summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-support/libsoup/libsoup/CVE-2024-52531-1.patch116
-rw-r--r--meta/recipes-support/libsoup/libsoup/CVE-2024-52531-2.patch40
-rw-r--r--meta/recipes-support/libsoup/libsoup/CVE-2024-52531-3.patch136
-rw-r--r--meta/recipes-support/libsoup/libsoup_3.0.7.bb3
4 files changed, 295 insertions, 0 deletions
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-1.patch b/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-1.patch
new file mode 100644
index 0000000000..c8e855c128
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-1.patch
@@ -0,0 +1,116 @@
1From 4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Tue, 27 Aug 2024 12:18:58 -0500
4Subject: [PATCH] fuzzing: Cover soup_header_parse_param_list
5
6CVE: CVE-2024-52531
7Upstream-Status: Backport
8[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede]
9
10Signed-off-by: Changqing Li <changqing.li@windriver.com>
11
12---
13 fuzzing/fuzz.h | 9 +++++++--
14 fuzzing/fuzz_header_parsing.c | 19 +++++++++++++++++++
15 fuzzing/fuzz_header_parsing.dict | 8 ++++++++
16 fuzzing/meson.build | 2 ++
17 4 files changed, 36 insertions(+), 2 deletions(-)
18 create mode 100644 fuzzing/fuzz_header_parsing.c
19 create mode 100644 fuzzing/fuzz_header_parsing.dict
20
21diff --git a/fuzzing/fuzz.h b/fuzzing/fuzz.h
22index 0d380285..f3bd28ee 100644
23--- a/fuzzing/fuzz.h
24+++ b/fuzzing/fuzz.h
25@@ -1,13 +1,14 @@
26 #include "libsoup/soup.h"
27
28 int LLVMFuzzerTestOneInput (const unsigned char *data, size_t size);
29+static int set_logger = 0;
30
31 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
32 static GLogWriterOutput
33 empty_logging_func (GLogLevelFlags log_level, const GLogField *fields,
34 gsize n_fields, gpointer user_data)
35 {
36- return G_LOG_WRITER_HANDLED;
37+ return G_LOG_WRITER_HANDLED;
38 }
39 #endif
40
41@@ -16,6 +17,10 @@ static void
42 fuzz_set_logging_func (void)
43 {
44 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
45- g_log_set_writer_func (empty_logging_func, NULL, NULL);
46+ if (!set_logger)
47+ {
48+ set_logger = 1;
49+ g_log_set_writer_func (empty_logging_func, NULL, NULL);
50+ }
51 #endif
52 }
53diff --git a/fuzzing/fuzz_header_parsing.c b/fuzzing/fuzz_header_parsing.c
54new file mode 100644
55index 00000000..a8e5c1f9
56--- /dev/null
57+++ b/fuzzing/fuzz_header_parsing.c
58@@ -0,0 +1,19 @@
59+#include "fuzz.h"
60+
61+int
62+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
63+{
64+ GHashTable *elements;
65+
66+ // We only accept NUL terminated strings
67+ if (!size || data[size - 1] != '\0')
68+ return 0;
69+
70+ fuzz_set_logging_func ();
71+
72+ elements = soup_header_parse_param_list((char*)data);
73+
74+ g_hash_table_unref(elements);
75+
76+ return 0;
77+}
78\ No newline at end of file
79diff --git a/fuzzing/fuzz_header_parsing.dict b/fuzzing/fuzz_header_parsing.dict
80new file mode 100644
81index 00000000..1562ca3a
82--- /dev/null
83+++ b/fuzzing/fuzz_header_parsing.dict
84@@ -0,0 +1,8 @@
85+"*=UTF-8''"
86+"*=iso-8859-1''"
87+"'"
88+"''"
89+"="
90+"*="
91+"""
92+";"
93\ No newline at end of file
94diff --git a/fuzzing/meson.build b/fuzzing/meson.build
95index b14cbb50..5dd0f417 100644
96--- a/fuzzing/meson.build
97+++ b/fuzzing/meson.build
98@@ -5,6 +5,7 @@ fuzz_targets = [
99 'fuzz_cookie_parse',
100 'fuzz_content_sniffer',
101 'fuzz_date_time',
102+ 'fuzz_header_parsing',
103 ]
104
105 fuzzing_args = '-fsanitize=fuzzer,address,undefined'
106@@ -34,6 +35,7 @@ if have_fuzzing and (fuzzing_feature.enabled() or fuzzing_feature.auto())
107 '-runs=200000',
108 '-artifact_prefix=meson-logs/' + target + '-',
109 '-print_final_stats=1',
110+ '-max_len=4096',
111 ] + extra_args,
112 env: [
113 'ASAN_OPTIONS=fast_unwind_on_malloc=0',
114--
1152.25.1
116
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-2.patch b/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-2.patch
new file mode 100644
index 0000000000..7e0d81ba4c
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-2.patch
@@ -0,0 +1,40 @@
1From 825fda3425546847b42ad5270544e9388ff349fe Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Tue, 27 Aug 2024 13:52:08 -0500
4Subject: [PATCH] tests: Add test for passing invalid UTF-8 to
5 soup_header_parse_semi_param_list()
6
7CVE: CVE-2024-52531
8Upstream-Status: Backport
9[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=825fda3425546847b42ad5270544e9388ff349fe]
10
11Signed-off-by: Changqing Li <changqing.li@windriver.com>
12---
13 tests/header-parsing-test.c | 11 +++++++++++
14 1 file changed, 11 insertions(+)
15
16diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
17index 715c2c6f..5e423d2b 100644
18--- a/tests/header-parsing-test.c
19+++ b/tests/header-parsing-test.c
20@@ -825,6 +825,17 @@ static struct ParamListTest {
21 { "filename", "t\xC3\xA9st.txt" },
22 },
23 },
24+
25+ /* This tests invalid UTF-8 data which *should* never be passed here but it was designed to be robust against it. */
26+ { TRUE,
27+ "invalid*=\x69\x27\x27\x93\x93\x93\x93\xff\x61\x61\x61\x61\x61\x61\x61\x62\x63\x64\x65\x0a; filename*=iso-8859-1''\x69\x27\x27\x93\x93\x93\x93\xff\x61\x61\x61\x61\x61\x61\x61\x62\x63\x64\x65\x0a; foo",
28+ {
29+ { "filename", "i''\302\223\302\223\302\223\302\223\303\277aaaaaaabcde" },
30+ { "invalid", "\302\223\302\223\302\223\302\223\303\277aaaaaaabcde" },
31+ { "foo", NULL },
32+
33+ },
34+ }
35 };
36 static const int num_paramlisttests = G_N_ELEMENTS (paramlisttests);
37
38--
392.25.1
40
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-3.patch b/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-3.patch
new file mode 100644
index 0000000000..a47c8747c5
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2024-52531-3.patch
@@ -0,0 +1,136 @@
1From a35222dd0bfab2ac97c10e86b95f762456628283 Mon Sep 17 00:00:00 2001
2From: Patrick Griffis <pgriffis@igalia.com>
3Date: Tue, 27 Aug 2024 13:53:26 -0500
4Subject: [PATCH] headers: Be more robust against invalid input when parsing
5 params
6
7If you pass invalid input to a function such as soup_header_parse_param_list_strict()
8it can cause an overflow if it decodes the input to UTF-8.
9
10This should never happen with valid UTF-8 input which libsoup's client API
11ensures, however it's server API does not currently.
12
13CVE: CVE-2024-52531
14Upstream-Status: Backport
15[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=a35222dd0bfab2ac97c10e86b95f762456628283]
16
17Signed-off-by: Changqing Li <changqing.li@windriver.com>
18
19---
20 libsoup/soup-headers.c | 46 ++++++++++++++++++++++--------------------
21 1 file changed, 24 insertions(+), 22 deletions(-)
22
23diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
24index f30ee467..613e1905 100644
25--- a/libsoup/soup-headers.c
26+++ b/libsoup/soup-headers.c
27@@ -646,8 +646,9 @@ soup_header_contains (const char *header, const char *token)
28 }
29
30 static void
31-decode_quoted_string (char *quoted_string)
32+decode_quoted_string_inplace (GString *quoted_gstring)
33 {
34+ char *quoted_string = quoted_gstring->str;
35 char *src, *dst;
36
37 src = quoted_string + 1;
38@@ -661,10 +662,11 @@ decode_quoted_string (char *quoted_string)
39 }
40
41 static gboolean
42-decode_rfc5987 (char *encoded_string)
43+decode_rfc5987_inplace (GString *encoded_gstring)
44 {
45 char *q, *decoded;
46 gboolean iso_8859_1 = FALSE;
47+ const char *encoded_string = encoded_gstring->str;
48
49 q = strchr (encoded_string, '\'');
50 if (!q)
51@@ -696,14 +698,7 @@ decode_rfc5987 (char *encoded_string)
52 decoded = utf8;
53 }
54
55- /* If encoded_string was UTF-8, then each 3-character %-escape
56- * will be converted to a single byte, and so decoded is
57- * shorter than encoded_string. If encoded_string was
58- * iso-8859-1, then each 3-character %-escape will be
59- * converted into at most 2 bytes in UTF-8, and so it's still
60- * shorter.
61- */
62- strcpy (encoded_string, decoded);
63+ g_string_assign (encoded_gstring, decoded);
64 g_free (decoded);
65 return TRUE;
66 }
67@@ -713,15 +708,17 @@ parse_param_list (const char *header, char delim, gboolean strict)
68 {
69 GHashTable *params;
70 GSList *list, *iter;
71- char *item, *eq, *name_end, *value;
72- gboolean override, duplicated;
73
74 params = g_hash_table_new_full (soup_str_case_hash,
75 soup_str_case_equal,
76- g_free, NULL);
77+ g_free, g_free);
78
79 list = parse_list (header, delim);
80 for (iter = list; iter; iter = iter->next) {
81+ char *item, *eq, *name_end;
82+ gboolean override, duplicated;
83+ GString *parsed_value = NULL;
84+
85 item = iter->data;
86 override = FALSE;
87
88@@ -736,19 +733,19 @@ parse_param_list (const char *header, char delim, gboolean strict)
89
90 *name_end = '\0';
91
92- value = (char *)skip_lws (eq + 1);
93+ parsed_value = g_string_new ((char *)skip_lws (eq + 1));
94
95 if (name_end[-1] == '*' && name_end > item + 1) {
96 name_end[-1] = '\0';
97- if (!decode_rfc5987 (value)) {
98+ if (!decode_rfc5987_inplace (parsed_value)) {
99+ g_string_free (parsed_value, TRUE);
100 g_free (item);
101 continue;
102 }
103 override = TRUE;
104- } else if (*value == '"')
105- decode_quoted_string (value);
106- } else
107- value = NULL;
108+ } else if (parsed_value->str[0] == '"')
109+ decode_quoted_string_inplace (parsed_value);
110+ }
111
112 duplicated = g_hash_table_lookup_extended (params, item, NULL, NULL);
113
114@@ -756,11 +753,16 @@ parse_param_list (const char *header, char delim, gboolean strict)
115 soup_header_free_param_list (params);
116 params = NULL;
117 g_slist_foreach (iter, (GFunc)g_free, NULL);
118+ if (parsed_value)
119+ g_string_free (parsed_value, TRUE);
120 break;
121- } else if (override || !duplicated)
122- g_hash_table_replace (params, item, value);
123- else
124+ } else if (override || !duplicated) {
125+ g_hash_table_replace (params, item, parsed_value ? g_string_free (parsed_value, FALSE) : NULL);
126+ } else {
127+ if (parsed_value)
128+ g_string_free (parsed_value, TRUE);
129 g_free (item);
130+ }
131 }
132
133 g_slist_free (list);
134--
1352.25.1
136
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index 919fef5107..869f0f1696 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -15,6 +15,9 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
15 file://CVE-2024-52530.patch \ 15 file://CVE-2024-52530.patch \
16 file://CVE-2024-52532-1.patch \ 16 file://CVE-2024-52532-1.patch \
17 file://CVE-2024-52532-2.patch \ 17 file://CVE-2024-52532-2.patch \
18 file://CVE-2024-52531-1.patch \
19 file://CVE-2024-52531-2.patch \
20 file://CVE-2024-52531-3.patch \
18 " 21 "
19SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8" 22SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
20 23
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-17 08:36:04 +0000