diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-1.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-1.patch deleted file mode 100644 index adec7b3cf07..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-1.patch +++ /dev/null @@ -1,229 +0,0 @@ -From 46338bccc2ad9c34f892af19123f64ca2d9d866f Mon Sep 17 00:00:00 2001 -From: Ignacio Casal Quinteiro -Date: Wed, 24 Jul 2024 15:20:35 +0200 -Subject: [PATCH 1/4] websocket: add a way to restrict the total message size - -Otherwise a client could send small packages smaller than -total-incoming-payload-size but still to break the server -with a big allocation - -Fixes: #390 - -Change SOUP_AVAILABLE_IN_3_8 to SOUP_AVAILABLE_IN_3_6 -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/db87805ab565d67533dfed2cb409dbfd63c7fdce] -CVE: CVE-2025-32049 - -Signed-off-by: Changqing Li ---- - libsoup/websocket/soup-websocket-connection.c | 106 +++++++++++++++++- - libsoup/websocket/soup-websocket-connection.h | 7 ++ - 2 files changed, 110 insertions(+), 3 deletions(-) - -diff --git a/libsoup/websocket/soup-websocket-connection.c b/libsoup/websocket/soup-websocket-connection.c -index 36e8459..a4fc36e 100644 ---- a/libsoup/websocket/soup-websocket-connection.c -+++ b/libsoup/websocket/soup-websocket-connection.c -@@ -78,6 +78,7 @@ enum { - PROP_KEEPALIVE_INTERVAL, - PROP_KEEPALIVE_PONG_TIMEOUT, - PROP_EXTENSIONS, -+ PROP_MAX_TOTAL_MESSAGE_SIZE, - - LAST_PROPERTY - }; -@@ -120,6 +121,7 @@ typedef struct { - char *origin; - char *protocol; - guint64 max_incoming_payload_size; -+ guint64 max_total_message_size; - guint keepalive_interval; - guint keepalive_pong_timeout; - guint64 last_keepalive_seq_num; -@@ -164,6 +166,7 @@ typedef struct { - } SoupWebsocketConnectionPrivate; - - #define MAX_INCOMING_PAYLOAD_SIZE_DEFAULT 128 * 1024 -+#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT 128 * 1024 - #define READ_BUFFER_SIZE 1024 - #define MASK_LENGTH 4 - -@@ -696,8 +699,8 @@ bad_data_error_and_close (SoupWebsocketConnection *self) - } - - static void --too_big_error_and_close (SoupWebsocketConnection *self, -- guint64 payload_len) -+too_big_incoming_payload_error_and_close (SoupWebsocketConnection *self, -+ guint64 payload_len) - { - SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self); - GError *error; -@@ -713,6 +716,24 @@ too_big_error_and_close (SoupWebsocketConnection *self, - emit_error_and_close (self, error, TRUE); - } - -+static void -+too_big_message_error_and_close (SoupWebsocketConnection *self, -+ guint64 len) -+{ -+ SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self); -+ GError *error; -+ -+ error = g_error_new_literal (SOUP_WEBSOCKET_ERROR, -+ SOUP_WEBSOCKET_CLOSE_TOO_BIG, -+ priv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ? -+ "Received WebSocket payload from the client larger than configured max-total-message-size" : -+ "Received WebSocket payload from the server larger than configured max-total-message-size"); -+ g_debug ("%s received message of size %" G_GUINT64_FORMAT " or greater, but max supported size is %" G_GUINT64_FORMAT, -+ priv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ? "server" : "client", -+ len, priv->max_total_message_size); -+ emit_error_and_close (self, error, TRUE); -+} -+ - static void - close_connection (SoupWebsocketConnection *self, - gushort code, -@@ -973,6 +994,12 @@ process_contents (SoupWebsocketConnection *self, - switch (priv->message_opcode) { - case 0x01: - case 0x02: -+ /* Safety valve */ -+ if (priv->max_total_message_size > 0 && -+ (priv->message_data->len + payload_len) > priv->max_total_message_size) { -+ too_big_message_error_and_close (self, (priv->message_data->len + payload_len)); -+ return; -+ } - g_byte_array_append (priv->message_data, payload, payload_len); - break; - default: -@@ -1111,7 +1138,7 @@ process_frame (SoupWebsocketConnection *self) - /* Safety valve */ - if (priv->max_incoming_payload_size > 0 && - payload_len > priv->max_incoming_payload_size) { -- too_big_error_and_close (self, payload_len); -+ too_big_incoming_payload_error_and_close (self, payload_len); - return FALSE; - } - -@@ -1428,6 +1455,10 @@ soup_websocket_connection_get_property (GObject *object, - g_value_set_pointer (value, priv->extensions); - break; - -+ case PROP_MAX_TOTAL_MESSAGE_SIZE: -+ g_value_set_uint64 (value, priv->max_total_message_size); -+ break; -+ - default: - G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); - break; -@@ -1486,6 +1517,10 @@ soup_websocket_connection_set_property (GObject *object, - priv->extensions = g_value_get_pointer (value); - break; - -+ case PROP_MAX_TOTAL_MESSAGE_SIZE: -+ priv->max_total_message_size = g_value_get_uint64 (value); -+ break; -+ - default: - G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); - break; -@@ -1716,6 +1751,26 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass) - G_PARAM_CONSTRUCT_ONLY | - G_PARAM_STATIC_STRINGS); - -+ /** -+ * SoupWebsocketConnection:max-total-message-size: -+ * -+ * The total message size for incoming packets. -+ * -+ * The protocol expects or 0 to not limit it. -+ * -+ * Since: 3.8 -+ */ -+ properties[PROP_MAX_TOTAL_MESSAGE_SIZE] = -+ g_param_spec_uint64 ("max-total-message-size", -+ "Max total message size", -+ "Max total message size ", -+ 0, -+ G_MAXUINT64, -+ MAX_TOTAL_MESSAGE_SIZE_DEFAULT, -+ G_PARAM_READWRITE | -+ G_PARAM_CONSTRUCT | -+ G_PARAM_STATIC_STRINGS); -+ - g_object_class_install_properties (gobject_class, LAST_PROPERTY, properties); - - /** -@@ -2186,6 +2241,51 @@ soup_websocket_connection_set_max_incoming_payload_size (SoupWebsocketConnection - } - } - -+/** -+ * soup_websocket_connection_get_max_total_message_size: -+ * @self: the WebSocket -+ * -+ * Gets the maximum total message size allowed for packets. -+ * -+ * Returns: the maximum total message size. -+ * -+ * Since: 3.8 -+ */ -+guint64 -+soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self) -+{ -+ SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self); -+ -+ g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), MAX_TOTAL_MESSAGE_SIZE_DEFAULT); -+ -+ return priv->max_total_message_size; -+} -+ -+/** -+ * soup_websocket_connection_set_max_total_message_size: -+ * @self: the WebSocket -+ * @max_total_message_size: the maximum total message size -+ * -+ * Sets the maximum total message size allowed for packets. -+ * -+ * It does not limit the outgoing packet size. -+ * -+ * Since: 3.8 -+ */ -+void -+soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self, -+ guint64 max_total_message_size) -+{ -+ SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self); -+ -+ g_return_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self)); -+ -+ if (priv->max_total_message_size != max_total_message_size) { -+ priv->max_total_message_size = max_total_message_size; -+ g_object_notify_by_pspec (G_OBJECT (self), properties[PROP_MAX_TOTAL_MESSAGE_SIZE]); -+ } -+} -+ - /** - * soup_websocket_connection_get_keepalive_interval: - * @self: the WebSocket -diff --git a/libsoup/websocket/soup-websocket-connection.h b/libsoup/websocket/soup-websocket-connection.h -index f047c0a..ea0cb58 100644 ---- a/libsoup/websocket/soup-websocket-connection.h -+++ b/libsoup/websocket/soup-websocket-connection.h -@@ -88,6 +88,13 @@ SOUP_AVAILABLE_IN_ALL - void soup_websocket_connection_set_max_incoming_payload_size (SoupWebsocketConnection *self, - guint64 max_incoming_payload_size); - -+SOUP_AVAILABLE_IN_3_6 -+guint64 soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self); -+ -+SOUP_AVAILABLE_IN_3_6 -+void soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self, -+ guint64 max_total_message_size); -+ - SOUP_AVAILABLE_IN_ALL - guint soup_websocket_connection_get_keepalive_interval (SoupWebsocketConnection *self); - --- -2.34.1 - diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-2.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-2.patch deleted file mode 100644 index 4cb9cf201b1..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-2.patch +++ /dev/null @@ -1,34 +0,0 @@ -From c00f1e961a17c0af1cd34881f64db2948f32bb65 Mon Sep 17 00:00:00 2001 -From: Ignacio Casal Quinteiro -Date: Fri, 20 Sep 2024 12:12:38 +0200 -Subject: [PATCH 2/4] websocket-test: set the total message size - -This is required when sending a big amount of data - -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/4904a46a2d9a014efa6be01a186ac353dbf5047b] -CVE: CVE-2025-32049 - -Signed-off-by: Changqing Li ---- - tests/websocket-test.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/tests/websocket-test.c b/tests/websocket-test.c -index c924601..1678042 100644 ---- a/tests/websocket-test.c -+++ b/tests/websocket-test.c -@@ -615,6 +615,11 @@ test_send_big_packets (Test *test, - soup_websocket_connection_set_max_incoming_payload_size (test->server, 1000 * 1000 + 1); - g_assert_true (soup_websocket_connection_get_max_incoming_payload_size (test->server) == (1000 * 1000 + 1)); - -+ soup_websocket_connection_set_max_total_message_size (test->client, 1000 * 1000 + 1); -+ g_assert (soup_websocket_connection_get_max_total_message_size (test->client) == (1000 * 1000 + 1)); -+ soup_websocket_connection_set_max_total_message_size (test->server, 1000 * 1000 + 1); -+ g_assert (soup_websocket_connection_get_max_total_message_size (test->server) == (1000 * 1000 + 1)); -+ - sent = g_bytes_new_take (g_strnfill (1000 * 1000, '?'), 1000 * 1000); - soup_websocket_connection_send_text (test->server, g_bytes_get_data (sent, NULL)); - WAIT_UNTIL (received != NULL); --- -2.34.1 - diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-3.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-3.patch deleted file mode 100644 index b5ccf374bf1..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-3.patch +++ /dev/null @@ -1,133 +0,0 @@ -From aa189f8bf0593427c67e0becb13f60f2da2fea26 Mon Sep 17 00:00:00 2001 -From: Michael Catanzaro -Date: Thu, 8 May 2025 16:16:25 -0500 -Subject: [PATCH 3/4] Set message size limit in SoupServer rather than - SoupWebsocketConnection - -We're not sure about the compatibility implications of having a default -size limit for clients. - -Also not sure whether the server limit is actually set appropriately, -but there is probably very little server usage of -SoupWebsocketConnection in the wild, so it's not so likely to break -things. - -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/2df34d9544cabdbfdedd3b36f098cf69233b1df7] -CVE: CVE-2025-32049 - -Signed-off-by: Changqing Li ---- - libsoup/server/soup-server.c | 24 +++++++++++++++---- - libsoup/websocket/soup-websocket-connection.c | 24 +++++++++++++------ - 2 files changed, 36 insertions(+), 12 deletions(-) - -diff --git a/libsoup/server/soup-server.c b/libsoup/server/soup-server.c -index 63af0cf..023abed 100644 ---- a/libsoup/server/soup-server.c -+++ b/libsoup/server/soup-server.c -@@ -188,6 +188,16 @@ static GParamSpec *properties[LAST_PROPERTY] = { NULL, }; - - G_DEFINE_TYPE_WITH_PRIVATE (SoupServer, soup_server, G_TYPE_OBJECT) - -+/* SoupWebsocketConnection by default limits only maximum packet size. But a -+ * message may consist of multiple packets, so SoupServer additionally restricts -+ * total message size to mitigate denial of service attacks on the server. -+ * SoupWebsocketConnection does not do this by default because I don't know -+ * whether that would or would not cause compatibility problems for websites. -+ * -+ * This size is in bytes and it is arbitrary. -+ */ -+#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT 128 * 1024 -+ - static void request_finished (SoupServerMessage *msg, - SoupMessageIOCompletion completion, - SoupServer *server); -@@ -952,11 +962,15 @@ complete_websocket_upgrade (SoupServer *server, - - g_object_ref (msg); - stream = soup_server_message_steal_connection (msg); -- conn = soup_websocket_connection_new (stream, uri, -- SOUP_WEBSOCKET_CONNECTION_SERVER, -- soup_message_headers_get_one_common (soup_server_message_get_request_headers (msg), SOUP_HEADER_ORIGIN), -- soup_message_headers_get_one_common (soup_server_message_get_response_headers (msg), SOUP_HEADER_SEC_WEBSOCKET_PROTOCOL), -- handler->websocket_extensions); -+ conn = SOUP_WEBSOCKET_CONNECTION (g_object_new (SOUP_TYPE_WEBSOCKET_CONNECTION, -+ "io-stream", stream, -+ "uri", uri, -+ "connection-type", SOUP_WEBSOCKET_CONNECTION_SERVER, -+ "origin", soup_message_headers_get_one_common (soup_server_message_get_request_headers (msg), SOUP_HEADER_ORIGIN), -+ "protocol", soup_message_headers_get_one_common (soup_server_message_get_response_headers (msg), SOUP_HEADER_SEC_WEBSOCKET_PROTOCOL), -+ "extensions", handler->websocket_extensions, -+ "max-total-message-size", (guint64)MAX_TOTAL_MESSAGE_SIZE_DEFAULT, -+ NULL)); - handler->websocket_extensions = NULL; - g_object_unref (stream); - -diff --git a/libsoup/websocket/soup-websocket-connection.c b/libsoup/websocket/soup-websocket-connection.c -index a4fc36e..f60297c 100644 ---- a/libsoup/websocket/soup-websocket-connection.c -+++ b/libsoup/websocket/soup-websocket-connection.c -@@ -166,7 +166,6 @@ typedef struct { - } SoupWebsocketConnectionPrivate; - - #define MAX_INCOMING_PAYLOAD_SIZE_DEFAULT 128 * 1024 --#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT 128 * 1024 - #define READ_BUFFER_SIZE 1024 - #define MASK_LENGTH 4 - -@@ -1681,9 +1680,10 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass) - /** - * SoupWebsocketConnection:max-incoming-payload-size: - * -- * The maximum payload size for incoming packets. -+ * The maximum payload size for incoming packets, or 0 to not limit it. - * -- * The protocol expects or 0 to not limit it. -+ * Each message may consist of multiple packets, so also refer to -+ * [property@WebSocketConnection:max-total-message-size]. - */ - properties[PROP_MAX_INCOMING_PAYLOAD_SIZE] = - g_param_spec_uint64 ("max-incoming-payload-size", -@@ -1754,9 +1754,19 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass) - /** - * SoupWebsocketConnection:max-total-message-size: - * -- * The total message size for incoming packets. -+ * The maximum size for incoming messages. - * -- * The protocol expects or 0 to not limit it. -+ * Set to a value to limit the total message size, or 0 to not -+ * limit it. -+ * -+ * [method@Server.add_websocket_handler] will set this to a nonzero -+ * default value to mitigate denial of service attacks. Clients must -+ * choose their own default if they need to mitigate denial of service -+ * attacks. You also need to set your own default if creating your own -+ * server SoupWebsocketConnection without using SoupServer. -+ * -+ * Each message may consist of multiple packets, so also refer to -+ * [property@WebSocketConnection:max-incoming-payload-size]. - * - * Since: 3.8 - */ -@@ -1766,7 +1776,7 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass) - "Max total message size ", - 0, - G_MAXUINT64, -- MAX_TOTAL_MESSAGE_SIZE_DEFAULT, -+ 0, - G_PARAM_READWRITE | - G_PARAM_CONSTRUCT | - G_PARAM_STATIC_STRINGS); -@@ -2256,7 +2266,7 @@ soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *s - { - SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self); - -- g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), MAX_TOTAL_MESSAGE_SIZE_DEFAULT); -+ g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), 0); - - return priv->max_total_message_size; - } --- -2.34.1 - diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-4.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-4.patch deleted file mode 100644 index c89637eae24..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2025-32049-4.patch +++ /dev/null @@ -1,291 +0,0 @@ -From 800cbde5e42131bdea3d6f30808b7e034d45d438 Mon Sep 17 00:00:00 2001 -From: Michael Catanzaro -Date: Fri, 16 May 2025 16:55:40 -0500 -Subject: [PATCH 4/4] Add tests for max-incoming-packet-size and - max-total-message-size - -An even better test would verify that it's possible to send big messages -containing small packets, but libsoup doesn't offer control over packet -size, and I don't want to take the time to learn how WebSockets work to -figure out how to do that manually. Instead, I just check that both -limits work, for both client and server. - -I didn't add deflate variants of these tests because I doubt that would -add valuable coverage. - -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/4d00b45b7eebdcfa0706b58e34c40b8a0a16015b] -CVE: CVE-2025-32049 - -Signed-off-by: Changqing Li ---- - tests/websocket-test.c | 213 +++++++++++++++++++++++++++++++++++++---- - 1 file changed, 196 insertions(+), 17 deletions(-) - -diff --git a/tests/websocket-test.c b/tests/websocket-test.c -index 1678042..60da66f 100644 ---- a/tests/websocket-test.c -+++ b/tests/websocket-test.c -@@ -591,16 +591,9 @@ test_send_big_packets (Test *test, - { - GBytes *sent = NULL; - GBytes *received = NULL; -+ gulong signal_id; - -- g_signal_connect (test->client, "message", G_CALLBACK (on_text_message), &received); -- -- sent = g_bytes_new_take (g_strnfill (400, '!'), 400); -- soup_websocket_connection_send_text (test->server, g_bytes_get_data (sent, NULL)); -- WAIT_UNTIL (received != NULL); -- g_assert_true (g_bytes_equal (sent, received)); -- g_bytes_unref (sent); -- g_bytes_unref (received); -- received = NULL; -+ signal_id = g_signal_connect (test->client, "message", G_CALLBACK (on_text_message), &received); - - sent = g_bytes_new_take (g_strnfill (100 * 1000, '?'), 100 * 1000); - soup_websocket_connection_send_text (test->server, g_bytes_get_data (sent, NULL)); -@@ -611,23 +604,173 @@ test_send_big_packets (Test *test, - received = NULL; - - soup_websocket_connection_set_max_incoming_payload_size (test->client, 1000 * 1000 + 1); -- g_assert_true (soup_websocket_connection_get_max_incoming_payload_size (test->client) == (1000 * 1000 + 1)); -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->client), ==, 1000 * 1000 + 1); - soup_websocket_connection_set_max_incoming_payload_size (test->server, 1000 * 1000 + 1); -- g_assert_true (soup_websocket_connection_get_max_incoming_payload_size (test->server) == (1000 * 1000 + 1)); -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->server), ==, 1000 * 1000 + 1); - - soup_websocket_connection_set_max_total_message_size (test->client, 1000 * 1000 + 1); -- g_assert (soup_websocket_connection_get_max_total_message_size (test->client) == (1000 * 1000 + 1)); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->client), ==, 1000 * 1000 + 1); - soup_websocket_connection_set_max_total_message_size (test->server, 1000 * 1000 + 1); -- g_assert (soup_websocket_connection_get_max_total_message_size (test->server) == (1000 * 1000 + 1)); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->server), ==, 1000 * 1000 + 1); - - sent = g_bytes_new_take (g_strnfill (1000 * 1000, '?'), 1000 * 1000); - soup_websocket_connection_send_text (test->server, g_bytes_get_data (sent, NULL)); - WAIT_UNTIL (received != NULL); - g_assert_true (g_bytes_equal (sent, received)); -+ g_bytes_unref (received); -+ received = NULL; -+ -+ /* Reverse the test and send the big message to the server. */ -+ g_signal_handler_disconnect (test->client, signal_id); -+ g_signal_connect (test->server, "message", G_CALLBACK (on_text_message), &received); -+ -+ soup_websocket_connection_send_text (test->client, g_bytes_get_data (sent, NULL)); -+ WAIT_UNTIL (received != NULL); -+ g_assert_true (g_bytes_equal (sent, received)); - g_bytes_unref (sent); - g_bytes_unref (received); - } - -+static void -+test_send_big_packets_direct (Test *test, -+ gconstpointer data) -+{ -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->client), ==, 128 * 1024); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->client), ==, 0); -+ -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->server), ==, 128 * 1024); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->server), ==, 0); -+ -+ test_send_big_packets (test, data); -+} -+ -+static void -+test_send_big_packets_soup (Test *test, -+ gconstpointer data) -+{ -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->client), ==, 128 * 1024); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->client), ==, 0); -+ -+ /* Max total message size defaults to 0 (unlimited), but SoupServer applies its own limit by default. */ -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->server), ==, 128 * 1024); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->server), ==, 128 * 1024); -+ -+ test_send_big_packets (test, data); -+} -+ -+static void -+test_send_exceeding_client_max_payload_size (Test *test, -+ gconstpointer data) -+{ -+ GBytes *sent = NULL; -+ GBytes *received = NULL; -+ gboolean close_event = FALSE; -+ GError *error = NULL; -+ -+ g_signal_connect (test->server, "error", G_CALLBACK (on_error_copy), &error); -+ g_signal_connect (test->client, "closed", G_CALLBACK (on_close_set_flag), &close_event); -+ -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->client), ==, 128 * 1024); -+ -+ soup_websocket_connection_set_max_incoming_payload_size (test->server, 0); -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->server), ==, 0); -+ -+ /* The message to the client is dropped due to the client's limit. */ -+ sent = g_bytes_new_take (g_strnfill (1000 * 1000, '?'), 1000 * 1000); -+ soup_websocket_connection_send_text (test->server, g_bytes_get_data (sent, NULL)); -+ g_bytes_unref (sent); -+ WAIT_UNTIL (close_event); -+ g_assert_null (received); -+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED); -+ g_assert_no_error (test->client_error); -+} -+ -+static void -+test_send_exceeding_server_max_payload_size (Test *test, -+ gconstpointer data) -+{ -+ GBytes *sent = NULL; -+ GBytes *received = NULL; -+ gboolean close_event = FALSE; -+ GError *error = NULL; -+ -+ g_signal_connect (test->client, "error", G_CALLBACK (on_error_copy), &error); -+ g_signal_connect (test->server, "closed", G_CALLBACK (on_close_set_flag), &close_event); -+ -+ soup_websocket_connection_set_max_incoming_payload_size (test->client, 0); -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->client), ==, 0); -+ -+ g_assert_cmpuint (soup_websocket_connection_get_max_incoming_payload_size (test->server), ==, 128 * 1024); -+ -+ /* The message to the server is dropped due to the server's limit. */ -+ sent = g_bytes_new_take (g_strnfill (1000 * 1000, '?'), 1000 * 1000); -+ soup_websocket_connection_send_text (test->client, g_bytes_get_data (sent, NULL)); -+ g_bytes_unref (sent); -+ WAIT_UNTIL (close_event); -+ g_assert_null (received); -+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED); -+ g_assert_no_error (test->client_error); -+} -+ -+static void -+test_send_exceeding_client_max_message_size (Test *test, -+ gconstpointer data) -+{ -+ GBytes *sent = NULL; -+ GBytes *received = NULL; -+ gboolean close_event = FALSE; -+ GError *error = NULL; -+ -+ g_signal_connect (test->server, "error", G_CALLBACK (on_error_copy), &error); -+ g_signal_connect (test->client, "closed", G_CALLBACK (on_close_set_flag), &close_event); -+ -+ soup_websocket_connection_set_max_total_message_size (test->client, 128 * 1024); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->client), ==, 128 * 1024); -+ -+ soup_websocket_connection_set_max_total_message_size (test->server, 0); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->server), ==, 0); -+ -+ /* The message to the client is dropped due to the client's limit. */ -+ sent = g_bytes_new_take (g_strnfill (1000 * 1000, '?'), 1000 * 1000); -+ soup_websocket_connection_send_text (test->server, g_bytes_get_data (sent, NULL)); -+ g_bytes_unref (sent); -+ WAIT_UNTIL (close_event); -+ g_assert_null (received); -+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED); -+ g_assert_no_error (test->client_error); -+} -+ -+static void -+test_send_exceeding_server_max_message_size (Test *test, -+ gconstpointer data) -+{ -+ GBytes *sent = NULL; -+ GBytes *received = NULL; -+ gboolean close_event = FALSE; -+ GError *error = NULL; -+ -+ g_signal_connect (test->client, "error", G_CALLBACK (on_error_copy), &error); -+ g_signal_connect (test->server, "closed", G_CALLBACK (on_close_set_flag), &close_event); -+ -+ soup_websocket_connection_set_max_total_message_size (test->client, 0); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->client), ==, 0); -+ -+ /* Set the server message total message size manually, because its -+ * default is different for direct connection vs. soup connection. -+ */ -+ soup_websocket_connection_set_max_total_message_size (test->server, 128 * 1024); -+ g_assert_cmpuint (soup_websocket_connection_get_max_total_message_size (test->server), ==, 128 * 1024); -+ -+ /* The message to the server is dropped due to the server's limit. */ -+ sent = g_bytes_new_take (g_strnfill (1000 * 1000, '?'), 1000 * 1000); -+ soup_websocket_connection_send_text (test->client, g_bytes_get_data (sent, NULL)); -+ g_bytes_unref (sent); -+ WAIT_UNTIL (close_event); -+ g_assert_null (received); -+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED); -+ g_assert_no_error (test->client_error); -+} -+ - static void - test_send_empty_packets (Test *test, - gconstpointer data) -@@ -2262,11 +2405,47 @@ main (int argc, - - g_test_add ("/websocket/direct/send-big-packets", Test, NULL, - setup_direct_connection, -- test_send_big_packets, -+ test_send_big_packets_direct, - teardown_direct_connection); - g_test_add ("/websocket/soup/send-big-packets", Test, NULL, - setup_soup_connection, -- test_send_big_packets, -+ test_send_big_packets_soup, -+ teardown_soup_connection); -+ -+ g_test_add ("/websocket/direct/send-exceeding-client-max-payload-size", Test, NULL, -+ setup_direct_connection, -+ test_send_exceeding_client_max_payload_size, -+ teardown_direct_connection); -+ g_test_add ("/websocket/soup/send-exceeding-client-max-payload-size", Test, NULL, -+ setup_soup_connection, -+ test_send_exceeding_client_max_payload_size, -+ teardown_soup_connection); -+ -+ g_test_add ("/websocket/direct/send-exceeding-server-max-payload-size", Test, NULL, -+ setup_direct_connection, -+ test_send_exceeding_server_max_payload_size, -+ teardown_direct_connection); -+ g_test_add ("/websocket/soup/send-exceeding-server-max-payload-size", Test, NULL, -+ setup_soup_connection, -+ test_send_exceeding_server_max_payload_size, -+ teardown_soup_connection); -+ -+ g_test_add ("/websocket/direct/send-exceeding-client-max-message-size", Test, NULL, -+ setup_direct_connection, -+ test_send_exceeding_client_max_message_size, -+ teardown_direct_connection); -+ g_test_add ("/websocket/soup/send-exceeding-client-max-message-size", Test, NULL, -+ setup_soup_connection, -+ test_send_exceeding_client_max_message_size, -+ teardown_soup_connection); -+ -+ g_test_add ("/websocket/direct/send-exceeding-server-max-message-size", Test, NULL, -+ setup_direct_connection, -+ test_send_exceeding_server_max_message_size, -+ teardown_direct_connection); -+ g_test_add ("/websocket/soup/send-exceeding-server-max-message-size", Test, NULL, -+ setup_soup_connection, -+ test_send_exceeding_server_max_message_size, - teardown_soup_connection); - - g_test_add ("/websocket/direct/send-empty-packets", Test, NULL, -@@ -2421,11 +2600,11 @@ main (int argc, - - g_test_add ("/websocket/direct/deflate-send-big-packets", Test, NULL, - setup_direct_connection_with_extensions, -- test_send_big_packets, -+ test_send_big_packets_direct, - teardown_direct_connection); - g_test_add ("/websocket/soup/deflate-send-big-packets", Test, NULL, - setup_soup_connection_with_extensions, -- test_send_big_packets, -+ test_send_big_packets_soup, - teardown_soup_connection); - - g_test_add ("/websocket/direct/deflate-send-empty-packets", Test, NULL, --- -2.34.1 - diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2026-1539.patch b/meta/recipes-support/libsoup/libsoup/CVE-2026-1539.patch deleted file mode 100644 index e887b441df9..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2026-1539.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 7a70f089e13cc113032b1459286835b72a2986af Mon Sep 17 00:00:00 2001 -From: Carlos Garcia Campos -Date: Tue, 20 Jan 2026 13:17:42 +0100 -Subject: [PATCH] Also remove Proxy-Authorization header on cross origin - redirect - -Closes #489 - -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/98c1285d9d78662c38bf14b4a128af01ccfdb446] -CVE: CVE-2026-1539 - -Signed-off-by: Changqing Li ---- - libsoup/soup-session.c | 1 + - tests/httpd.conf.in | 1 + - tests/proxy-test.c | 34 ++++++++++++++++++++++++++++++++++ - 3 files changed, 36 insertions(+) - -diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c -index 2d34022..386d145 100644 ---- a/libsoup/soup-session.c -+++ b/libsoup/soup-session.c -@@ -1234,6 +1234,7 @@ soup_session_redirect_message (SoupSession *session, - /* Strip all credentials on cross-origin redirect. */ - if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) { - soup_message_headers_remove_common (soup_message_get_request_headers (msg), SOUP_HEADER_AUTHORIZATION); -+ soup_message_headers_remove_common (soup_message_get_request_headers (msg), SOUP_HEADER_PROXY_AUTHORIZATION); - soup_message_set_auth (msg, NULL); - } - -diff --git a/tests/httpd.conf.in b/tests/httpd.conf.in -index 809dc5c..cc0a116 100644 ---- a/tests/httpd.conf.in -+++ b/tests/httpd.conf.in -@@ -34,6 +34,7 @@ LoadModule ssl_module @APACHE_SSL_MODULE_DIR@/mod_ssl.so - DirectoryIndex index.txt - TypesConfig /dev/null - Redirect permanent /redirected /index.txt -+Redirect permanent /Basic/realm1/redirected https://127.0.0.1:47525/index.txt - - # Prefer http1 for now because most of the tests expect http1 behavior. - Protocols http/1.1 h2 -diff --git a/tests/proxy-test.c b/tests/proxy-test.c -index d730c8a..68c97ac 100644 ---- a/tests/proxy-test.c -+++ b/tests/proxy-test.c -@@ -269,6 +269,39 @@ do_proxy_redirect_test (void) - soup_test_session_abort_unref (session); - } - -+static void proxy_auth_redirect_message_restarted (SoupMessage *msg) -+{ -+ if (soup_message_get_status (msg) != SOUP_STATUS_MOVED_PERMANENTLY) -+ return; -+ -+ g_assert_null (soup_message_headers_get_one (soup_message_get_request_headers (msg), "Proxy-Authorization")); -+} -+ -+static void -+do_proxy_auth_redirect_test (void) -+{ -+ SoupSession *session; -+ SoupMessage *msg; -+ char *url; -+ -+ SOUP_TEST_SKIP_IF_NO_APACHE; -+ SOUP_TEST_SKIP_IF_NO_TLS; -+ -+ session = soup_test_session_new ("proxy-resolver", proxy_resolvers[AUTH_PROXY], NULL); -+ -+ url = g_strconcat (HTTP_SERVER, "/Basic/realm1/redirected", NULL); -+ msg = soup_message_new (SOUP_METHOD_GET, url); -+ g_signal_connect (msg, "authenticate", G_CALLBACK (authenticate), NULL); -+ g_signal_connect (msg, "restarted", G_CALLBACK (proxy_auth_redirect_message_restarted), NULL); -+ -+ soup_test_session_send_message (session, msg); -+ soup_test_assert_message_status (msg, SOUP_STATUS_OK); -+ -+ g_free (url); -+ g_object_unref (msg); -+ soup_test_session_abort_unref (session); -+} -+ - static void - do_proxy_auth_request (const char *url, SoupSession *session, gboolean do_read) - { -@@ -402,6 +435,7 @@ main (int argc, char **argv) - - g_test_add_data_func ("/proxy/fragment", base_uri, do_proxy_fragment_test); - g_test_add_func ("/proxy/redirect", do_proxy_redirect_test); -+ g_test_add_func ("/proxy/auth-redirect", do_proxy_auth_redirect_test); - g_test_add_func ("/proxy/auth-cache", do_proxy_auth_cache_test); - g_test_add_data_func ("/proxy/connect-error", base_https_uri, do_proxy_connect_error_test); - --- -2.34.1 - diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2026-2708.patch b/meta/recipes-support/libsoup/libsoup/CVE-2026-2708.patch deleted file mode 100644 index 479a53ae212..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2026-2708.patch +++ /dev/null @@ -1,218 +0,0 @@ -From e032d3e9b0a27d10597398023532dd8f9b6654cf Mon Sep 17 00:00:00 2001 -From: Carlos Garcia Campos -Date: Tue, 17 Feb 2026 16:39:26 +0100 -Subject: [PATCH] Do not allow adding multiple content length values to headers - -Closes #500 - -CVE: CVE-2026-2708 -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e032d3e9b0a27d10597398023532dd8f9b6654cf] -Signed-off-by: Peter Marko ---- - libsoup/soup-message-headers.c | 27 ++++++++++++++ - tests/header-parsing-test.c | 50 +++++++++++++++++++++++++- - tests/server-test.c | 64 ++++++++++++++++++++++++++++++++++ - 3 files changed, 140 insertions(+), 1 deletion(-) - -diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c -index ca7719db..34cd2d8f 100644 ---- a/libsoup/soup-message-headers.c -+++ b/libsoup/soup-message-headers.c -@@ -269,6 +269,33 @@ soup_message_headers_append_common (SoupMessageHeaders *hdrs, - return FALSE; - } - -+ if (name == SOUP_HEADER_CONTENT_LENGTH) { -+ /* RFC 9110 - 7.7. Content-Length -+ * If a message is received that has a Content-Length header field value consisting of -+ * the same decimal value as a comma-separated list (Section 5.7.1) — for example, -+ * "Content-Length: 42, 42" — indicating that duplicate Content-Length header fields have -+ * been generated or combined by an upstream message processor, then the recipient must either -+ * reject the message as invalid or replace the duplicated field values with a single valid -+ * Content-Length field containing that decimal value prior to determining the message body -+ * length or forwarding the message. -+ */ -+ const char *content_length = soup_message_headers_get_one_common (hdrs, SOUP_HEADER_CONTENT_LENGTH); -+ if (content_length) { -+ guint64 decimal_value1, decimal_value2; -+ char *end; -+ -+ decimal_value1 = g_ascii_strtoull (content_length, &end, 10); -+ if (*end) -+ return FALSE; -+ -+ decimal_value2 = g_ascii_strtoull (value, &end, 10); -+ if (*end) -+ return FALSE; -+ -+ return decimal_value1 == decimal_value2; -+ } -+ } -+ - if (trusted_value == SOUP_HEADER_VALUE_UNTRUSTED && !is_valid_header_value (value)) { - g_warning ("soup_message_headers_append: Rejecting bad value '%s'", value); - return FALSE; -diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c -index ebdc3246..5a3c92eb 100644 ---- a/tests/header-parsing-test.c -+++ b/tests/header-parsing-test.c -@@ -368,6 +368,22 @@ static struct RequestTest { - }, 0 - }, - -+ { "Duplicate Content-Length with the same value", NULL, -+ "POST / HTTP/1.1\r\nContent-Length: 4\r\nContent-Length: 4\r\n", -+ -1, -+ SOUP_STATUS_OK, -+ "POST", "/", SOUP_HTTP_1_1, -+ { { "Content-Length", "4" } }, 0 -+ }, -+ -+ { "Duplicate Content-Length with the same decimal value", NULL, -+ "POST / HTTP/1.1\r\nContent-Length: 04\r\nContent-Length: 4\r\n", -+ -1, -+ SOUP_STATUS_OK, -+ "POST", "/", SOUP_HTTP_1_1, -+ { { "Content-Length", "04" } }, 0 -+ }, -+ - /************************/ - /*** INVALID REQUESTS ***/ - /************************/ -@@ -507,7 +523,16 @@ static struct RequestTest { - NULL, NULL, -1, - { { NULL } }, - G_LOG_LEVEL_WARNING -- } -+ }, -+ -+ { "Duplicate Content-Length with different value", -+ "https://gitlab.gnome.org/GNOME/libsoup/-/issues/500", -+ "POST / HTTP/1.1\r\nContent-Length: 2\r\nContent-Length: 4\r\n", -+ -1, -+ SOUP_STATUS_BAD_REQUEST, -+ NULL, NULL, -1, -+ { { NULL } }, 0 -+ } - }; - static const int num_reqtests = G_N_ELEMENTS (reqtests); - -@@ -1475,6 +1500,28 @@ do_append_duplicate_host_test (void) - soup_message_headers_unref (hdrs); - } - -+static void -+do_append_duplicate_content_length_test (void) -+{ -+ SoupMessageHeaders *hdrs; -+ const char *list_value; -+ -+ hdrs = soup_message_headers_new (SOUP_MESSAGE_HEADERS_REQUEST); -+ soup_message_headers_append (hdrs, "Content-Length", "42"); -+ -+ /* Inserting the same value doesn't generate a list */ -+ soup_message_headers_append (hdrs, "Content-Length", "42"); -+ list_value = soup_message_headers_get_list (hdrs, "Content-Length"); -+ g_assert_cmpstr (list_value, ==, "42"); -+ -+ /* Inserting a different value does nothing */ -+ soup_message_headers_append (hdrs, "Content-Length", "45"); -+ list_value = soup_message_headers_get_list (hdrs, "Content-Length"); -+ g_assert_cmpstr (list_value, ==, "42"); -+ -+ soup_message_headers_unref (hdrs); -+} -+ - int - main (int argc, char **argv) - { -@@ -1491,6 +1538,7 @@ main (int argc, char **argv) - g_test_add_func ("/header-parsing/append-param", do_append_param_tests); - g_test_add_func ("/header-parsing/bad", do_bad_header_tests); - g_test_add_func ("/header-parsing/append-duplicate-host", do_append_duplicate_host_test); -+ g_test_add_func ("/header-parsing/append-duplicate-content-length", do_append_duplicate_content_length_test); - - ret = g_test_run (); - -diff --git a/tests/server-test.c b/tests/server-test.c -index 09ea03b3..59230444 100644 ---- a/tests/server-test.c -+++ b/tests/server-test.c -@@ -1422,6 +1422,68 @@ do_chunked_test (ServerData *sd, gconstpointer test_data) - } - } - -+static void -+do_multiple_content_length_test (ServerData *sd, gconstpointer test_data) -+{ -+ gint i; -+ struct { -+ const char *description; -+ const char *test; -+ const char *expected_response; -+ } tests[] = { -+ { "Double Content-Length with different value", "POST / HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Length: 0\r\nContent-Length: 4\r\nConnection: close\r\n\r\n\r\nABCD", "HTTP/1.0 400 Bad Request" }, -+ { "Double Content-Length with the same value", "POST / HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Length: 4\r\nContent-Length: 4\r\nConnection: close\r\n\r\n\r\nABCD", "HTTP/1.1 200 OK" }, -+ }; -+ -+ sd->server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD); -+ sd->base_uri = soup_test_server_get_uri (sd->server, "http", NULL); -+ server_add_handler (sd, NULL, server_callback, NULL, NULL); -+ -+ for (i = 0; i < G_N_ELEMENTS (tests); i++) { -+ GSocketClient *client; -+ GSocketConnection *conn; -+ GInputStream *input; -+ GOutputStream *output; -+ gsize nwritten; -+ char buffer[4096]; -+ gssize nread; -+ GString *response; -+ const char *boundary; -+ GError *error = NULL; -+ -+ debug_printf (1, " %s\n", tests[i].description); -+ -+ client = g_socket_client_new (); -+ conn = g_socket_client_connect_to_host (client, g_uri_get_host (sd->base_uri), g_uri_get_port (sd->base_uri), NULL, &error); -+ g_assert_no_error (error); -+ -+ output = g_io_stream_get_output_stream (G_IO_STREAM (conn)); -+ g_output_stream_write_all (output, tests[i].test, strlen (tests[i].test), &nwritten, NULL, &error); -+ g_assert_no_error (error); -+ g_assert_cmpuint (nwritten, ==, strlen (tests[i].test)); -+ g_output_stream_flush (output, NULL, &error); -+ g_assert_no_error (error); -+ -+ response = g_string_new (NULL); -+ -+ input = g_io_stream_get_input_stream (G_IO_STREAM (conn)); -+ do { -+ nread = g_input_stream_read (input, buffer, sizeof(buffer), NULL, NULL); -+ if (nread >= 0) -+ response = g_string_append_len (response, (const char *)buffer, nread); -+ } while (nread > 0); -+ -+ boundary = strstr (response->str, "\r\n"); -+ g_assert_nonnull (boundary); -+ response = g_string_truncate (response, response->len - strlen (boundary)); -+ g_assert_cmpstr (response->str, ==, tests[i].expected_response); -+ g_string_free (response, TRUE); -+ -+ g_object_unref (conn); -+ g_object_unref (client); -+ } -+} -+ - int - main (int argc, char **argv) - { -@@ -1464,6 +1526,8 @@ main (int argc, char **argv) - server_setup, do_steal_connect_test, server_teardown); - g_test_add ("/server/chunked", ServerData, NULL, - NULL, do_chunked_test, server_teardown); -+ g_test_add ("/server/multiple-content-length", ServerData, NULL, -+ NULL, do_multiple_content_length_test, server_teardown); - - ret = g_test_run (); - diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch b/meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch deleted file mode 100644 index ca377e03553..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2026-4271.patch +++ /dev/null @@ -1,362 +0,0 @@ -From 489affa74c8a229b8a4dd541710d4a5debedb7b4 Mon Sep 17 00:00:00 2001 -From: Carlos Garcia Campos -Date: Mon, 16 Feb 2026 12:09:08 +0100 -Subject: [PATCH] server: protect message io while reading and writing - -Ensure the nghttp2 session is not destroyed while being used. - -Closes #496 - -CVE: CVE-2026-4271 -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/489affa74c8a229b8a4dd541710d4a5debedb7b4] -Signed-off-by: Peter Marko ---- - .../http2/soup-server-message-io-http2.c | 117 +++++++++++++----- - tests/http2-test.c | 54 ++++++++ - 2 files changed, 141 insertions(+), 30 deletions(-) - -diff --git a/libsoup/server/http2/soup-server-message-io-http2.c b/libsoup/server/http2/soup-server-message-io-http2.c -index 913afb46..6f8d1bb6 100644 ---- a/libsoup/server/http2/soup-server-message-io-http2.c -+++ b/libsoup/server/http2/soup-server-message-io-http2.c -@@ -69,6 +69,8 @@ typedef struct { - GHashTable *messages; - - guint in_callback; -+ guint protected; -+ gboolean destroyed; - } SoupServerMessageIOHTTP2; - - static void soup_server_message_io_http2_send_response (SoupServerMessageIOHTTP2 *io, -@@ -146,6 +148,8 @@ soup_server_message_io_http2_destroy (SoupServerMessageIO *iface) - { - SoupServerMessageIOHTTP2 *io = (SoupServerMessageIOHTTP2 *)iface; - -+ io->destroyed = TRUE; -+ - if (io->read_source) { - g_source_destroy (io->read_source); - g_source_unref (io->read_source); -@@ -160,10 +164,14 @@ soup_server_message_io_http2_destroy (SoupServerMessageIO *iface) - } - - g_clear_object (&io->iostream); -- g_clear_pointer (&io->session, nghttp2_session_del); -- g_clear_pointer (&io->messages, g_hash_table_unref); -+ io->istream = NULL; -+ io->ostream = NULL; - -- g_free (io); -+ if (io->protected == 0) { -+ g_clear_pointer (&io->session, nghttp2_session_del); -+ g_clear_pointer (&io->messages, g_hash_table_unref); -+ g_free (io); -+ } - } - - static void -@@ -321,7 +329,33 @@ static const SoupServerMessageIOFuncs io_funcs = { - soup_server_message_io_http2_is_paused - }; - -+static void -+soup_server_message_io_http2_protect (SoupServerMessageIOHTTP2 *io) -+{ -+ io->protected++; -+ g_object_ref (io->conn); -+} -+ - static gboolean -+soup_server_message_io_http2_unprotect (SoupServerMessageIOHTTP2 *io) -+{ -+ g_object_unref (io->conn); -+ -+ if (--io->protected > 0) -+ return FALSE; -+ -+ if (io->destroyed) { -+ g_clear_pointer (&io->session, nghttp2_session_del); -+ g_clear_pointer (&io->messages, g_hash_table_unref); -+ g_free (io); -+ -+ return TRUE; -+ } -+ -+ return FALSE; -+} -+ -+static void - io_write (SoupServerMessageIOHTTP2 *io, - GError **error) - { -@@ -336,51 +370,57 @@ io_write (SoupServerMessageIOHTTP2 *io, - if (io->write_buffer_size == 0) { - /* Done */ - io->write_buffer = NULL; -- return TRUE; -+ return; - } - } - -+ if (!io->ostream) -+ return; -+ - gssize ret = g_pollable_stream_write (io->ostream, - io->write_buffer + io->written_bytes, - io->write_buffer_size - io->written_bytes, - FALSE, NULL, error); -- if (ret < 0) -- return FALSE; -- -- io->written_bytes += ret; -- return TRUE; -+ if (ret > 0) -+ io->written_bytes += ret; - } - - static gboolean - io_write_ready (GObject *stream, - SoupServerMessageIOHTTP2 *io) - { -- SoupServerConnection *conn = io->conn; - GError *error = NULL; - -- g_object_ref (conn); -+ soup_server_message_io_http2_protect (io); -+ -+ while (!error) { -+ if (io->destroyed) -+ break; -+ -+ if (!nghttp2_session_want_write (io->session)) -+ break; - -- while (!error && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && nghttp2_session_want_write (io->session)) - io_write (io, &error); -+ } - - if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) { - g_error_free (error); -- g_object_unref (conn); -+ soup_server_message_io_http2_unprotect (io); - return G_SOURCE_CONTINUE; - } - -- if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) { -+ if (!io->destroyed) { - if (error) - h2_debug (io, NULL, "[SESSION] IO error: %s", error->message); - - g_clear_pointer (&io->write_source, g_source_unref); - - if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session))) -- soup_server_connection_disconnect (conn); -+ soup_server_connection_disconnect (io->conn); - } - - g_clear_error (&error); -- g_object_unref (conn); -+ soup_server_message_io_http2_unprotect (io); - - return G_SOURCE_REMOVE; - } -@@ -390,13 +430,12 @@ static gboolean io_write_idle_cb (SoupServerMessageIOHTTP2* io); - static void - io_try_write (SoupServerMessageIOHTTP2 *io) - { -- SoupServerConnection *conn = io->conn; - GError *error = NULL; - - if (io->write_source) - return; - -- if (io->in_callback && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) { -+ if (io->in_callback && !io->destroyed) { - if (!nghttp2_session_want_write (io->session)) - return; - -@@ -416,12 +455,19 @@ io_try_write (SoupServerMessageIOHTTP2 *io) - g_clear_pointer (&io->write_idle_source, g_source_unref); - } - -- g_object_ref (conn); -+ soup_server_message_io_http2_protect (io); -+ -+ while (!error) { -+ if (io->destroyed) -+ break; -+ -+ if (!nghttp2_session_want_write (io->session)) -+ break; - -- while (!error && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && !io->in_callback && nghttp2_session_want_write (io->session)) - io_write (io, &error); -+ } - -- if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) { -+ if (!io->destroyed) { - if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) { - g_clear_error (&error); - io->write_source = g_pollable_output_stream_create_source (G_POLLABLE_OUTPUT_STREAM (io->ostream), NULL); -@@ -434,11 +480,11 @@ io_try_write (SoupServerMessageIOHTTP2 *io) - h2_debug (io, NULL, "[SESSION] IO error: %s", error->message); - - if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session))) -- soup_server_connection_disconnect (conn); -+ soup_server_connection_disconnect (io->conn); - } - - g_clear_error (&error); -- g_object_unref (conn); -+ soup_server_message_io_http2_unprotect (io); - } - - static gboolean -@@ -481,31 +527,37 @@ static gboolean - io_read_ready (GObject *stream, - SoupServerMessageIOHTTP2 *io) - { -- SoupServerConnection *conn = io->conn; - gboolean progress = TRUE; - GError *error = NULL; - -- g_object_ref (conn); -+ soup_server_message_io_http2_protect (io); -+ -+ while (progress) { -+ if (io->destroyed) -+ break; -+ -+ if (!nghttp2_session_want_read (io->session)) -+ break; - -- while (progress && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && nghttp2_session_want_read (io->session)) - progress = io_read (io, &error); -+ } - - if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) { - g_error_free (error); -- g_object_unref (conn); -+ soup_server_message_io_http2_unprotect (io); - return G_SOURCE_CONTINUE; - } - -- if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) { -+ if (!io->destroyed) { - if (error) - h2_debug (io, NULL, "[SESSION] IO error: %s", error->message); - - if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session))) -- soup_server_connection_disconnect (conn); -+ soup_server_connection_disconnect (io->conn); - } - - g_clear_error (&error); -- g_object_unref (conn); -+ soup_server_message_io_http2_unprotect (io); - - return G_SOURCE_REMOVE; - } -@@ -931,5 +983,10 @@ soup_server_message_io_http2_new (SoupServerConnection *conn, - nghttp2_submit_settings (io->session, NGHTTP2_FLAG_NONE, settings, G_N_ELEMENTS (settings)); - io_try_write (io); - -+#ifdef __clang_analyzer__ -+ // Suppress false positive about io being destroyed here, since at this point we have only -+ // send the initial settings and not callback is called. -+ [[clang::suppress]] -+#endif - return (SoupServerMessageIO *)io; - } -diff --git a/tests/http2-test.c b/tests/http2-test.c -index 0846a0a6..d12b4bf7 100644 ---- a/tests/http2-test.c -+++ b/tests/http2-test.c -@@ -1268,6 +1268,40 @@ do_broken_pseudo_header_test (Test *test, gconstpointer data) - g_uri_unref (uri); - } - -+static void -+disconnect_on_got_headers (SoupServerMessage *msg, gpointer user_data) -+{ -+ GUri *uri; -+ SoupServerConnection *conn; -+ -+ uri = soup_server_message_get_uri (msg); -+ if (!g_str_equal (g_uri_get_path (uri), "/close-on-got-headers")) -+ return; -+ -+ conn = soup_server_message_get_connection (msg); -+ soup_server_connection_disconnect (conn); -+} -+ -+static void -+do_server_disconnect_on_got_headers_test (Test *test, gconstpointer data) -+{ -+ SoupMessage *msg; -+ GUri *uri; -+ GBytes *response; -+ GError *error = NULL; -+ -+ uri = g_uri_parse_relative (base_uri, "/close-on-got-headers", SOUP_HTTP_URI_FLAGS, NULL); -+ msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri); -+ -+ response = soup_test_session_async_send (test->session, msg, NULL, &error); -+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_PARTIAL_INPUT); -+ -+ g_clear_error (&error); -+ g_bytes_unref (response); -+ g_object_unref (msg); -+ g_uri_unref (uri); -+} -+ - static gboolean - unpause_message (SoupServerMessage *msg) - { -@@ -1396,12 +1430,26 @@ server_handler (SoupServer *server, - shutdown (fd, SHUT_WR); - #endif - -+ soup_server_message_set_response (msg, "text/plain", -+ SOUP_MEMORY_STATIC, -+ "Success!", 8); -+ } else if (strcmp (path, "/close-on-got-headers") == 0) { - soup_server_message_set_response (msg, "text/plain", - SOUP_MEMORY_STATIC, - "Success!", 8); - } - } - -+static void -+server_request_started (SoupServer *server, -+ SoupServerMessage *msg, -+ SoupServerConnection *conn, -+ gpointer user_data) -+{ -+ g_signal_connect (msg, "got-headers", -+ G_CALLBACK (disconnect_on_got_headers), NULL); -+} -+ - static gboolean - server_basic_auth_callback (SoupAuthDomain *auth_domain, - SoupServerMessage *msg, -@@ -1428,6 +1476,8 @@ main (int argc, char **argv) - return 0; - - server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD | SOUP_TEST_SERVER_HTTP2); -+ g_signal_connect (server, "request-started", -+ G_CALLBACK (server_request_started), NULL); - auth = soup_auth_domain_basic_new ("realm", "http2-test", - "auth-callback", server_basic_auth_callback, - NULL); -@@ -1584,6 +1634,10 @@ main (int argc, char **argv) - setup_session, - do_broken_pseudo_header_test, - teardown_session); -+ g_test_add ("/http2/server-disconnect-on-got-headers", Test, NULL, -+ setup_session, -+ do_server_disconnect_on_got_headers_test, -+ teardown_session); - - ret = g_test_run (); - diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2026-5119.patch b/meta/recipes-support/libsoup/libsoup/CVE-2026-5119.patch deleted file mode 100644 index f5e3f91b000..00000000000 --- a/meta/recipes-support/libsoup/libsoup/CVE-2026-5119.patch +++ /dev/null @@ -1,122 +0,0 @@ -From b0626fff8538e3dd4a52f148d91c8348d51d64d1 Mon Sep 17 00:00:00 2001 -From: Carlos Garcia Campos -Date: Fri, 27 Feb 2026 12:03:25 +0100 -Subject: [PATCH] cookies: do not send cookies to a HTTP proxy for a HTTPS - request - -Closes #502 - -CVE: CVE-2026-5119 -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/b0626fff8538e3dd4a52f148d91c8348d51d64d1] -Signed-off-by: Peter Marko - ---- - libsoup/cookies/soup-cookie-jar.c | 24 +++++++++++----- - tests/proxy-test.c | 47 +++++++++++++++++++++++++++++++ - 2 files changed, 64 insertions(+), 7 deletions(-) - -diff --git a/libsoup/cookies/soup-cookie-jar.c b/libsoup/cookies/soup-cookie-jar.c -index 7e200f8f..6a996ffe 100644 ---- a/libsoup/cookies/soup-cookie-jar.c -+++ b/libsoup/cookies/soup-cookie-jar.c -@@ -885,18 +885,28 @@ process_set_cookie_header (SoupMessage *msg, gpointer user_data) - g_slist_free (new_cookies); - } - -+static gboolean -+allow_cookies_for_request (SoupMessage *msg) -+{ -+ /* Do not send cookies to a HTTP proxy for a HTTPS request */ -+ return soup_message_get_method (msg) != SOUP_METHOD_CONNECT || !soup_connection_is_tunnelled (soup_message_get_connection (msg)); -+} -+ - static void - msg_starting_cb (SoupMessage *msg, gpointer feature) - { - SoupCookieJar *jar = SOUP_COOKIE_JAR (feature); -- GSList *cookies; -+ GSList *cookies = NULL; -+ -+ if (allow_cookies_for_request (msg)) { -+ cookies = soup_cookie_jar_get_cookie_list_with_same_site_info (jar, soup_message_get_uri (msg), -+ soup_message_get_first_party (msg), -+ soup_message_get_site_for_cookies (msg), -+ TRUE, -+ SOUP_METHOD_IS_SAFE (soup_message_get_method (msg)), -+ soup_message_get_is_top_level_navigation (msg)); -+ } - -- cookies = soup_cookie_jar_get_cookie_list_with_same_site_info (jar, soup_message_get_uri (msg), -- soup_message_get_first_party (msg), -- soup_message_get_site_for_cookies (msg), -- TRUE, -- SOUP_METHOD_IS_SAFE (soup_message_get_method (msg)), -- soup_message_get_is_top_level_navigation (msg)); - if (cookies != NULL) { - char *cookie_header = soup_cookies_to_cookie_header (cookies); - soup_message_headers_replace_common (soup_message_get_request_headers (msg), SOUP_HEADER_COOKIE, cookie_header, SOUP_HEADER_VALUE_TRUSTED); -diff --git a/tests/proxy-test.c b/tests/proxy-test.c -index 68c97aca..945de2cc 100644 ---- a/tests/proxy-test.c -+++ b/tests/proxy-test.c -@@ -406,6 +406,52 @@ do_proxy_connect_error_test (gconstpointer data) - soup_test_session_abort_unref (session); - } - -+static void -+connect_message_wrote_headers_cb (SoupMessage *msg, guint *counter) -+{ -+ SoupMessageHeaders *hdrs; -+ -+ *counter += 1; -+ -+ hdrs = soup_message_get_request_headers (msg); -+ if (soup_message_get_method (msg) == SOUP_METHOD_CONNECT) -+ g_assert_null (soup_message_headers_get_one (hdrs, "Cookie")); -+ else -+ g_assert_nonnull (soup_message_headers_get_one (hdrs, "Cookie")); -+} -+ -+static void -+request_queued_cb (SoupSession *session, SoupMessage *msg, guint *counter) -+{ -+ g_signal_connect (msg, "wrote-headers", G_CALLBACK (connect_message_wrote_headers_cb), counter); -+} -+ -+static void -+do_proxy_secure_cookies_test (void) -+{ -+ SoupSession *session; -+ SoupMessage *msg; -+ SoupCookieJar *jar; -+ guint counter = 0; -+ -+ SOUP_TEST_SKIP_IF_NO_APACHE; -+ SOUP_TEST_SKIP_IF_NO_TLS; -+ -+ session = soup_test_session_new ("proxy-resolver", proxy_resolvers[SIMPLE_PROXY], NULL); -+ g_signal_connect (session, "request-queued", G_CALLBACK (request_queued_cb), &counter); -+ -+ soup_session_add_feature_by_type (session, SOUP_TYPE_COOKIE_JAR); -+ jar = SOUP_COOKIE_JAR (soup_session_get_feature (session, SOUP_TYPE_COOKIE_JAR)); -+ -+ msg = soup_message_new (SOUP_METHOD_GET, HTTPS_SERVER); -+ soup_cookie_jar_set_cookie (jar, soup_message_get_uri (msg), "user=password; secure"); -+ soup_test_session_send_message (session, msg); -+ soup_test_assert_message_status (msg, SOUP_STATUS_OK); -+ g_assert_cmpuint (counter, ==, 2); -+ -+ soup_test_session_abort_unref (session); -+} -+ - int - main (int argc, char **argv) - { -@@ -438,6 +484,7 @@ main (int argc, char **argv) - g_test_add_func ("/proxy/auth-redirect", do_proxy_auth_redirect_test); - g_test_add_func ("/proxy/auth-cache", do_proxy_auth_cache_test); - g_test_add_data_func ("/proxy/connect-error", base_https_uri, do_proxy_connect_error_test); -+ g_test_add_func ("/proxy/secure-cookies", do_proxy_secure_cookies_test); - - ret = g_test_run (); - diff --git a/meta/recipes-support/libsoup/libsoup_3.6.6.bb b/meta/recipes-support/libsoup/libsoup_3.8.0.bb similarity index 83% rename from meta/recipes-support/libsoup/libsoup_3.6.6.bb rename to meta/recipes-support/libsoup/libsoup_3.8.0.bb index e5c2d18ded7..3301451292d 100644 --- a/meta/recipes-support/libsoup/libsoup_3.6.6.bb +++ b/meta/recipes-support/libsoup/libsoup_3.8.0.bb @@ -11,17 +11,7 @@ DEPENDS = "glib-2.0 glib-2.0-native libxml2 sqlite3 libpsl nghttp2" inherit gettext gnomebase upstream-version-is-even gobject-introspection gi-docgen vala -SRC_URI[archive.sha256sum] = "51ed0ae06f9d5a40f401ff459e2e5f652f9a510b7730e1359ee66d14d4872740" - -SRC_URI += "file://CVE-2025-32049-1.patch \ - file://CVE-2025-32049-2.patch \ - file://CVE-2025-32049-3.patch \ - file://CVE-2025-32049-4.patch \ - file://CVE-2026-1539.patch \ - file://CVE-2026-5119.patch \ - file://CVE-2026-2708.patch \ - file://CVE-2026-4271.patch \ -" +SRC_URI[archive.sha256sum] = "bbf08fa3e03a88c31a3d27a0d87cb422e9490f2d08e149211103df6d638a2238" PROVIDES = "libsoup-3.0"