From 52c5859b82fe79f2c32d883e048d218e0d7f2182 Mon Sep 17 00:00:00 2001 From: Changqing Li Date: Wed, 30 Apr 2025 14:59:55 +0800 Subject: [PATCH] CVE-2025-32911 CVE: CVE-2025-32911 CVE-2025-32913 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/422/commits] Signed-off-by: Changqing Li --- libsoup/soup-message-headers.c | 13 +++++++++---- tests/header-parsing-test.c | 15 +++++++++++++++ 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c index 39ad14a..78b2455 100644 --- a/libsoup/soup-message-headers.c +++ b/libsoup/soup-message-headers.c @@ -1454,10 +1454,15 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders *hdrs, */ if (params && g_hash_table_lookup_extended (*params, "filename", &orig_key, &orig_value)) { - char *filename = strrchr (orig_value, '/'); - - if (filename) - g_hash_table_insert (*params, g_strdup (orig_key), filename + 1); + if (orig_value) { + char *filename = strrchr (orig_value, '/'); + + if (filename) + g_hash_table_insert (*params, g_strdup (orig_key), g_strdup(filename + 1)); + } else { + /* filename with no value isn't valid. */ + g_hash_table_remove (*params, "filename"); + } } return TRUE; } diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c index 946f118..752196e 100644 --- a/tests/header-parsing-test.c +++ b/tests/header-parsing-test.c @@ -1034,6 +1034,7 @@ do_param_list_tests (void) #define RFC5987_TEST_HEADER_FALLBACK "attachment; filename*=Unknown''t%FF%FF%FFst.txt; filename=\"test.txt\"" #define RFC5987_TEST_HEADER_NO_TYPE "filename=\"test.txt\"" #define RFC5987_TEST_HEADER_NO_TYPE_2 "filename=\"test.txt\"; foo=bar" +#define RFC5987_TEST_HEADER_EMPTY_FILENAME ";filename" static void do_content_disposition_tests (void) @@ -1133,6 +1134,20 @@ do_content_disposition_tests (void) g_assert_cmpstr (filename, ==, RFC5987_TEST_FALLBACK_FILENAME); parameter2 = g_hash_table_lookup (params, "foo"); g_assert_cmpstr (parameter2, ==, "bar"); + g_hash_table_destroy (params); + + /* Empty filename */ + soup_message_headers_clear (hdrs); + soup_message_headers_append (hdrs, "Content-Disposition", + RFC5987_TEST_HEADER_EMPTY_FILENAME); + if (!soup_message_headers_get_content_disposition (hdrs, + &disposition, + ¶ms)) { + soup_test_assert (FALSE, "empty filename decoding FAILED"); + return; + } + g_free (disposition); + g_assert_false (g_hash_table_contains (params, "filename")); g_hash_table_destroy (params); soup_message_headers_free (hdrs); -- 2.34.1