\r\n" after boundary */
35--
362.34.1
37
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
index 7e275a48f4..52e732b78d 100644
--- a/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
@@ -18,8 +18,28 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
18 file://0001-Remove-http-and-https-aliases-support-test.patch \ 18 file://0001-Remove-http-and-https-aliases-support-test.patch \
19 file://CVE-2024-52532-1.patch \ 19 file://CVE-2024-52532-1.patch \
20 file://CVE-2024-52532-2.patch \ 20 file://CVE-2024-52532-2.patch \
21 file://CVE-2024-52532-3.patch" 21 file://CVE-2024-52532-3.patch \
22 22 file://CVE-2025-32053.patch \
23 file://CVE-2025-2784.patch \
24 file://CVE-2024-52530.patch \
25 file://CVE-2025-32906.patch \
26 file://CVE-2025-32914.patch \
27 file://CVE-2025-46420.patch \
28 file://CVE-2025-46421.patch \
29 file://CVE-2025-32050.patch \
30 file://CVE-2025-32052.patch \
31 file://CVE-2025-32909.patch \
32 file://CVE-2025-32910-1.patch \
33 file://CVE-2025-32910-2.patch \
34 file://CVE-2025-32910-3.patch \
35 file://CVE-2025-32912.patch \
36 file://CVE-2024-52531-1.patch \
37 file://CVE-2024-52531-2.patch \
38 file://CVE-2025-4476.patch \
39 file://CVE-2025-32907.patch \
40 file://CVE-2025-4948.patch \
41 file://CVE-2025-4969.patch \
42"
23SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13" 43SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13"
24 44
25CVE_PRODUCT = "libsoup" 45CVE_PRODUCT = "libsoup"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-14 18:02:33 +0000