From patchwork Wed Oct 14 16:12:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Stasiak X-Patchwork-Id: 100706 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4BAACC6B1D for ; Wed, 14 Oct 2026 16:12:34 +0000 (UTC) Received: from mail-dl1-f53.google.com (mail-dl1-f53.google.com [74.125.82.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.17957.1791994353599196132 for ; Wed, 14 Oct 2026 09:12:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=jCanQmLa; spf=pass (domain: gmail.com, ip: 74.125.82.53, mailfrom: jason.stasiak@gmail.com) Received: by mail-dl1-f53.google.com with SMTP id a92af1059eb24-15354aa70e8so3069392c88.1 for ; Wed, 14 Oct 2026 09:12:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791994353; x=1792599153; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=fJ880M6/1Z0827ccc4DYh9lbkaQsCyAPB8UOtd2b+aQ=; b=jCanQmLaXKueHhg1rDmmCal7B3onX6SZg+OlLKeWefc4pqtj9zPqNFsZycKyveYRjK URK4ynkp6HIpYJFzScWK8yimPtfG+spdFWvcqmDe9xlpHXyBrdJtk1YMt9p3qmwbtfkN 3tCGZL7oG2VQn+CkQyX8F7mm7qYVVMVKhkAih8j8ud8sLN1xNUmAPFluG5tykfNwr8J9 TaNcg7QMcFrELMhtatvDJ3wwGkiDUjZfcZyYnn7Pe8WSbtmSIEJ8W2q98IWlYAsHdO1q WMLWHzpA/TY5wTutUrlALpAWWKo3Koatlmhpb45vbdL59rf6hfKdQHvI4VweGWhsolCv ybjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791994353; x=1792599153; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=fJ880M6/1Z0827ccc4DYh9lbkaQsCyAPB8UOtd2b+aQ=; b=yraWOilgeLH90I7fIiHJ7VdEwPrZsMiouAzinEFhDfekxeF/oYkcASYp1goPeGJ3ZT l25KPki50IJvpkLNE8wuxKAl/HVyItzEv8FUbIjVp5+izVl1YBIcNSCbDVwvaQkNGKCW guXiTSQBmKUPA4h6GDkbiH6p47IrIBu94nHBbWRrmzyc9fV+Bi+IvyGIjsPulL8ueMim pYx7SLj/+RoYegnmOE1TEdTxL+7aX9v+ZDD9xZ5clSYXcd/rG5/FYwJ5tTZ08Q0suypS wN9++k9gqmGmF1VJS8BE5nJPPnqqK3XJ/rpuIT86qcjfRE7NXGTKw0fPzGaY7agxsQNL UxdA== X-Gm-Message-State: AFq9FYJ46o3EZA2dKWxRjwSoIEdz5gh+qq0v8O2rBuscg5C0hr+jfAh1 DTv7q2UwweRmJlY8uuimkuot3gPUnCvDXTGdgfodQj9WOALprpDWTxrsoPnwZA== X-Gm-Gg: AYBFou2wDBRc4eQesnCtZcirDrjk0C4PIWXXKDecuuLGUqjea7RsqSjvJ1qB8xxPdq0 xVUSHD7WWZ9G0b61iLDAU9h6OBDxSA3eoFM12GKESSVTMRZMXQdHq+bKAMUQu/vYoO6BTQsLdsi 4rIg41qrOU0gKL6KQ6S5ryz+4xUo0oqXPFr5yHsq8DWSTHg4ihcR623ZKiiAdLuKfyPN6zuGQxQ mEOp0YEDdPWJvUequqC2I4OrPrmU5d31KHIPMucJA9vSwDsF3SKqc0SFHiT5Fpz0v9bQpbgaKbK JCk0cpDdQFU1j3HJmC2LW51oTgxjkwEOJh/iCboA8H4QO2Wsi2hMaO9qoYK/5uuJ0wkGFzzYxLy S9jIGFucBJAm3AKmE7YCKmWSjEuEadBxzQ4Xd6vOFw2ejhP1Ca/bAJ1w0YgIu5dmz+3xJKJ3Nwi cxau2vF6em3HITu+06+LDsZvFzWHRVOH2D4kj6bCE7S5tSYjd9gnPai1dJteY4aSSF8deTxbNbh 3sYVqxBns/J7ccL91RM X-Received: by 2002:a05:7022:3f0c:b0:151:2e62:fe8d with SMTP id a92af1059eb24-16a5dcf817bmr24141144c88.9.1791994352531; Wed, 14 Oct 2026 09:12:32 -0700 (PDT) Received: from CHA-FQKPM83.ad.garmin.com ([65.175.40.146]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-35a352d4b05sm36006426eec.19.2026.10.14.09.12.31 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 09:12:32 -0700 (PDT) From: Jason Stasiak X-Google-Original-From: Jason Stasiak To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH v2 1/5] libsoup-2.4: fix CVE-2026-1539 Date: Wed, 14 Oct 2026 09:12:05 -0700 Message-ID: <20261014161209.2227316-1-jason.stasiak@garmin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260929205055.2403390-2-jason.stasiak@gmail.com> References: <20260929205055.2403390-2-jason.stasiak@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 14 Oct 2026 16:12:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247783 Backport fix for CVE-2026-1539 from meta-oe to OE-core. Update CVE patch to restore the auth-redirect proxy validation unit test from the upstream libsoup3 patch. (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d) Signed-off-by: Jason Stasiak --- Changes since v1: - Resolved malformed patch lines .../libsoup/libsoup-2.4/CVE-2026-1539.patch | 104 ++++++++++++++++++ .../libsoup/libsoup-2.4_2.74.3.bb | 1 + 2 files changed, 105 insertions(+) create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1539.patch diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1539.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1539.patch new file mode 100644 index 0000000000..2682c35a42 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1539.patch @@ -0,0 +1,104 @@ +From 285faea567e1e2a95226201175dbf745a64a2439 Mon Sep 17 00:00:00 2001 +From: Changqing Li +Date: Fri, 20 Mar 2026 15:04:22 +0800 +Subject: [PATCH 4/4] Also remove Proxy-Authorization header on cross origin + redirect + +Closes #489 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/98c1285d9d78662c38bf14b4a128af01ccfdb446] +CVE: CVE-2026-1539 + +Signed-off-by: Changqing Li + +Backport the auth-redirect proxy validation unit tests from the upstream +libsoup3 patch + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-session.c | 1 + + tests/httpd.conf.in | 1 + + tests/proxy-test.c | 36 ++++++++++++++++++++++++++++++++++++ + 3 files changed, 38 insertions(+) + +diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c +index fadd5cd2..4cad0946 100644 +--- a/libsoup/soup-session.c ++++ b/libsoup/soup-session.c +@@ -1192,6 +1192,7 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg) + /* Strip all credentials on cross-origin redirect. */ + if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) { + soup_message_headers_remove (msg->request_headers, "Authorization"); ++ soup_message_headers_remove (msg->request_headers, "Proxy-Authorization"); + soup_message_set_auth (msg, NULL); + } + +diff --git a/tests/httpd.conf.in b/tests/httpd.conf.in +index 93fb7ff4..e190b6f7 100644 +--- a/tests/httpd.conf.in ++++ b/tests/httpd.conf.in +@@ -37,6 +37,7 @@ DirectoryIndex index.txt + TypesConfig /dev/null + AddType application/x-httpd-php .php + Redirect permanent /redirected /index.txt ++Redirect permanent /Basic/realm1/redirected https://127.0.0.1:47525/index.txt + + # Proxy #1: unauthenticated + Listen 127.0.0.1:47526 +diff --git a/tests/proxy-test.c b/tests/proxy-test.c +index 1d68aa05..105a02a6 100644 +--- a/tests/proxy-test.c ++++ b/tests/proxy-test.c +@@ -322,6 +322,41 @@ do_proxy_redirect_test (void) + soup_test_session_abort_unref (session); + } + ++static void proxy_auth_redirect_message_restarted (SoupMessage *msg) ++{ ++ if (msg->status_code != SOUP_STATUS_MOVED_PERMANENTLY) ++ return; ++ ++ g_assert_null (soup_message_headers_get_one (msg->request_headers, "Proxy-Authorization")); ++} ++ ++static void ++do_proxy_auth_redirect_test (void) ++{ ++ SoupSession *session; ++ SoupMessage *msg; ++ char *url; ++ ++ SOUP_TEST_SKIP_IF_NO_APACHE; ++ SOUP_TEST_SKIP_IF_NO_TLS; ++ ++ session = soup_test_session_new (SOUP_TYPE_SESSION_ASYNC, ++ SOUP_SESSION_PROXY_RESOLVER, proxy_resolvers[AUTH_PROXY], ++ NULL); ++ ++ url = g_strconcat (HTTP_SERVER, "/Basic/realm1/redirected", NULL); ++ msg = soup_message_new (SOUP_METHOD_GET, url); ++ g_signal_connect (session, "authenticate", G_CALLBACK (authenticate), NULL); ++ g_signal_connect (msg, "restarted", G_CALLBACK (proxy_auth_redirect_message_restarted), NULL); ++ ++ soup_session_send_message (session, msg); ++ soup_test_assert_message_status (msg, SOUP_STATUS_OK); ++ ++ g_free (url); ++ g_object_unref (msg); ++ soup_test_session_abort_unref (session); ++} ++ + static void + do_proxy_auth_request (const char *url, SoupSession *session, gboolean do_read) + { +@@ -433,6 +468,7 @@ main (int argc, char **argv) + + g_test_add_data_func ("/proxy/fragment", base_uri, do_proxy_fragment_test); + g_test_add_func ("/proxy/redirect", do_proxy_redirect_test); ++ g_test_add_func ("/proxy/auth-redirect", do_proxy_auth_redirect_test); + g_test_add_func ("/proxy/auth-cache", do_proxy_auth_cache_test); + + ret = g_test_run (); +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb index 7e00cd678a..4fe1e36f03 100644 --- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb +++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb @@ -41,6 +41,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \ file://CVE-2025-4476.patch \ file://CVE-2025-2784.patch \ file://CVE-2025-4945.patch \ + file://CVE-2026-1539.patch \ " SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13" From patchwork Wed Oct 14 16:12:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Stasiak X-Patchwork-Id: 100707 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4742DCC6B1A for ; Wed, 14 Oct 2026 16:12:35 +0000 (UTC) Received: from mail-dl1-f50.google.com (mail-dl1-f50.google.com [74.125.82.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.17965.1791994354293149607 for ; Wed, 14 Oct 2026 09:12:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=FG2SeVtw; spf=pass (domain: gmail.com, ip: 74.125.82.50, mailfrom: jason.stasiak@gmail.com) Received: by mail-dl1-f50.google.com with SMTP id a92af1059eb24-16ad92569b5so4161044c88.1 for ; Wed, 14 Oct 2026 09:12:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791994354; x=1792599154; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ZMP2lliwYb0mrQ/BDX5WHAFr1rTwCJ9q2Ts7ShgEdr4=; b=FG2SeVtwt6QBj1bMSYHkW5mKYq/LOuPGCUmzsZA7lCyyJG5QjMX38Vv1Ht6k8ypdSG ijK0Om6EtfJPXBUVxcXiDO5Wa4CIPe342BVHkcHALui0kLaHAq3plG0VEIYQzUd9remG G3KS2GOApUGl1Z1moycpXNBT0HTXWbZn2RTMZbkQSyqkxVQfdpBtWqL8sfLilRxrVeuO gf8j1d+gnvhvSFL7bN0Eq8IkqFAs8miGanWpg89rVsQ2UM7XNxng4bQpdInQgsm4hpTf /gUWvZV44rGrusU7zLgrs6+BTye92oDq6oufHsD8hzheeM6MZ4d9LRBLd27xLgdWRvFV YZEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791994354; x=1792599154; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=ZMP2lliwYb0mrQ/BDX5WHAFr1rTwCJ9q2Ts7ShgEdr4=; b=EmPNPvSx4hq7CAIylZrDt0GO/WG/GadoMJLPh7SNZKk+sK/IF0n23UW6kfS+BuTtPB BL7Nb9HYE4FPtSopHhMLCo2NWvKWCcQj0qetyKB1oX1v91MWv9Bjh4po+bJ72R4wzYpx FyjD1BkPqXEAddkAUBDCBUp1+H73IPCj6Pzx7SYcLA4PNjC2a5mlFVdXujlh/DvLA3/Y jnbVY0jgkuYniZQS+ZGPurzpBsMh7u4GJSQ202ZDbz+X7sb/gfAebK3tLyg7hwrupnH1 CMPv95rYLXOj5tTkdRuW8Iu+lQ5fHkTyzEf7w9B4PVbpUh3snkAk+OG0nnz3i5KWab0o fMkg== X-Gm-Message-State: AFq9FYLRv4MmvjX9vPHjD8SaUOnNmb0Kd1TRveH0Ewy1JlvGdl6tIea8 Ko0jwktgiSbI1WcR6MDMRsEQ1ZkJWsoOjN6k/yp1171yXHMx/FgGj/zyPqV52g== X-Gm-Gg: AYBFou15MS0W+P3ByRYFcmxN3ngLyeACNXp4QDrNAqSnrfXwfKHqAIUCTML6nEyemHN w+msNDO0majxz9CjZ0+7OEeEowciZXkc3U4JYF+XVgEufbn7VOZjljlhQmpWc6eQTEhrim8qChA bbDTc2yBexMGwHOBxa0iwSZlKz6QWQ+uIvmxx57oFZkUrA2OQUsRnmpy6TXb0sv6oLDuC2IqNae bhh+7Grr6eql8TbI3WUBIKia2v3Ovqv3x2YHDML6yeFqJkpEyDh7EKb1nV4aH0wd89ugr+vhNkx fe4CKGj52+k8kvRETNscxDxm/CWdV8YnpZihq62xPSxI6GuHiL/0jrDm5/tO1CyHshtjbpoWSdD dSilw7huBa/OznHCZ0pPzB7Fiv9TfngVAO+lDxhflvD5bKFwis8Rf1HuHLUZLPbSKmFBM98Csbu EfPBRsA++ozgQ25CZrxq/nLxFEguZyRqBKQ9KpmO15s1kO3UqS1cGKJDNLvUOTn8gJtu5PjvCMB cwVNCHbMkbX+XQB2V2h X-Received: by 2002:a05:7022:285:20b0:15d:f053:18b6 with SMTP id a92af1059eb24-16a5adfbebdmr20663040c88.9.1791994353297; Wed, 14 Oct 2026 09:12:33 -0700 (PDT) Received: from CHA-FQKPM83.ad.garmin.com ([65.175.40.146]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-35a352d4b05sm36006426eec.19.2026.10.14.09.12.32 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 09:12:32 -0700 (PDT) From: Jason Stasiak X-Google-Original-From: Jason Stasiak To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH v2 2/5] libsoup-2.4: fix CVE-2026-1801 Date: Wed, 14 Oct 2026 09:12:06 -0700 Message-ID: <20261014161209.2227316-2-jason.stasiak@garmin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261014161209.2227316-1-jason.stasiak@garmin.com> References: <20260929205055.2403390-2-jason.stasiak@gmail.com> <20261014161209.2227316-1-jason.stasiak@garmin.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 14 Oct 2026 16:12:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247784 Backport fix for CVE-2026-1801 from meta-oe to OE-core. Update CVE patch to restore the chunked server validation unit test from the upstream libsoup3 patch (b9a1c0663ff8ab6e79715db4b35b54f560416ddd). (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d) Signed-off-by: Jason Stasiak --- Changes since v1: - Resolved malformed patch lines .../libsoup/libsoup-2.4/CVE-2026-1801.patch | 217 ++++++++++++++++++ .../libsoup/libsoup-2.4_2.74.3.bb | 1 + 2 files changed, 218 insertions(+) create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch new file mode 100644 index 0000000000..f7579a9834 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch @@ -0,0 +1,217 @@ +From f9c933e258e9ef2f221cca6395f8092a1c4b93dd Mon Sep 17 00:00:00 2001 +From: Changqing Li +Date: Thu, 19 Mar 2026 17:10:36 +0800 +Subject: [PATCH 2/4] Fix CVE-2026-1801 + +This patch merges 3 upstream patches + +Chery-pick the first two patches to make the context is the same as the +third patch that fix CVE-2026-1801 + +Upstream-Status: Backport +[https://gitlab.gnome.org/GNOME/libsoup/-/commit/1e32b5e123aa1689505472bdbfcbd897eac41977, +https://gitlab.gnome.org/GNOME/libsoup/-/commit/8a2e15c88512ae4517d2c2c887d39299725b22da, +https://gitlab.gnome.org/GNOME/libsoup/-/commit/b9a1c0663ff8ab6e79715db4b35b54f560416ddd] +CVE: CVE-2026-1801 + +Signed-off-by: Changqing Li + +Backport the chunked server validation unit test from the upstream +libsoup3 patch (b9a1c0663ff8ab6e79715db4b35b54f560416ddd). + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-body-input-stream.c | 66 +++++++++++++++++++------------ + tests/server-test.c | 67 ++++++++++++++++++++++++++++++++ + 2 files changed, 108 insertions(+), 25 deletions(-) + +diff --git a/libsoup/soup-body-input-stream.c b/libsoup/soup-body-input-stream.c +index 6b95884..25d9312 100644 +--- a/libsoup/soup-body-input-stream.c ++++ b/libsoup/soup-body-input-stream.c +@@ -159,15 +159,18 @@ soup_body_input_stream_read_chunked (SoupBodyInputStream *bistream, + again: + switch (bistream->priv->chunked_state) { + case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_SIZE: +- nread = soup_filter_input_stream_read_line ( +- fstream, metabuf, sizeof (metabuf), blocking, +- &got_line, cancellable, error); +- if (nread <= 0) ++ nread = soup_filter_input_stream_read_until ( ++ fstream, metabuf, sizeof (metabuf), ++ "\r\n", 2, blocking, TRUE, ++ &got_line, cancellable, error); ++ if (nread < 0) + return nread; +- if (!got_line) { +- g_set_error_literal (error, G_IO_ERROR, +- G_IO_ERROR_PARTIAL_INPUT, +- _("Connection terminated unexpectedly")); ++ if (nread == 0 || !got_line) { ++ if (error && *error == NULL) { ++ g_set_error_literal (error, G_IO_ERROR, ++ G_IO_ERROR_PARTIAL_INPUT, ++ ("Connection terminated unexpectedly")); ++ } + return -1; + } + +@@ -180,9 +183,9 @@ again: + + case SOUP_BODY_INPUT_STREAM_STATE_CHUNK: + nread = soup_body_input_stream_read_raw ( +- bistream, buffer, +- MIN (count, bistream->priv->read_length), +- blocking, cancellable, error); ++ bistream, buffer, ++ MIN (count, bistream->priv->read_length), ++ blocking, cancellable, error); + if (nread > 0) { + bistream->priv->read_length -= nread; + if (bistream->priv->read_length == 0) +@@ -191,16 +194,19 @@ again: + return nread; + + case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_END: +- nread = soup_filter_input_stream_read_line ( +- SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream), +- metabuf, sizeof (metabuf), blocking, +- &got_line, cancellable, error); +- if (nread <= 0) ++ nread = soup_filter_input_stream_read_until ( ++ SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream), ++ metabuf, sizeof (metabuf), ++ "\r\n", 2, blocking, TRUE, ++ &got_line, cancellable, error); ++ if (nread < 0) + return nread; +- if (!got_line) { +- g_set_error_literal (error, G_IO_ERROR, +- G_IO_ERROR_PARTIAL_INPUT, +- _("Connection terminated unexpectedly")); ++ if (nread == 0 || !got_line) { ++ if (error && *error == NULL) { ++ g_set_error_literal (error, G_IO_ERROR, ++ G_IO_ERROR_PARTIAL_INPUT, ++ _("Connection terminated unexpectedly")); ++ } + return -1; + } + +@@ -208,13 +214,23 @@ again: + break; + + case SOUP_BODY_INPUT_STREAM_STATE_TRAILERS: +- nread = soup_filter_input_stream_read_line ( +- fstream, buffer, count, blocking, +- &got_line, cancellable, error); +- if (nread <= 0) ++ nread = soup_filter_input_stream_read_until ( ++ fstream, metabuf, sizeof (metabuf), ++ "\r\n", 2, blocking, TRUE, ++ &got_line, cancellable, error); ++ if (nread < 0) + return nread; + +- if (strncmp (buffer, "\r\n", nread) || strncmp (buffer, "\n", nread)) { ++ if (nread == 0) { ++ if (error && *error == NULL) { ++ g_set_error_literal (error, G_IO_ERROR, ++ G_IO_ERROR_PARTIAL_INPUT, ++ _("Connection terminated unexpectedly")); ++ } ++ return -1; ++ } ++ ++ if (nread == 2 && strncmp (metabuf, "\r\n", nread) == 0) { + bistream->priv->chunked_state = SOUP_BODY_INPUT_STREAM_STATE_DONE; + bistream->priv->eof = TRUE; + } +diff --git a/tests/server-test.c b/tests/server-test.c +index 8976103e..fbe8bdcc 100644 +--- a/tests/server-test.c ++++ b/tests/server-test.c +@@ -1373,6 +1373,71 @@ do_steal_connect_test (ServerData *sd, gconstpointer test_data) + soup_uri_free (proxy_uri); + } + ++static void ++server_chunked_hundler (SoupServer *server, ++ SoupMessage *msg, ++ const char *path, ++ GHashTable *query, ++ gpointer data) ++{ ++ g_assert_true (msg->method == SOUP_METHOD_POST); ++ g_assert_cmpstr (path, ==, "/valid"); ++ ++ soup_message_set_status (msg, SOUP_STATUS_OK); ++ soup_message_set_response (msg, "text/plain", SOUP_MEMORY_STATIC, "index", 5); ++} ++ ++#define CHUNKED_FORMAT_REQUEST "POST /valid HTTP/1.1\r\nHost: 127.0.0.1\r\n%sGET /invalid HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n" ++ ++static void ++do_chunked_test (ServerData *sd, gconstpointer test_data) ++{ ++ gint i; ++ struct { ++ const char *description; ++ const char *test; ++ } tests[] = { ++ { "Lone LF", "Transfer-Encoding: chunked\r\n\r\n5;ext\n data\r\n0\r\n\r\n" }, ++ }; ++ ++ sd->server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD); ++ sd->base_uri = soup_test_server_get_uri (sd->server, "http", NULL); ++ server_add_handler (sd, NULL, server_chunked_hundler, NULL, NULL); ++ ++ for (i = 0; i < G_N_ELEMENTS (tests); i++) { ++ GSocketClient *client; ++ GSocketConnection *conn; ++ GInputStream *input; ++ GOutputStream *output; ++ char *request; ++ char buffer[4096]; ++ gssize nread; ++ GError *error = NULL; ++ ++ debug_printf (1, " %s\n", tests[i].description); ++ ++ client = g_socket_client_new (); ++ conn = g_socket_client_connect_to_host (client, sd->base_uri->host, sd->base_uri->port, NULL, &error); ++ g_assert_no_error (error); ++ ++ request = g_strdup_printf (CHUNKED_FORMAT_REQUEST, tests[i].test); ++ ++ output = g_io_stream_get_output_stream (G_IO_STREAM (conn)); ++ g_output_stream_write_all (output, request, strlen (request), NULL, NULL, NULL); ++ g_output_stream_close (output, NULL, NULL); ++ g_socket_shutdown (g_socket_connection_get_socket (G_SOCKET_CONNECTION (conn)), FALSE, TRUE, &error); ++ ++ input = g_io_stream_get_input_stream (G_IO_STREAM (conn)); ++ do { ++ nread = g_input_stream_read (input, buffer, sizeof(buffer), NULL, NULL); ++ } while (nread > 0); ++ ++ g_free (request); ++ g_object_unref (conn); ++ g_object_unref (client); ++ } ++} ++ + int + main (int argc, char **argv) + { +@@ -1411,6 +1476,8 @@ main (int argc, char **argv) + server_setup_nohandler, do_early_multi_test, server_teardown); + g_test_add ("/server/steal/CONNECT", ServerData, NULL, + server_setup, do_steal_connect_test, server_teardown); ++ g_test_add ("/server/chunked", ServerData, NULL, ++ NULL, do_chunked_test, server_teardown); + + ret = g_test_run (); + +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb index 4fe1e36f03..9da2dde714 100644 --- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb +++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb @@ -42,6 +42,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \ file://CVE-2025-2784.patch \ file://CVE-2025-4945.patch \ file://CVE-2026-1539.patch \ + file://CVE-2026-1801.patch \ " SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13" From patchwork Wed Oct 14 16:12:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jason Stasiak X-Patchwork-Id: 100710 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC0B4CC6B2C for ; Wed, 14 Oct 2026 16:12:45 +0000 (UTC) Received: from mail-dy1-f176.google.com (mail-dy1-f176.google.com [74.125.82.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.17970.1791994355673933917 for ; Wed, 14 Oct 2026 09:12:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=qnMHYfQ/; spf=pass (domain: gmail.com, ip: 74.125.82.176, mailfrom: jason.stasiak@gmail.com) Received: by mail-dy1-f176.google.com with SMTP id 5a478bee46e88-33c2520ad38so9804885eec.1 for ; Wed, 14 Oct 2026 09:12:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791994355; x=1792599155; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=btzZMfBCuoA87eUiBLyqdJY9mxEMNAZJDdE/DiJrZZo=; b=qnMHYfQ/A03i+57pZzUWSqSApNmOJ/0rEidquIQaYzF/zkxY5supOWHaK14zHSCs29 iL5xkNQXwieJacVV8Kcs184HI4VKllEbxk1rhgEgqOjy8hqNO9DdT734DpJa5BEagDM1 QxSApJ9TFe8DmIG/0pWpb4NmRvKH6WhCc3KAXUE4A+N9Rzf7jarlX3JhPZ2iOQCCvFdr EAVkhWhsJlc5uBkwaT0KIB46Ho28FjgOAN4FlSK9LEqKhFaBAZCb7gU4krSa6HihMrky Nv+FOh96LGZXljqM6Eeile6stSCGi1AWB/SNL9x6+YZ1R2kf6DByMkC1SjYFakBTq9L/ Q3cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791994355; x=1792599155; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=btzZMfBCuoA87eUiBLyqdJY9mxEMNAZJDdE/DiJrZZo=; b=B96NoWRYMARrkSuHRxSPm19uubqwjbhQDnCMP7pV1zPZ88ZOYoVTn+Uo6anUtRzQbJ NOREPsucV9iqBijapRlNtcXSbJ3JMRcvzDhBjo0X16ngk1k+RuIbHSJnfJgK+NmjXVQV iXoT7lGijWBjWe5xFz1jFyfVx6knlPqRmpvjyfTtOmr4daCgQVvHZwtPKzkPqHHkDtPx lzlBdeGuZCFX7uTEzW9yHt0JxO3okzR7GdNNl85ayxdqWLEhCiyL477KIF5oaRErBa69 MrmLZxXc4MewaOwxc8wsmB9FtbI/OvUkmRCJxjJJe+KQHwXH4EyFxq4Canf8jthS3MRW wj6Q== X-Gm-Message-State: AFq9FYLcXuqcRDHwn/OSy9tS0zGVyXNJ+hF3DZrg35fKYjCvLp7WBKhS 88KLynJnQfrEcRVdhJ/Yn5NUzCcuJsQUXKpOF787AeX7mBdTJt0GOyKj2KoGWw== X-Gm-Gg: AYBFou2+GK44eP0lQTx0kVobMNe78/tBZm/l0lRJNwtdocbaI4QxLilT6JHyrUgvmcD AutnXGmPUo+8RpY1A0w1VyJzSE/+dlsTSMjOICxUbvrQmR/oDYdtM9GsAebrv1ij6GXAFHfvtLB iA/DNa2AzvmOPHA8a+5oao/V/vb6irrb4Sm25n8F2dgOzrmYtdxOQTs9X4pIsgqL8utLB2zeIYm isP0xzW7853lSVY7qfFiHMMymsUCUqw/pxG6z2/VRu1iynsswoKpC5iYXKrH8x6cx78FAaiyZwO 6+rZlIy3ofDX+v9IDhrwALqhp6P/IgwFkAFvmG9L1Btv0bbEggGaLhZbMFI7+gFnx6OCiNV2Z1k UOCg4j4trPB+ZUCkB4bM7pTWSOw5KIs6WlGt0YIE/qh1Ekio4cyJIHT5R3sOP4kwVheAr/ST4x7 leWX1QJUtm9ejed9poUQoXhkqFjUFK9Z5HSWZyWvu6by2JxSWqSGgm6UK7nqEe8HUrymj2qmfkl NKCHbhaNuWbLw12Fijw X-Received: by 2002:a05:7301:470e:b0:35c:73ca:a1e0 with SMTP id 5a478bee46e88-35c73caae65mr7230191eec.15.1791994354472; Wed, 14 Oct 2026 09:12:34 -0700 (PDT) Received: from CHA-FQKPM83.ad.garmin.com ([65.175.40.146]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-35a352d4b05sm36006426eec.19.2026.10.14.09.12.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 09:12:33 -0700 (PDT) From: Jason Stasiak X-Google-Original-From: Jason Stasiak To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH v2 3/5] libsoup-2.4: fix CVE-2026-2443 Date: Wed, 14 Oct 2026 09:12:07 -0700 Message-ID: <20261014161209.2227316-3-jason.stasiak@garmin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261014161209.2227316-1-jason.stasiak@garmin.com> References: <20260929205055.2403390-2-jason.stasiak@gmail.com> <20261014161209.2227316-1-jason.stasiak@garmin.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 14 Oct 2026 16:12:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247785 Backport fix for CVE-2026-2443 from meta-oe to OE-core. Update CVE patch to restore the range-test validation unit test from the upstream libsoup3 patch (b9a1c0663ff8ab6e79715db4b35b54f560416ddd). (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d) Signed-off-by: Jason Stasiak --- .../libsoup/libsoup-2.4/CVE-2026-2443.patch | 390 ++++++++++++++++++ .../libsoup/libsoup-2.4_2.74.3.bb | 1 + 2 files changed, 391 insertions(+) create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-2443.patch diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-2443.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-2443.patch new file mode 100644 index 0000000000..e4d5f184fa --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-2443.patch @@ -0,0 +1,390 @@ +From 7bb3115a296154e3f465900ea5c984a493385a7f Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Fri, 19 Dec 2025 23:49:05 +0000 +Subject: [PATCH] Fix CVE-2026-2443 + +Upstream-Status: Backport [ +c1796442 soup-message-headers: Rework Range response statuses to match Apache +191ef313 soup-message-headers: Fix rejection of Range headers with trailing garbage +be677bea soup-message-headers: Fix parsing of invalid Range suffix lengths +2bbfdfe8 soup-message-headers: Reject ranges where end is before start +739bf7cb soup-message-headers: Reject invalid Range ends longer than the content +] +CVE: CVE-2026-2443 + +Signed-off-by: Changqing Li + +Backport the range-test validation unit tests from the upstream libsoup3 patches. + +Upstream-Status: Backport [ +5890c42d tests: Add more tests for invalid Range headers +c1796442 soup-message-headers: Rework Range response statuses to match Apache +6574a84f tests: Allow range tests to check more response statuses +191ef313 soup-message-headers: Fix rejection of Range headers with trailing garbage +be677bea soup-message-headers: Fix parsing of invalid Range suffix lengths +2bbfdfe8 soup-message-headers: Reject ranges where end is before start +739bf7cb soup-message-headers: Reject invalid Range ends longer than the content +] + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-message-headers.c | 62 ++++++++++---- + tests/range-test.c | 149 ++++++++++++++++++++++++++++----- + 2 files changed, 172 insertions(+), 39 deletions(-) + +diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c +index ff10e103..f30dd461 100644 +--- a/libsoup/soup-message-headers.c ++++ b/libsoup/soup-message-headers.c +@@ -940,10 +940,16 @@ sort_ranges (gconstpointer a, gconstpointer b) + } + + /* like soup_message_headers_get_ranges(), except it returns: +- * SOUP_STATUS_OK if there is no Range or it should be ignored. +- * SOUP_STATUS_PARTIAL_CONTENT if there is at least one satisfiable range. +- * SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE if @check_satisfiable +- * is %TRUE and the request is not satisfiable given @total_length. ++ * - SOUP_STATUS_OK if there is no Range or it should be ignored due to being ++ * entirely invalid. ++ * - SOUP_STATUS_PARTIAL_CONTENT if there is at least one satisfiable range. ++ * - SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE if @check_satisfiable ++ * is %TRUE, the Range is valid, but no part of the request is satisfiable ++ * given @total_length. ++ * ++ * @ranges and @length are only set if SOUP_STATUS_PARTIAL_CONTENT is returned. ++ * ++ * See https://httpwg.org/specs/rfc9110.html#field.range + */ + guint + soup_message_headers_get_ranges_internal (SoupMessageHeaders *hdrs, +@@ -957,22 +963,28 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders *hdrs, + GArray *array; + char *spec, *end; + guint status = SOUP_STATUS_OK; ++ gboolean is_all_valid = TRUE; + + if (!range || strncmp (range, "bytes", 5) != 0) +- return status; ++ return SOUP_STATUS_OK; /* invalid header or unknown range unit */ + + range += 5; + while (g_ascii_isspace (*range)) + range++; + if (*range++ != '=') +- return status; ++ return SOUP_STATUS_OK; /* invalid header */ + while (g_ascii_isspace (*range)) + range++; + + range_list = soup_header_parse_list (range); + if (!range_list) +- return status; ++ return SOUP_STATUS_OK; /* invalid list */ + ++ /* Loop through the ranges and modify the status accordingly. Default to ++ * status 200 (OK, ignoring the ranges). Switch to status 206 (Partial ++ * Content) if there is at least one partially valid range. Switch to ++ * status 416 (Range Not Satisfiable) if there are no partially valid ++ * ranges at all. */ + array = g_array_new (FALSE, FALSE, sizeof (SoupRange)); + for (r = range_list; r; r = r->next) { + SoupRange cur; +@@ -985,30 +997,44 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders *hdrs, + cur.start = g_ascii_strtoull (spec, &end, 10); + if (*end == '-') + end++; +- if (*end) { ++ if (*end) + cur.end = g_ascii_strtoull (end, &end, 10); +- if (cur.end < cur.start) { +- status = SOUP_STATUS_OK; +- break; +- } +- } else ++ else + cur.end = total_length - 1; + } ++ + if (*end) { +- status = SOUP_STATUS_OK; +- break; +- } else if (check_satisfiable && cur.start >= total_length) { +- if (status == SOUP_STATUS_OK) +- status = SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE; ++ /* Junk after the range */ ++ is_all_valid = FALSE; ++ continue; ++ } ++ ++ if (cur.end < cur.start) { ++ is_all_valid = FALSE; ++ continue; ++ } ++ ++ g_assert (cur.start >= 0); ++ if (cur.end >= total_length) ++ cur.end = total_length - 1; ++ ++ if (cur.start >= total_length) { ++ /* Range is valid, but unsatisfiable */ + continue; + } + ++ /* We have at least one (at least partially) satisfiable range */ + g_array_append_val (array, cur); + status = SOUP_STATUS_PARTIAL_CONTENT; + } + soup_header_free_list (range_list); + + if (status != SOUP_STATUS_PARTIAL_CONTENT) { ++ g_assert (status == SOUP_STATUS_OK); ++ ++ if (is_all_valid && check_satisfiable) ++ status = SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE; ++ + g_array_free (array, TRUE); + return status; + } +diff --git a/tests/range-test.c b/tests/range-test.c +index d3c49963..8bd0fa1c 100644 +--- a/tests/range-test.c ++++ b/tests/range-test.c +@@ -57,7 +57,8 @@ check_part (SoupMessageHeaders *headers, const char *body, gsize body_len, + + static void + do_single_range (SoupSession *session, SoupMessage *msg, +- int start, int end, gboolean succeed) ++ int start, int end, SoupStatus expected_status, ++ int expected_start, int expected_end) + { + const char *content_type; + +@@ -66,7 +67,7 @@ do_single_range (SoupSession *session, SoupMessage *msg, + + soup_session_send_message (session, msg); + +- if (!succeed) { ++ if (expected_status == SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE) { + soup_test_assert_message_status (msg, SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE); + if (msg->status_code != SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE) { + const char *content_range; +@@ -76,31 +77,78 @@ do_single_range (SoupSession *session, SoupMessage *msg, + if (content_range) + debug_printf (1, " Content-Range: %s\n", content_range); + } +- + g_object_unref (msg); + return; ++ } else if (expected_status == SOUP_STATUS_OK) { ++ soup_test_assert_message_status (msg, SOUP_STATUS_OK); ++ ++ content_type = soup_message_headers_get_content_type(msg->response_headers, NULL); ++ g_assert_cmpstr (content_type, !=, "multipart/byteranges"); ++ ++ g_assert_false (soup_message_headers_get_content_range (msg->response_headers, NULL, ++ NULL, NULL)); ++ g_assert_cmpint (soup_message_headers_get_content_length (msg->response_headers), ++ ==, full_response->length); ++ } else { ++ soup_test_assert_message_status (msg, SOUP_STATUS_PARTIAL_CONTENT); ++ content_type = soup_message_headers_get_content_type (msg->response_headers, NULL); ++ g_assert_cmpstr (content_type, !=, "multipart/byteranges"); ++ ++ check_part (msg->response_headers, msg->response_body->data, ++ msg->response_body->length, TRUE, expected_start, expected_end); + } + +- soup_test_assert_message_status (msg, SOUP_STATUS_PARTIAL_CONTENT); +- +- content_type = soup_message_headers_get_content_type ( +- msg->response_headers, NULL); +- g_assert_cmpstr (content_type, !=, "multipart/byteranges"); +- +- check_part (msg->response_headers, msg->response_body->data, +- msg->response_body->length, TRUE, start, end); + g_object_unref (msg); + } + + static void + request_single_range (SoupSession *session, const char *uri, +- int start, int end, gboolean succeed) ++ int start, int end, SoupStatus expected_status, ++ int expected_start, int expected_end) + { + SoupMessage *msg; + + msg = soup_message_new ("GET", uri); + soup_message_headers_set_range (msg->request_headers, start, end); +- do_single_range (session, msg, start, end, succeed); ++ do_single_range (session, msg, start, end, expected_status, expected_start, expected_end); ++} ++ ++/* This always asserts failure (either 406 or 200 with no Content-Range); it’s ++ * intended to be used for passing invalid ++ * Range header formats which can’t be built by calling ++ * soup_message_headers_set_range(). */ ++static void ++request_single_range_by_string (SoupSession *session, const char *uri, ++ const char *range, SoupStatus expected_status) ++{ ++ SoupMessage *msg; ++ ++ msg = soup_message_new ("GET", uri); ++ soup_message_headers_replace (msg->request_headers, "Range", range); ++ ++ debug_printf (1, " Range: %s\n", ++ soup_message_headers_get_one (msg->request_headers, "Range")); ++ ++ soup_session_send_message (session, msg); ++ ++ if (expected_status == SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE) { ++ soup_test_assert_message_status (msg, SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE); ++ } else { ++ const char *content_type; ++ ++ soup_test_assert_message_status (msg, SOUP_STATUS_OK); ++ ++ content_type = soup_message_headers_get_content_type (msg->response_headers, NULL); ++ g_assert_cmpstr (content_type, !=, "multipart/byteranges"); ++ ++ g_assert_false (soup_message_headers_get_content_range (msg->response_headers, ++ NULL, NULL, NULL)); ++ ++ g_assert_cmpint (soup_message_headers_get_content_length (msg->response_headers), ++ ==, full_response->length); ++ } ++ ++ g_object_unref (msg); + } + + static void +@@ -165,7 +213,9 @@ request_double_range (SoupSession *session, const char *uri, + do_single_range (session, msg, + MIN (first_start, second_start), + MAX (first_end, second_end), +- TRUE); ++ SOUP_STATUS_PARTIAL_CONTENT, ++ MIN (first_start, second_start), ++ MAX (first_end, second_end)); + } else + do_multi_range (session, msg, expected_return_ranges); + } +@@ -193,7 +243,9 @@ request_triple_range (SoupSession *session, const char *uri, + do_single_range (session, msg, + MIN (first_start, MIN (second_start, third_start)), + MAX (first_end, MAX (second_end, third_end)), +- TRUE); ++ SOUP_STATUS_PARTIAL_CONTENT, ++ MIN (first_start, MIN (second_start, third_start)), ++ MAX (first_end, MAX (second_end, third_end))); + } else + do_multi_range (session, msg, expected_return_ranges); + } +@@ -248,7 +300,8 @@ do_range_test (SoupSession *session, const char *uri, + debug_printf (1, "Requesting %d-%d\n", 0 * twelfths, 1 * twelfths); + request_single_range (session, uri, + 0 * twelfths, 1 * twelfths, +- TRUE); ++ SOUP_STATUS_PARTIAL_CONTENT, ++ 0 * twelfths, 1 * twelfths); + + /* B: 11, end-relative request. These two are mostly redundant + * in terms of data coverage, but they may still catch +@@ -257,11 +310,13 @@ do_range_test (SoupSession *session, const char *uri, + debug_printf (1, "Requesting %d-\n", 11 * twelfths); + request_single_range (session, uri, + 11 * twelfths, -1, +- TRUE); ++ SOUP_STATUS_PARTIAL_CONTENT, ++ 11 * twelfths, -1); + debug_printf (1, "Requesting -%d\n", 1 * twelfths); + request_single_range (session, uri, + -1 * twelfths, -1, +- TRUE); ++ SOUP_STATUS_PARTIAL_CONTENT, ++ -1 * twelfths, -1); + + /* C: 2 and 5 */ + debug_printf (1, "Requesting %d-%d,%d-%d\n", +@@ -314,7 +369,8 @@ do_range_test (SoupSession *session, const char *uri, + (int) full_response->length + 100); + request_single_range (session, uri, + full_response->length + 1, full_response->length + 100, +- FALSE); ++ SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE, ++ 0, 0); + + debug_printf (1, "Requesting (semi-invalid) 1-10,%d-%d,20-30\n", + (int) full_response->length + 1, +@@ -322,7 +378,58 @@ do_range_test (SoupSession *session, const char *uri, + request_semi_invalid_range (session, uri, + 1, 10, + full_response->length + 1, full_response->length + 100, +- 20, 30); ++ 20, 30); ++ ++ debug_printf (1, "Requesting (invalid end) %d-%d\n", ++ 1, ++ (int) full_response->length + 1000); ++ request_single_range (session, uri, ++ 1, full_response->length + 1000, ++ SOUP_STATUS_PARTIAL_CONTENT, ++ 1, full_response->length - 1); ++ ++ debug_printf (1, "Requesting (end before start) %d-%d\n", ++ 10, ++ 1); ++ request_single_range (session, uri, ++ 10, 1, ++ SOUP_STATUS_OK, ++ 1, full_response->length); ++ ++ debug_printf (1, "Requesting (malformed suffix length) -0\n"); ++ request_single_range_by_string (session, uri, ++ "bytes=-0", ++ SOUP_STATUS_OK); ++ ++ debug_printf (1, "Requesting (extra content after valid header value) 0-10\n"); ++ request_single_range_by_string (session, uri, ++ "bytes=0-10 but with weird trailing content", ++ SOUP_STATUS_OK); ++ ++ debug_printf (1, "Requesting (invalid range dash) 0a10\n"); ++ request_single_range_by_string (session, uri, ++ "bytes=0a10", ++ SOUP_STATUS_OK); ++ ++ debug_printf (1, "Requesting (invalid range unit) 0-10\n"); ++ request_single_range_by_string (session, uri, ++ "horses=0-10", ++ SOUP_STATUS_OK); ++ ++ debug_printf (1, "Requesting (missing equals) 0-10\n"); ++ request_single_range_by_string (session, uri, ++ "bytes 0-10", ++ SOUP_STATUS_OK); ++ ++ debug_printf (1, "Requesting (end before start but with whitespace) 10-1\n"); ++ request_single_range_by_string (session, uri, ++ "bytes \t = \t 10-1", ++ SOUP_STATUS_OK); ++ ++ debug_printf (1, "Requesting (delimiters but no ranges)\n"); ++ request_single_range_by_string (session, uri, ++ "bytes=, ,,\t, ", ++ SOUP_STATUS_OK); + } + + static void +@@ -341,7 +448,7 @@ do_apache_range_test (void) + + static void + server_handler (SoupServer *server, +- SoupMessage *msg, ++ SoupMessage *msg, + const char *path, + GHashTable *query, + SoupClientContext *client, +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb index 9da2dde714..18f82f8ef7 100644 --- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb +++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb @@ -43,6 +43,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \ file://CVE-2025-4945.patch \ file://CVE-2026-1539.patch \ file://CVE-2026-1801.patch \ + file://CVE-2026-2443.patch \ " SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13" From patchwork Wed Oct 14 16:12:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Stasiak X-Patchwork-Id: 100708 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 858E4CC6B1A for ; Wed, 14 Oct 2026 16:12:45 +0000 (UTC) Received: from mail-dl1-f44.google.com (mail-dl1-f44.google.com [74.125.82.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18129.1791994356333344804 for ; Wed, 14 Oct 2026 09:12:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=aSaARlbx; spf=pass (domain: gmail.com, ip: 74.125.82.44, mailfrom: jason.stasiak@gmail.com) Received: by mail-dl1-f44.google.com with SMTP id a92af1059eb24-15354aa70e8so3069519c88.1 for ; Wed, 14 Oct 2026 09:12:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791994356; x=1792599156; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=6zebUfDertHmgSgGLGGUurC+orb0otQBUhgOJCb9Ohs=; b=aSaARlbxkIKnJ/Hq676fzZIuXQbfaAMQqM3WdzX2g4Xmbzfmgm++LnyCu5RE/DT/28 ePNoBYNYIj2CcA/qFLwz6/C+a1dYK6trIf6tiqdYnHu7zahoqRoOIROtyzu4MmWiLB1O UlPWh6NTVZW3YJDhzug6f57WFya+SKhoAZn1jZuX6M1Ipiy7V0/glGJRk5+okiBMVMcX BUxMVRL6fvwGrEIo3VOZZN9ayunI0Vv5KNpjt09kQhzYSx8/Gy46kzamKup6uB35jhTu NNJ8LF95YcCwNgKnnLJfMFaxFYEWgMwAQDGFgRqmK+n96kPPehO924lj+BOAPv5Imk2i +tQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791994356; x=1792599156; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6zebUfDertHmgSgGLGGUurC+orb0otQBUhgOJCb9Ohs=; b=UQPnUvJqUNUsCv1ooUylqwBu8exhod+ikTEPCxOg66oPi+LxN8UHgSteUeALSwomlZ 0TSeydwz6Kst/0MpiKPj1rFpOpum7gzQVvPiGUj5oYb+JDETLnA9C+zYXxHY9n9pIbc8 jbLXNx4lUJxRMGUIfRxJn8kB0mbNzax6B7R265gGGzKyxAO6TGwpuhg+25w3msxShEwH vVw2tU3B6Fal6jkBoIivELwGGJsxI9yo1+IlzJUcjtStr4Gdap3gz/ebMoQye35L/6K0 sisrZzmFvB1nZsd0rU/Sg0yxSdkh+5/SCHyKeIvALCB5ZfsqjoVKjPfN6uQf2l3aGrdd xTaA== X-Gm-Message-State: AFq9FYKXRi09DC/sxDmEF4iTu8jEZEqmf1DzZEviqcz+j+yyWexUgrY1 RTzJaJ1eio01+XR9Mhh+w021spQu6+a29Vstpq8mf4ZVeA4OFXr0n+Yn61REGQ== X-Gm-Gg: AYBFou3QaCFjnrwMk1ylpUYAubSt7ii8eug2yeepEyTSgFKvy8OYKHhxD/Ff77o9vp4 YyOmGPxuq8OFMQO18kU8yImXzXO/av9fZ/vWuu+2wILYSh/IeZZnlHPv76ySWorriFRefuyGiZk hpI7qdvIjwGzufxPxJai4z5LJXopFdWwvlgbEi5D7bNTaFVdhQYH2cTsmlrnXWipet2FBKongxu KQZNCev7nWF/nvZrGT3fc85C+jVvk3I55R09SrLL13G/4eO8sLxfh1dMry+3+q5tYqL999CUnLn Fiswo5ixNZiZEXAQWjbRiMYnXkWSIStjtkpeMCFjtVN9WS2Ku5KPkRz3dkKyQKMN0Z9eLd0I/Bf Bbsb4XzuB98eAwTiWemFQBN5i48iriSildPqYe/79Nr/WgJvf/5sV8OiUFX6ZhsIOvAPE3fa9wY jzkhPcf6BAvpcXCy0THmO/5XtmxF3OBVOXOpuiyI3va9gbVomYI6uKqz68Qv2Qqe6AjvNAisRkf 9o3f6+tMAGwtX/as4gg4NLiltL5+UU= X-Received: by 2002:a05:701b:280d:b0:16b:fdbf:4a9d with SMTP id a92af1059eb24-16bfdbf4ff5mr22436610c88.27.1791994355570; Wed, 14 Oct 2026 09:12:35 -0700 (PDT) Received: from CHA-FQKPM83.ad.garmin.com ([65.175.40.146]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-35a352d4b05sm36006426eec.19.2026.10.14.09.12.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 09:12:35 -0700 (PDT) From: Jason Stasiak X-Google-Original-From: Jason Stasiak To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH v2 4/5] libsoup-2.4: fix CVE-2026-5119 Date: Wed, 14 Oct 2026 09:12:08 -0700 Message-ID: <20261014161209.2227316-4-jason.stasiak@garmin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261014161209.2227316-1-jason.stasiak@garmin.com> References: <20260929205055.2403390-2-jason.stasiak@gmail.com> <20261014161209.2227316-1-jason.stasiak@garmin.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 14 Oct 2026 16:12:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247786 Backport fix for CVE-2026-5119 from upstream libsoup 3 patch [1]. [1] https://gitlab.gnome.org/GNOME/libsoup/-/commit/b0626fff8538e3dd4a52f148d91c8348d51d64d1 Signed-off-by: Jason Stasiak --- Changes since v1: - Updated subject line to identify correct CVE .../libsoup/libsoup-2.4/CVE-2026-5119.patch | 129 ++++++++++++++++++ .../libsoup/libsoup-2.4_2.74.3.bb | 1 + 2 files changed, 130 insertions(+) create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-5119.patch diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-5119.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-5119.patch new file mode 100644 index 0000000000..0041010667 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-5119.patch @@ -0,0 +1,129 @@ +From b0626fff8538e3dd4a52f148d91c8348d51d64d1 Mon Sep 17 00:00:00 2001 +From: Carlos Garcia Campos +Date: Fri, 27 Feb 2026 12:03:25 +0100 +Subject: [PATCH] Fix CVE-2026-5119 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/b0626fff8538e3dd4a52f148d91c8348d51d64d1] +CVE: CVE-2026-5119 + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-cookie-jar.c | 25 +++++++++++++++------ + tests/proxy-test.c | 46 +++++++++++++++++++++++++++++++++++++++ + 2 files changed, 64 insertions(+), 7 deletions(-) + +diff --git a/libsoup/soup-cookie-jar.c b/libsoup/soup-cookie-jar.c +index c8231f0e..b9abdc82 100644 +--- a/libsoup/soup-cookie-jar.c ++++ b/libsoup/soup-cookie-jar.c +@@ -12,6 +12,7 @@ + #include + + #include "soup-cookie-jar.h" ++#include "soup-connection.h" + #include "soup-message-private.h" + #include "soup-misc-private.h" + #include "soup.h" +@@ -818,18 +819,28 @@ process_set_cookie_header (SoupMessage *msg, gpointer user_data) + g_slist_free (new_cookies); + } + ++static gboolean ++allow_cookies_for_request (SoupMessage *msg) ++{ ++ /* Do not send cookies to a HTTP proxy for a HTTPS request */ ++ return msg->method != SOUP_METHOD_CONNECT || !soup_connection_is_tunnelled (soup_message_get_connection (msg)); ++} ++ + static void + msg_starting_cb (SoupMessage *msg, gpointer feature) + { + SoupCookieJar *jar = SOUP_COOKIE_JAR (feature); +- GSList *cookies; ++ GSList *cookies = NULL; ++ ++ if (allow_cookies_for_request (msg)) { ++ cookies = soup_cookie_jar_get_cookie_list_with_same_site_info (jar, soup_message_get_uri (msg), ++ soup_message_get_first_party (msg), ++ soup_message_get_site_for_cookies (msg), ++ TRUE, ++ SOUP_METHOD_IS_SAFE (msg->method), ++ soup_message_get_is_top_level_navigation (msg)); ++ } + +- cookies = soup_cookie_jar_get_cookie_list_with_same_site_info (jar, soup_message_get_uri (msg), +- soup_message_get_first_party (msg), +- soup_message_get_site_for_cookies (msg), +- TRUE, +- SOUP_METHOD_IS_SAFE (msg->method), +- soup_message_get_is_top_level_navigation (msg)); + if (cookies != NULL) { + char *cookie_header = soup_cookies_to_cookie_header (cookies); + soup_message_headers_replace (msg->request_headers, "Cookie", cookie_header); +diff --git a/tests/proxy-test.c b/tests/proxy-test.c +index 105a02a6..d8c7e8a1 100644 +--- a/tests/proxy-test.c ++++ b/tests/proxy-test.c +@@ -435,6 +435,51 @@ do_proxy_auth_cache_test (void) + g_object_unref (cache); + } + ++static void ++connect_message_wrote_headers_cb (SoupMessage *msg, guint *counter) ++{ ++ SoupMessageHeaders *hdrs; ++ ++ *counter += 1; ++ ++ if (msg->method == SOUP_METHOD_CONNECT) ++ g_assert_null (soup_message_headers_get_one (msg->request_headers, "Cookie")); ++ else ++ g_assert_nonnull (soup_message_headers_get_one (msg->request_headers, "Cookie")); ++} ++ ++static void ++request_queued_cb (SoupSession *session, SoupMessage *msg, guint *counter) ++{ ++ g_signal_connect (msg, "wrote-headers", G_CALLBACK (connect_message_wrote_headers_cb), counter); ++} ++ ++static void ++do_proxy_secure_cookies_test (void) ++{ ++ SoupSession *session; ++ SoupMessage *msg; ++ SoupCookieJar *jar; ++ guint counter = 0; ++ ++ SOUP_TEST_SKIP_IF_NO_APACHE; ++ SOUP_TEST_SKIP_IF_NO_TLS; ++ ++ session = soup_test_session_new (SOUP_TYPE_SESSION_SYNC, SOUP_SESSION_PROXY_RESOLVER, proxy_resolvers[SIMPLE_PROXY], NULL); ++ g_signal_connect (session, "request-queued", G_CALLBACK (request_queued_cb), &counter); ++ ++ soup_session_add_feature_by_type (session, SOUP_TYPE_COOKIE_JAR); ++ jar = SOUP_COOKIE_JAR (soup_session_get_feature (session, SOUP_TYPE_COOKIE_JAR)); ++ ++ msg = soup_message_new (SOUP_METHOD_GET, HTTPS_SERVER); ++ soup_cookie_jar_set_cookie (jar, soup_message_get_uri (msg), "user=password; secure"); ++ soup_session_send_message (session, msg); ++ soup_test_assert_message_status (msg, SOUP_STATUS_OK); ++ g_assert_cmpuint (counter, ==, 2); ++ ++ soup_test_session_abort_unref (session); ++} ++ + int + main (int argc, char **argv) + { +@@ -470,6 +515,7 @@ main (int argc, char **argv) + g_test_add_func ("/proxy/redirect", do_proxy_redirect_test); + g_test_add_func ("/proxy/auth-redirect", do_proxy_auth_redirect_test); + g_test_add_func ("/proxy/auth-cache", do_proxy_auth_cache_test); ++ g_test_add_func ("/proxy/secure-cookies", do_proxy_secure_cookies_test); + + ret = g_test_run (); + +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb index 18f82f8ef7..c79bced69d 100644 --- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb +++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb @@ -44,6 +44,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \ file://CVE-2026-1539.patch \ file://CVE-2026-1801.patch \ file://CVE-2026-2443.patch \ + file://CVE-2026-5119.patch \ " SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13" From patchwork Wed Oct 14 16:12:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Stasiak X-Patchwork-Id: 100709 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F007CC6B1D for ; Wed, 14 Oct 2026 16:12:45 +0000 (UTC) Received: from mail-dy1-f182.google.com (mail-dy1-f182.google.com [74.125.82.182]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18133.1791994357576835436 for ; Wed, 14 Oct 2026 09:12:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=pA/T/C9I; spf=pass (domain: gmail.com, ip: 74.125.82.182, mailfrom: jason.stasiak@gmail.com) Received: by mail-dy1-f182.google.com with SMTP id 5a478bee46e88-33bf40b0c8bso1171139eec.0 for ; Wed, 14 Oct 2026 09:12:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791994357; x=1792599157; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=mV8Dsm79UjSmL3f8YDP76bnQScpCWf/U8RehHSr8qFA=; b=pA/T/C9IJSKn8q0e3UA4yG4wr2EYibk0NSuUDaDWabiv/h+8snrUkEBy1/GATTfM5K GDE5lCQZFb9Os7JPuOhVUymtCxvtkjkO/MNTCVeiCOSBw6bkqMsiSQ8YTEIbl+Tz0EZc nx+UZY+7Q5FpDhCv+SWY+CsM9GVlvudyO+Erdyq6magGpJs2Q4PQB86CnhYneaMHIa6X RpxHAhnVUsK/83h1GuKJ0BA3uFY9DLD8dLNwCaowdDr2HGL8FMzGt9Mn6OpcKGKdReDc WYIUn/kypU1rEnrruY1hmgLCA0phHm3gg+ZpD7g+wj/c+3pI9xZiX7bv2GDb863fm0JZ kGvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791994357; x=1792599157; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=mV8Dsm79UjSmL3f8YDP76bnQScpCWf/U8RehHSr8qFA=; b=rvSnWIHibVvKeYrUHXqomepv08QLJzf/mxANmF8qhcg7zG4IPYfPZtCxTaVtzrc2dK +KdDv/rg6/hbcGEsbghRl6rIFbGKXl2aY7dpeBHy7AaJI2CXsqeJkGkb6cUlZ9KyjV9a ShecrKuoWBMPfwJqA5HDFYH9IdAActIr8tn0f4sPMx4A/g5C6PWqXroSMO3ylH1WoFi8 ijZ7Qz5Rhcw/Gzmi2JwE9b+pU3bXGixh2bKFx+cGso+iNlPi3iU8S4BAueCseHDvSLsN f/bVufBEsOwlwlK3RvLX9adbz10RAq93bKs47GYRoxRbHCPxWTC3gQ3Q3dmUOJcU3LTS 27cQ== X-Gm-Message-State: AFq9FYKMAj0vgnkrQpGPAKRi7CljH18dlbrlsKGv91mK8cLnsa3eKeYj DJW1zj4X1/CrFaOdcQZwvP+NtNtzQz0Xso95h4cqJsmu7CwBKX7f4PRHzqvSdA== X-Gm-Gg: AYBFou0pUN+ZpVog/B33oe6toNR68CmUKOH1DFgo2iFujMjDXOq2Gp6k/BV8zpxU0qn u+5xvMSdEJAm/+LwTUQ/uGiewoLf7c5CZc3kmzoxGWjQy7UgXG3SrJHXcL2F7ee4y2dyV/BXZaD jawU9QddLfJxkIg0nSixFqo1kNjttNCfPHqjidbQULCODG6c5pnhqqKszeXSBmmkIr/HuxmP7YD Ca320TRrdh9i7jr2iuS6+i4TrCw6vmxig7jPo1VYFn6NE6gd7I5XmotYkQyHoiSkNJZyikHMxVH hmqceWOvysaqhHIL9Qy6flVR6aD97CaN4rWbd5/gXDjwBFJvjkWX/qSkjffVEPgtTwg8VTH0zsq 5YqCXiaex+2vwTdsp2BHyuwNQrV8KZKCNKYecNxaWNsOfqxiHok3unSJT0uCipnFjlUK2o9JV6P KjwqM1wP12aXCOT4jTKTULjeDEBftcSw43+Gc6s7WRfGFV9cdIi8SmzuJY01XjTfyyQreCOtO5Q u99tRUWo7xQf7hx+Yft X-Received: by 2002:a05:7022:e806:b0:178:4a98:8751 with SMTP id a92af1059eb24-1784ab70e5cmr10284602c88.37.1791994356509; Wed, 14 Oct 2026 09:12:36 -0700 (PDT) Received: from CHA-FQKPM83.ad.garmin.com ([65.175.40.146]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-35a352d4b05sm36006426eec.19.2026.10.14.09.12.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 09:12:35 -0700 (PDT) From: Jason Stasiak X-Google-Original-From: Jason Stasiak To: openembedded-core@lists.openembedded.org Subject: [scarthgap][PATCH v2 5/5] libsoup-2.4: fix CVE-2026-3633 Date: Wed, 14 Oct 2026 09:12:09 -0700 Message-ID: <20261014161209.2227316-5-jason.stasiak@garmin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261014161209.2227316-1-jason.stasiak@garmin.com> References: <20260929205055.2403390-2-jason.stasiak@gmail.com> <20261014161209.2227316-1-jason.stasiak@garmin.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 14 Oct 2026 16:12:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247787 Backport fix for CVE-2026-3633 [1] and additional supporting patches [2][3][4] from the upstream libsoup 3 repo. [1] https://gitlab.gnome.org/GNOME/libsoup/-/commit/7f2013d874f005035f2245e382ec82823a439926 [2] https://gitlab.gnome.org/GNOME/libsoup/-/commit/0120f183ca2b74abeee8439f73abc8ab504fbccf [3] https://gitlab.gnome.org/GNOME/libsoup/-/commit/05910f8cb577682d444b0abaef670b4eb028e2fa [4] https://gitlab.gnome.org/GNOME/libsoup/-/commit/a90c442df5f980dd9a8108c9def3b06607662fc8 Signed-off-by: Jason Stasiak --- .../libsoup/libsoup-2.4/CVE-2026-3633-1.patch | 51 ++++++++ .../libsoup/libsoup-2.4/CVE-2026-3633-2.patch | 53 ++++++++ .../libsoup/libsoup-2.4/CVE-2026-3633-3.patch | 49 ++++++++ .../libsoup/libsoup-2.4/CVE-2026-3633-4.patch | 113 ++++++++++++++++++ .../libsoup/libsoup-2.4_2.74.3.bb | 4 + 5 files changed, 270 insertions(+) create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-1.patch create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-2.patch create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-3.patch create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-4.patch diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-1.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-1.patch new file mode 100644 index 0000000000..37eeb24409 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-1.patch @@ -0,0 +1,51 @@ +From 5d61da4e261fab02d07dc74bb3049bbd13535247 Mon Sep 17 00:00:00 2001 +From: Jason Stasiak +Date: Fri, 25 Sep 2026 10:17:05 -0700 +Subject: [PATCH 1/4] CVE-2026-3633: Make SoupMessage a private and final type + +CVE: CVE-2026-3633 +Upstream-Status: Backport [ https://gitlab.gnome.org/GNOME/libsoup/-/commit/0120f183ca2b74abeee8439f73abc8ab504fbccf ] + +Backport the introduction of soup_message_set_method() from upstream +libsoup 3 patch to begin alignment of libsoup 2.4 code with that needed +to address CVE-2026-3633. + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-message-private.h | 2 ++ + libsoup/soup-message.c | 10 ++++++++++ + 2 files changed, 12 insertions(+) + +diff --git a/libsoup/soup-message-private.h b/libsoup/soup-message-private.h +index c30361c0..ee73112f 100644 +--- a/libsoup/soup-message-private.h ++++ b/libsoup/soup-message-private.h +@@ -179,4 +179,6 @@ gboolean soup_message_has_chunk_allocator (SoupMessage *msg); + SoupBuffer *soup_message_allocate_chunk (SoupMessage *msg, + goffset read_length); + ++void soup_message_set_method (SoupMessage *msg, ++ const char *method); + #endif /* __SOUP_MESSAGE_PRIVATE_H__ */ +diff --git a/libsoup/soup-message.c b/libsoup/soup-message.c +index cc4f22b6..eae11eea 100644 +--- a/libsoup/soup-message.c ++++ b/libsoup/soup-message.c +@@ -2394,3 +2394,13 @@ soup_message_allocate_chunk (SoupMessage *msg, + + return priv->chunk_allocator (msg, read_length, priv->chunk_allocator_data); + } ++ ++ ++void ++soup_message_set_method (SoupMessage *msg, ++ const char *method) ++{ ++ g_return_if_fail (method != NULL); ++ ++ msg->method = g_intern_string (method); ++} +\ No newline at end of file +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-2.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-2.patch new file mode 100644 index 0000000000..c98a26ee6a --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-2.patch @@ -0,0 +1,53 @@ +From ef7fb85f6bda553c37f50606205396b1a3b363a7 Mon Sep 17 00:00:00 2001 +From: Jason Stasiak +Date: Fri, 25 Sep 2026 10:23:14 -0700 +Subject: [PATCH 2/4] CVE-2026-3633: message: ensure GObject::notify signal is + always emitted when properties change + +CVE: CVE-2026-3633 +Upstream-Status: Backport [ https://gitlab.gnome.org/GNOME/libsoup/-/commit/05910f8cb577682d444b0abaef670b4eb028e2fa ] + +Backport the following portions of the libsoup 3 patch to align +libsoup 2.4 code with that needed to address CVE-2026-3633: +- Calling of soup_message_set_property() within soup_message_set_method() + for a method property change +- Update of soup_message_set_property() which triggers the GObject::notify + signal when the method property changes + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-message.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/libsoup/soup-message.c b/libsoup/soup-message.c +index eae11eea..ff8aaab5 100644 +--- a/libsoup/soup-message.c ++++ b/libsoup/soup-message.c +@@ -205,7 +205,7 @@ soup_message_set_property (GObject *object, guint prop_id, + + switch (prop_id) { + case PROP_METHOD: +- msg->method = g_intern_string (g_value_get_string (value)); ++ soup_message_set_method (msg, g_value_get_string (value)); + break; + case PROP_URI: + soup_message_set_uri (msg, g_value_get_boxed (value)); +@@ -2400,7 +2400,12 @@ void + soup_message_set_method (SoupMessage *msg, + const char *method) + { +- g_return_if_fail (method != NULL); ++ const char *new_method = g_intern_string (method); + +- msg->method = g_intern_string (method); ++ if (msg->method == new_method) ++ return; ++ ++ msg->method = new_method; ++ ++ g_object_notify (G_OBJECT (msg), "method"); + } +\ No newline at end of file +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-3.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-3.patch new file mode 100644 index 0000000000..825d7f0436 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-3.patch @@ -0,0 +1,49 @@ +From ac0de649ae76b073c8c405f141e6509eb624ee89 Mon Sep 17 00:00:00 2001 +From: Jason Stasiak +Date: Fri, 25 Sep 2026 10:32:36 -0700 +Subject: [PATCH 3/4] CVE-2026-3633: message: make soup_message_set_method + public + +CVE: CVE-2026-3633 +Upstream-Status: Backport [ https://gitlab.gnome.org/GNOME/libsoup/-/commit/a90c442df5f980dd9a8108c9def3b06607662fc8 ] + +Backport the portion of the libsoup 3 patch that transitions +soup_message_set_method() from being a private getter to a public +getter to align the libsoup 2.4 code with that needed to address +CVE-2026-3633. + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-message-private.h | 2 -- + libsoup/soup-message.h | 4 ++++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/libsoup/soup-message-private.h b/libsoup/soup-message-private.h +index ee73112f..c30361c0 100644 +--- a/libsoup/soup-message-private.h ++++ b/libsoup/soup-message-private.h +@@ -179,6 +179,4 @@ gboolean soup_message_has_chunk_allocator (SoupMessage *msg); + SoupBuffer *soup_message_allocate_chunk (SoupMessage *msg, + goffset read_length); + +-void soup_message_set_method (SoupMessage *msg, +- const char *method); + #endif /* __SOUP_MESSAGE_PRIVATE_H__ */ +diff --git a/libsoup/soup-message.h b/libsoup/soup-message.h +index 42379a4b..18066d35 100644 +--- a/libsoup/soup-message.h ++++ b/libsoup/soup-message.h +@@ -115,6 +115,10 @@ SoupHTTPVersion soup_message_get_http_version (SoupMessage *msg); + SOUP_AVAILABLE_IN_2_4 + gboolean soup_message_is_keepalive (SoupMessage *msg); + ++SOUP_AVAILABLE_IN_2_4 ++void soup_message_set_method (SoupMessage *msg, ++ const char *method); ++ + SOUP_AVAILABLE_IN_2_4 + SoupURI *soup_message_get_uri (SoupMessage *msg); + SOUP_AVAILABLE_IN_2_4 +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-4.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-4.patch new file mode 100644 index 0000000000..471df33ec9 --- /dev/null +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-3633-4.patch @@ -0,0 +1,113 @@ +From bd9d3c8c6af2783fed2745834f6623a2df70f75d Mon Sep 17 00:00:00 2001 +From: Jason Stasiak +Date: Fri, 25 Sep 2026 10:39:16 -0700 +Subject: [PATCH 4/4] Fix CVE-2026-3633 + +CVE: CVE-2026-3633 +Upstream-Status: Backport [ https://gitlab.gnome.org/GNOME/libsoup/-/commit/7f2013d874f005035f2245e382ec82823a439926 ] + +Backport the upstream libsoup 3 fix for CVE-2026-3633 to +libsoup 2.4. + +Signed-off-by: Jason Stasiak +--- + libsoup/soup-message.c | 32 ++++++++++++++++++++++++++++++-- + tests/misc-test.c | 22 ++++++++++++++++++++++ + 2 files changed, 52 insertions(+), 2 deletions(-) + +diff --git a/libsoup/soup-message.c b/libsoup/soup-message.c +index ff8aaab5..08f22c19 100644 +--- a/libsoup/soup-message.c ++++ b/libsoup/soup-message.c +@@ -2395,17 +2395,45 @@ soup_message_allocate_chunk (SoupMessage *msg, + return priv->chunk_allocator (msg, read_length, priv->chunk_allocator_data); + } + ++/* Validates that a method string conforms to the RFC 9110 'token' specification. */ ++static gboolean ++method_is_valid (const char *method) ++{ ++ const char *p; ++ ++ if (method == NULL || *method == '\0') ++ return FALSE; ++ ++ for (p = method; *p != '\0'; p++) { ++ char c = *p; ++ ++ if (g_ascii_isalnum (c)) ++ continue; ++ ++ if (strchr ("!#$%&\'*+-.^_`|~", c) == NULL) ++ return FALSE; ++ } ++ ++ return TRUE; ++} + + void + soup_message_set_method (SoupMessage *msg, + const char *method) + { +- const char *new_method = g_intern_string (method); ++ const char *new_method; ++ ++ g_return_if_fail (method != NULL); + ++ if (!method_is_valid (method)) { ++ g_warning ("soup_message_set_method: Rejecting invalid method '%s'", method); ++ return; ++ } ++ ++ new_method = g_intern_string (method); + if (msg->method == new_method) + return; + + msg->method = new_method; +- + g_object_notify (G_OBJECT (msg), "method"); + } +\ No newline at end of file +diff --git a/tests/misc-test.c b/tests/misc-test.c +index 0f9b0d33..afb7bb30 100644 +--- a/tests/misc-test.c ++++ b/tests/misc-test.c +@@ -89,6 +89,27 @@ server_callback (SoupServer *server, SoupMessage *msg, + } + } + ++static void ++do_method_injection_test (void) ++{ ++ SoupMessage *msg; ++ ++ g_test_expect_message ("libsoup", G_LOG_LEVEL_WARNING, ++ "soup_message_set_method: Rejecting invalid method*"); ++ msg = soup_message_new_from_uri ("GET / HTTP/1.1\r\nX-Injected: evil", base_uri); ++ g_assert_null (msg->method); ++ g_test_assert_expected_messages (); ++ g_object_unref (msg); ++ ++ g_test_expect_message ("libsoup", G_LOG_LEVEL_WARNING, ++ "soup_message_set_method: Rejecting invalid method*"); ++ msg = soup_message_new_from_uri (SOUP_METHOD_GET, base_uri); ++ soup_message_set_method (msg, "POST /evil HTTP/1.1\r\nHost: attacker\r\n\r\nGET"); ++ g_assert_cmpstr (msg->method, ==, SOUP_METHOD_GET); ++ g_test_assert_expected_messages (); ++ g_object_unref (msg); ++} ++ + /* Host header handling: client must be able to override the default + * value, server must be able to recognize different Host values. + */ +@@ -1276,6 +1297,7 @@ main (int argc, char **argv) + + g_test_add_func ("/misc/bigheader", do_host_big_header); + g_test_add_func ("/misc/host", do_host_test); ++ g_test_add_func ("/misc/method-injection", do_method_injection_test); + g_test_add_func ("/misc/callback-unref/msg", do_callback_unref_test); + g_test_add_func ("/misc/callback-unref/req", do_callback_unref_req_test); + g_test_add_func ("/misc/msg-reuse", do_msg_reuse_test); +-- +2.55.0 + diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb index c79bced69d..19a2d96b91 100644 --- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb +++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.3.bb @@ -45,6 +45,10 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \ file://CVE-2026-1801.patch \ file://CVE-2026-2443.patch \ file://CVE-2026-5119.patch \ + file://CVE-2026-3633-1.patch \ + file://CVE-2026-3633-2.patch \ + file://CVE-2026-3633-3.patch \ + file://CVE-2026-3633-4.patch \ " SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13"