public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/libsoup3] f43: Fix CVE-2026-0719, CVE-2026-4271, CVE-2026-12478
@ 2026-08-14 13:38 Luigi Pavan
0 siblings, 0 replies; only message in thread
From: Luigi Pavan @ 2026-08-14 13:38 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/libsoup3
Branch : f43
Commit : 235237afa16fc27ceb867c2a9e7eaaab51d73f96
Author : Luigi Pavan <lpavan@redhat.com>
Date : 2026-08-14T10:40:13+02:00
Stats : +702/-0 in 4 file(s)
URL : https://src.fedoraproject.org/rpms/libsoup3/c/235237afa16fc27ceb867c2a9e7eaaab51d73f96?branch=f43
Log:
Fix CVE-2026-0719, CVE-2026-4271, CVE-2026-12478
Backport 3 upstream fixes:
- CVE-2026-0719: Arbitrary code execution via stack-based buffer overflow
in NTLM authentication (rhbz#2427911)
- CVE-2026-4271: Denial of Service via Use-After-Free in HTTP/2 server
(rhbz#2448046)
- CVE-2026-12478: Incomplete fix for CVE-2026-0716, out-of-bounds read
in WebSocket frame processing for unmasked frames (rhbz#2499921)
Assisted-by: Cursor
---
diff --git a/0003-CVE-2026-0719-soup-auth-ntlm-Reject-excessively-long-passwords.patch b/0003-CVE-2026-0719-soup-auth-ntlm-Reject-excessively-long-passwords.patch
new file mode 100644
index 0000000..0e9a0f6
--- /dev/null
+++ b/0003-CVE-2026-0719-soup-auth-ntlm-Reject-excessively-long-passwords.patch
@@ -0,0 +1,188 @@
+From f86c5e0b8a3c1dac42a1b60c13ee4bf299b9bf05 Mon Sep 17 00:00:00 2001
+From: Mike Gorse <mgorse@suse.com>
+Date: Thu, 8 Jan 2026 16:19:37 -0600
+Subject: [PATCH] soup-auth-ntlm: Reject excessively long passwords
+
+According to
+https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/ntlm-user-authentication,
+the practical limit for a NTLM password is 128 Unicode characters, so it
+should be safe to reject passwords longer than 256 bytes. Previously,
+md4sum could overflow and cause an out-of-bounds memory access if an
+extremely long password was provided. Also update md4sum to use unsigned
+variables for size-related calculations, as a precaution.
+
+This is CVE-2026-0719.
+
+Closes #477.
+---
+ libsoup/auth/soup-auth-ntlm.c | 28 ++++++++++++-----
+ tests/ntlm-test.c | 59 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 80 insertions(+), 7 deletions(-)
+
+diff --git a/libsoup/auth/soup-auth-ntlm.c b/libsoup/auth/soup-auth-ntlm.c
+index b3f5327e..09e4d01d 100644
+--- a/libsoup/auth/soup-auth-ntlm.c
++++ b/libsoup/auth/soup-auth-ntlm.c
+@@ -309,6 +309,7 @@ soup_auth_ntlm_update_connection (SoupConnectionAuth *auth, SoupMessage *msg,
+ gboolean success = TRUE;
+ GUri *uri;
+ char *authority;
++ static const guchar zero_hash[21] = { 0 };
+
+ /* Note that we only return FALSE if some sort of parsing error
+ * occurs. Otherwise, the SoupAuth is still reusable (though it may
+@@ -355,6 +356,14 @@ soup_auth_ntlm_update_connection (SoupConnectionAuth *auth, SoupMessage *msg,
+ return FALSE;
+ }
+
++ if (priv->password_state == SOUP_NTLM_PASSWORD_PROVIDED && !memcmp(priv->nt_hash, zero_hash, sizeof(zero_hash))) {
++ /* This can happen if an excessively long password was
++ * provided, in which case we don't try to hash */
++ conn->state = SOUP_NTLM_FAILED;
++ priv->password_state = SOUP_NTLM_PASSWORD_REJECTED;
++ return TRUE;
++ }
++
+ if (!soup_ntlm_parse_challenge (auth_header + 5, &conn->nonce,
+ priv->domain ? NULL : &priv->domain,
+ &conn->ntlmv2_session, &conn->negotiate_target,
+@@ -449,8 +458,10 @@ soup_auth_ntlm_authenticate (SoupAuth *auth, const char *username,
+ priv->username = g_strdup (username);
+ }
+
+- soup_ntlm_nt_hash (password, priv->nt_hash);
+- soup_ntlm_lanmanager_hash (password, priv->lm_hash);
++ if (strlen (password) < 256) {
++ soup_ntlm_nt_hash (password, priv->nt_hash);
++ soup_ntlm_lanmanager_hash (password, priv->lm_hash);
++ }
+
+ priv->password_state = SOUP_NTLM_PASSWORD_PROVIDED;
+ }
+@@ -616,7 +627,7 @@ soup_auth_ntlm_class_init (SoupAuthNTLMClass *auth_ntlm_class)
+ }
+
+ static void md4sum (const unsigned char *in,
+- int nbytes,
++ size_t nbytes,
+ unsigned char digest[16]);
+
+ typedef guint32 DES_KS[16][2]; /* Single-key DES key schedule */
+@@ -662,7 +673,7 @@ soup_ntlm_nt_hash (const char *password, guchar hash[21])
+ {
+ unsigned char *buf, *p;
+
+- p = buf = g_malloc (strlen (password) * 2);
++ p = buf = g_malloc_n (strlen (password), 2);
+
+ while (*password) {
+ *p++ = *password++;
+@@ -1104,15 +1115,16 @@ calc_response (const guchar *key, const guchar *plaintext, guchar *results)
+ #define ROT(val, n) ( ((val) << (n)) | ((val) >> (32 - (n))) )
+
+ static void
+-md4sum (const unsigned char *in, int nbytes, unsigned char digest[16])
++md4sum (const unsigned char *in, size_t nbytes, unsigned char digest[16])
+ {
+ unsigned char *M;
+ guint32 A, B, C, D, AA, BB, CC, DD, X[16];
+- int pbytes, nbits = nbytes * 8, i, j;
++ size_t pbytes, nbits = nbytes * 8;
++ int i, j;
+
+ /* There is *always* padding of at least one bit. */
+ pbytes = ((119 - (nbytes % 64)) % 64) + 1;
+- M = alloca (nbytes + pbytes + 8);
++ M = g_malloc (nbytes + pbytes + 8);
+ memcpy (M, in, nbytes);
+ memset (M + nbytes, 0, pbytes + 8);
+ M[nbytes] = 0x80;
+@@ -1212,6 +1224,8 @@ md4sum (const unsigned char *in, int nbytes, unsigned char digest[16])
+ digest[13] = (D >> 8) & 0xFF;
+ digest[14] = (D >> 16) & 0xFF;
+ digest[15] = (D >> 24) & 0xFF;
++
++ g_free (M);
+ }
+
+
+diff --git a/tests/ntlm-test.c b/tests/ntlm-test.c
+index 18f13a7d..327153c5 100644
+--- a/tests/ntlm-test.c
++++ b/tests/ntlm-test.c
+@@ -735,6 +735,62 @@ do_retrying_test (TestServer *ts,
+ soup_test_session_abort_unref (session);
+ }
+
++static gboolean
++long_password_test_authenticate (SoupMessage *msg,
++ SoupAuth *auth,
++ gboolean retrying,
++ gpointer user)
++{
++ size_t l = 65536;
++ char *password;
++ char tmp[10000];
++ size_t i;
++
++ password = (char *)g_malloc (l);
++
++ for (i = 0; i < 10000; i++) {
++ tmp[i] = 'A';
++ }
++ for (i = 0; i < l/10000; i++) {
++ memcpy (password + i * 10000, tmp, 10000);
++ }
++ memcpy (password + l - 1 - 10000, tmp, 10000);
++
++ soup_auth_authenticate (auth, "alice", password);
++
++ g_free (password);
++ return TRUE;
++}
++
++static void
++do_long_password_test (TestServer *ts,
++ gconstpointer data)
++{
++ SoupSession *session;
++ SoupMessage *msg;
++ GUri *uri;
++ GBytes *body;
++
++ session = soup_test_session_new (NULL);
++ soup_session_add_feature_by_type (session, SOUP_TYPE_AUTH_NTLM);
++ soup_session_set_proxy_resolver(session, NULL);
++
++ uri = g_uri_parse_relative (ts->uri, "/alice", SOUP_HTTP_URI_FLAGS, NULL);
++ msg = soup_message_new_from_uri ("GET", uri);
++ g_signal_connect (msg, "authenticate",
++ G_CALLBACK (long_password_test_authenticate), NULL);
++ g_uri_unref (uri);
++
++ body = soup_session_send_and_read (session, msg, NULL, NULL);
++
++ soup_test_assert_message_status (msg, SOUP_STATUS_UNAUTHORIZED);
++
++ g_bytes_unref (body);
++ g_object_unref (msg);
++
++ soup_test_session_abort_unref (session);
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -758,6 +814,9 @@ main (int argc, char **argv)
+ g_test_add ("/ntlm/retry", TestServer, NULL,
+ setup_server, do_retrying_test, teardown_server);
+
++ g_test_add ("/ntlm/long-password", TestServer, NULL,
++ setup_server, do_long_password_test, teardown_server);
++
+ ret = g_test_run ();
+
+ test_cleanup ();
+--
+2.54.0
+
diff --git a/0004-CVE-2026-4271-server-protect-message-io-while-reading-and-writing.patch b/0004-CVE-2026-4271-server-protect-message-io-while-reading-and-writing.patch
new file mode 100644
index 0000000..3fcd971
--- /dev/null
+++ b/0004-CVE-2026-4271-server-protect-message-io-while-reading-and-writing.patch
@@ -0,0 +1,361 @@
+From a333e91403a0e2f8fdf7b47594e069573e5c1859 Mon Sep 17 00:00:00 2001
+From: Carlos Garcia Campos <cgarcia@igalia.com>
+Date: Mon, 16 Feb 2026 12:09:08 +0100
+Subject: [PATCH] server: protect message io while reading and writing
+
+Ensure the nghttp2 session is not destroyed while being used.
+
+Closes #496
+---
+ .../http2/soup-server-message-io-http2.c | 117 +++++++++++++-----
+ tests/http2-test.c | 54 ++++++++
+ 2 files changed, 141 insertions(+), 30 deletions(-)
+
+diff --git a/libsoup/server/http2/soup-server-message-io-http2.c b/libsoup/server/http2/soup-server-message-io-http2.c
+index 913afb46..6f8d1bb6 100644
+--- a/libsoup/server/http2/soup-server-message-io-http2.c
++++ b/libsoup/server/http2/soup-server-message-io-http2.c
+@@ -69,6 +69,8 @@ typedef struct {
+ GHashTable *messages;
+
+ guint in_callback;
++ guint protected;
++ gboolean destroyed;
+ } SoupServerMessageIOHTTP2;
+
+ static void soup_server_message_io_http2_send_response (SoupServerMessageIOHTTP2 *io,
+@@ -146,6 +148,8 @@ soup_server_message_io_http2_destroy (SoupServerMessageIO *iface)
+ {
+ SoupServerMessageIOHTTP2 *io = (SoupServerMessageIOHTTP2 *)iface;
+
++ io->destroyed = TRUE;
++
+ if (io->read_source) {
+ g_source_destroy (io->read_source);
+ g_source_unref (io->read_source);
+@@ -160,10 +164,14 @@ soup_server_message_io_http2_destroy (SoupServerMessageIO *iface)
+ }
+
+ g_clear_object (&io->iostream);
+- g_clear_pointer (&io->session, nghttp2_session_del);
+- g_clear_pointer (&io->messages, g_hash_table_unref);
++ io->istream = NULL;
++ io->ostream = NULL;
+
+- g_free (io);
++ if (io->protected == 0) {
++ g_clear_pointer (&io->session, nghttp2_session_del);
++ g_clear_pointer (&io->messages, g_hash_table_unref);
++ g_free (io);
++ }
+ }
+
+ static void
+@@ -321,7 +329,33 @@ static const SoupServerMessageIOFuncs io_funcs = {
+ soup_server_message_io_http2_is_paused
+ };
+
++static void
++soup_server_message_io_http2_protect (SoupServerMessageIOHTTP2 *io)
++{
++ io->protected++;
++ g_object_ref (io->conn);
++}
++
+ static gboolean
++soup_server_message_io_http2_unprotect (SoupServerMessageIOHTTP2 *io)
++{
++ g_object_unref (io->conn);
++
++ if (--io->protected > 0)
++ return FALSE;
++
++ if (io->destroyed) {
++ g_clear_pointer (&io->session, nghttp2_session_del);
++ g_clear_pointer (&io->messages, g_hash_table_unref);
++ g_free (io);
++
++ return TRUE;
++ }
++
++ return FALSE;
++}
++
++static void
+ io_write (SoupServerMessageIOHTTP2 *io,
+ GError **error)
+ {
+@@ -336,51 +370,57 @@ io_write (SoupServerMessageIOHTTP2 *io,
+ if (io->write_buffer_size == 0) {
+ /* Done */
+ io->write_buffer = NULL;
+- return TRUE;
++ return;
+ }
+ }
+
++ if (!io->ostream)
++ return;
++
+ gssize ret = g_pollable_stream_write (io->ostream,
+ io->write_buffer + io->written_bytes,
+ io->write_buffer_size - io->written_bytes,
+ FALSE, NULL, error);
+- if (ret < 0)
+- return FALSE;
+-
+- io->written_bytes += ret;
+- return TRUE;
++ if (ret > 0)
++ io->written_bytes += ret;
+ }
+
+ static gboolean
+ io_write_ready (GObject *stream,
+ SoupServerMessageIOHTTP2 *io)
+ {
+- SoupServerConnection *conn = io->conn;
+ GError *error = NULL;
+
+- g_object_ref (conn);
++ soup_server_message_io_http2_protect (io);
++
++ while (!error) {
++ if (io->destroyed)
++ break;
++
++ if (!nghttp2_session_want_write (io->session))
++ break;
+
+- while (!error && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && nghttp2_session_want_write (io->session))
+ io_write (io, &error);
++ }
+
+ if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) {
+ g_error_free (error);
+- g_object_unref (conn);
++ soup_server_message_io_http2_unprotect (io);
+ return G_SOURCE_CONTINUE;
+ }
+
+- if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++ if (!io->destroyed) {
+ if (error)
+ h2_debug (io, NULL, "[SESSION] IO error: %s", error->message);
+
+ g_clear_pointer (&io->write_source, g_source_unref);
+
+ if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session)))
+- soup_server_connection_disconnect (conn);
++ soup_server_connection_disconnect (io->conn);
+ }
+
+ g_clear_error (&error);
+- g_object_unref (conn);
++ soup_server_message_io_http2_unprotect (io);
+
+ return G_SOURCE_REMOVE;
+ }
+@@ -390,13 +430,12 @@ static gboolean io_write_idle_cb (SoupServerMessageIOHTTP2* io);
+ static void
+ io_try_write (SoupServerMessageIOHTTP2 *io)
+ {
+- SoupServerConnection *conn = io->conn;
+ GError *error = NULL;
+
+ if (io->write_source)
+ return;
+
+- if (io->in_callback && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++ if (io->in_callback && !io->destroyed) {
+ if (!nghttp2_session_want_write (io->session))
+ return;
+
+@@ -416,12 +455,19 @@ io_try_write (SoupServerMessageIOHTTP2 *io)
+ g_clear_pointer (&io->write_idle_source, g_source_unref);
+ }
+
+- g_object_ref (conn);
++ soup_server_message_io_http2_protect (io);
++
++ while (!error) {
++ if (io->destroyed)
++ break;
++
++ if (!nghttp2_session_want_write (io->session))
++ break;
+
+- while (!error && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && !io->in_callback && nghttp2_session_want_write (io->session))
+ io_write (io, &error);
++ }
+
+- if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++ if (!io->destroyed) {
+ if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) {
+ g_clear_error (&error);
+ io->write_source = g_pollable_output_stream_create_source (G_POLLABLE_OUTPUT_STREAM (io->ostream), NULL);
+@@ -434,11 +480,11 @@ io_try_write (SoupServerMessageIOHTTP2 *io)
+ h2_debug (io, NULL, "[SESSION] IO error: %s", error->message);
+
+ if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session)))
+- soup_server_connection_disconnect (conn);
++ soup_server_connection_disconnect (io->conn);
+ }
+
+ g_clear_error (&error);
+- g_object_unref (conn);
++ soup_server_message_io_http2_unprotect (io);
+ }
+
+ static gboolean
+@@ -481,31 +527,37 @@ static gboolean
+ io_read_ready (GObject *stream,
+ SoupServerMessageIOHTTP2 *io)
+ {
+- SoupServerConnection *conn = io->conn;
+ gboolean progress = TRUE;
+ GError *error = NULL;
+
+- g_object_ref (conn);
++ soup_server_message_io_http2_protect (io);
++
++ while (progress) {
++ if (io->destroyed)
++ break;
++
++ if (!nghttp2_session_want_read (io->session))
++ break;
+
+- while (progress && soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io && nghttp2_session_want_read (io->session))
+ progress = io_read (io, &error);
++ }
+
+ if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK)) {
+ g_error_free (error);
+- g_object_unref (conn);
++ soup_server_message_io_http2_unprotect (io);
+ return G_SOURCE_CONTINUE;
+ }
+
+- if (soup_server_connection_get_io_data (conn) == (SoupServerMessageIO *)io) {
++ if (!io->destroyed) {
+ if (error)
+ h2_debug (io, NULL, "[SESSION] IO error: %s", error->message);
+
+ if (error || (!nghttp2_session_want_read (io->session) && !nghttp2_session_want_write (io->session)))
+- soup_server_connection_disconnect (conn);
++ soup_server_connection_disconnect (io->conn);
+ }
+
+ g_clear_error (&error);
+- g_object_unref (conn);
++ soup_server_message_io_http2_unprotect (io);
+
+ return G_SOURCE_REMOVE;
+ }
+@@ -931,5 +983,10 @@ soup_server_message_io_http2_new (SoupServerConnection *conn,
+ nghttp2_submit_settings (io->session, NGHTTP2_FLAG_NONE, settings, G_N_ELEMENTS (settings));
+ io_try_write (io);
+
++#ifdef __clang_analyzer__
++ // Suppress false positive about io being destroyed here, since at this point we have only
++ // send the initial settings and not callback is called.
++ [[clang::suppress]]
++#endif
+ return (SoupServerMessageIO *)io;
+ }
+diff --git a/tests/http2-test.c b/tests/http2-test.c
+index e49e0068..0e1e1d63 100644
+--- a/tests/http2-test.c
++++ b/tests/http2-test.c
+@@ -1268,6 +1268,40 @@ do_broken_pseudo_header_test (Test *test, gconstpointer data)
+ g_uri_unref (uri);
+ }
+
++static void
++disconnect_on_got_headers (SoupServerMessage *msg, gpointer user_data)
++{
++ GUri *uri;
++ SoupServerConnection *conn;
++
++ uri = soup_server_message_get_uri (msg);
++ if (!g_str_equal (g_uri_get_path (uri), "/close-on-got-headers"))
++ return;
++
++ conn = soup_server_message_get_connection (msg);
++ soup_server_connection_disconnect (conn);
++}
++
++static void
++do_server_disconnect_on_got_headers_test (Test *test, gconstpointer data)
++{
++ SoupMessage *msg;
++ GUri *uri;
++ GBytes *response;
++ GError *error = NULL;
++
++ uri = g_uri_parse_relative (base_uri, "/close-on-got-headers", SOUP_HTTP_URI_FLAGS, NULL);
++ msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri);
++
++ response = soup_test_session_async_send (test->session, msg, NULL, &error);
++ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_PARTIAL_INPUT);
++
++ g_clear_error (&error);
++ g_bytes_unref (response);
++ g_object_unref (msg);
++ g_uri_unref (uri);
++}
++
+ static gboolean
+ unpause_message (SoupServerMessage *msg)
+ {
+@@ -1396,12 +1430,26 @@ server_handler (SoupServer *server,
+ shutdown (fd, SHUT_WR);
+ #endif
+
++ soup_server_message_set_response (msg, "text/plain",
++ SOUP_MEMORY_STATIC,
++ "Success!", 8);
++ } else if (strcmp (path, "/close-on-got-headers") == 0) {
+ soup_server_message_set_response (msg, "text/plain",
+ SOUP_MEMORY_STATIC,
+ "Success!", 8);
+ }
+ }
+
++static void
++server_request_started (SoupServer *server,
++ SoupServerMessage *msg,
++ SoupServerConnection *conn,
++ gpointer user_data)
++{
++ g_signal_connect (msg, "got-headers",
++ G_CALLBACK (disconnect_on_got_headers), NULL);
++}
++
+ static gboolean
+ server_basic_auth_callback (SoupAuthDomain *auth_domain,
+ SoupServerMessage *msg,
+@@ -1428,6 +1476,8 @@ main (int argc, char **argv)
+ return 0;
+
+ server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD | SOUP_TEST_SERVER_HTTP2);
++ g_signal_connect (server, "request-started",
++ G_CALLBACK (server_request_started), NULL);
+ auth = soup_auth_domain_basic_new ("realm", "http2-test",
+ "auth-callback", server_basic_auth_callback,
+ NULL);
+@@ -1584,6 +1634,10 @@ main (int argc, char **argv)
+ setup_session,
+ do_broken_pseudo_header_test,
+ teardown_session);
++ g_test_add ("/http2/server-disconnect-on-got-headers", Test, NULL,
++ setup_session,
++ do_server_disconnect_on_got_headers_test,
++ teardown_session);
+
+ ret = g_test_run ();
+
+--
+2.54.0
+
diff --git a/0005-CVE-2026-12478-websocket-Fix-out-of-bounds-read-when-reading-unmasked-frame.patch b/0005-CVE-2026-12478-websocket-Fix-out-of-bounds-read-when-reading-unmasked-frame.patch
new file mode 100644
index 0000000..39d2fd4
--- /dev/null
+++ b/0005-CVE-2026-12478-websocket-Fix-out-of-bounds-read-when-reading-unmasked-frame.patch
@@ -0,0 +1,144 @@
+From 6797eb3ea57819163d842bbc6d8c0509c67909a2 Mon Sep 17 00:00:00 2001
+From: Mike Gorse <mgorse@suse.com>
+Date: Tue, 3 Mar 2026 21:39:35 -0600
+Subject: [PATCH] websocket: Fix out-of-bounds read when reading unmasked frame
+
+The original fix for CVE-2026-0716 was incomplete; the same out-of-bounds
+read can occur if a server sends a malicious unmasked frame to the client.
+
+Closes #476
+---
+ libsoup/websocket/soup-websocket-connection.c | 12 ++--
+ tests/websocket-test.c | 63 +++++++++++++++++--
+ 2 files changed, 63 insertions(+), 12 deletions(-)
+
+diff --git a/libsoup/websocket/soup-websocket-connection.c b/libsoup/websocket/soup-websocket-connection.c
+index 36e84596..5f04e321 100644
+--- a/libsoup/websocket/soup-websocket-connection.c
++++ b/libsoup/websocket/soup-websocket-connection.c
+@@ -1120,17 +1120,17 @@ process_frame (SoupWebsocketConnection *self)
+
+ payload = header + at;
+
++ /* at has a maximum value of 10 + 4 = 14 */
++ if (payload_len > G_MAXSIZE - 14) {
++ bad_data_error_and_close (self);
++ return FALSE;
++ }
++
+ if (masked) {
+ mask = header + at;
+ payload += 4;
+ at += 4;
+
+- /* at has a maximum value of 10 + 4 = 14 */
+- if (payload_len > G_MAXSIZE - 14) {
+- bad_data_error_and_close (self);
+- return FALSE;
+- }
+-
+ if (len < at + payload_len)
+ return FALSE; /* need more data */
+
+diff --git a/tests/websocket-test.c b/tests/websocket-test.c
+index c9246015..b15ea978 100644
+--- a/tests/websocket-test.c
++++ b/tests/websocket-test.c
+@@ -2181,7 +2181,7 @@ test_fragment_assembly_corruption (Test *test, gconstpointer data)
+ }
+
+ static void
+-test_cve_2026_0716 (Test *test,
++test_bad_length_masked (Test *test,
+ gconstpointer unused)
+ {
+ GError *error = NULL;
+@@ -2198,7 +2198,7 @@ test_cve_2026_0716 (Test *test,
+
+ soup_websocket_connection_set_max_incoming_payload_size (test->server, 0);
+
+- // Malicious masked frame header (10-byte header + 4-byte mask) */
++ /* Malicious masked frame header (10-byte header + 4-byte mask) */
+ frame = "\x82\xff\xff\xff\xff\xff\xff\xff\xff\xf6\xaa\xbb\xcc\xdd";
+ if (!g_output_stream_write_all (g_io_stream_get_output_stream (io),
+ frame, 14, &written, NULL, NULL))
+@@ -2215,6 +2215,53 @@ test_cve_2026_0716 (Test *test,
+ g_assert_cmpuint (soup_websocket_connection_get_close_code (test->client), ==, SOUP_WEBSOCKET_CLOSE_BAD_DATA);
+ }
+
++static gpointer
++send_bad_length_frame_server_thread (gpointer user_data)
++{
++ Test *test = user_data;
++ const char frame[] = "\x82\x7f\xff\xff\xff\xff\xff\xff\xff\xf6";
++ gsize written;
++ GError *error = NULL;
++
++ g_output_stream_write_all (g_io_stream_get_output_stream (test->raw_server),
++ frame, sizeof (frame), &written, NULL, &error);
++ g_assert_no_error (error);
++ g_assert_cmpuint (written, ==, sizeof (frame));
++
++ g_io_stream_close (test->raw_server, NULL, &error);
++ g_assert_no_error (error);
++
++ return NULL;
++}
++
++static void
++test_bad_length_unmasked (Test *test,
++ gconstpointer unused)
++{
++ GThread *thread;
++ GBytes *received = NULL;
++ GError *error = NULL;
++
++ g_signal_connect (test->client, "error", G_CALLBACK (on_error_copy), &error);
++ g_signal_connect (test->client, "message", G_CALLBACK (on_binary_message), &received);
++
++ soup_websocket_connection_set_max_incoming_payload_size (test->client, 0);
++
++ thread = g_thread_new ("send-bad-length-frame-thread", send_bad_length_frame_server_thread, test);
++
++ WAIT_UNTIL (error != NULL || received != NULL);
++ g_assert_error (error, SOUP_WEBSOCKET_ERROR, SOUP_WEBSOCKET_CLOSE_BAD_DATA);
++ g_clear_error (&error);
++ g_assert_null (received);
++
++ /* it can emit more errors while joining the thread, thus disconnect, to avoid memory leak */
++ g_signal_handlers_disconnect_by_func (test->client, G_CALLBACK (on_error_copy), &error);
++
++ g_thread_join (thread);
++
++ WAIT_UNTIL (soup_websocket_connection_get_state (test->client) == SOUP_WEBSOCKET_STATE_CLOSED);
++}
++
+ int
+ main (int argc,
+ char *argv[])
+@@ -2466,14 +2513,18 @@ main (int argc,
+ test_fragment_assembly_corruption,
+ teardown_direct_connection);
+
+- g_test_add ("/websocket/direct/cve-2026-0716", Test, NULL,
++ g_test_add ("/websocket/direct/bad-length-masked", Test, NULL,
+ setup_direct_connection,
+- test_cve_2026_0716,
++ test_bad_length_masked,
+ teardown_direct_connection);
+- g_test_add ("/websocket/soup/cve-2026-0716", Test, NULL,
++ g_test_add ("/websocket/soup/bad-length-masked", Test, NULL,
+ setup_soup_connection,
+- test_cve_2026_0716,
++ test_bad_length_masked,
+ teardown_soup_connection);
++ g_test_add ("/websocket/direct/bad-length-unmasked", Test, NULL,
++ setup_half_direct_connection,
++ test_bad_length_unmasked,
++ teardown_direct_connection);
+
+ ret = g_test_run ();
+
+--
+2.54.0
+
diff --git a/libsoup3.spec b/libsoup3.spec
index 3fdcd38..8b02c59 100644
--- a/libsoup3.spec
+++ b/libsoup3.spec
@@ -24,6 +24,15 @@ Patch: 0001-CVE-2026-1539-Also-remove-Proxy-Authorization-header-on-cross-orig
# https://bugzilla.redhat.com/show_bug.cgi?id=2452935
Patch: 0002-CVE-2026-5119-cookies-do-not-send-cookies-to-HTTP-proxy-for-HTTPS-request.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2427911
+Patch: 0003-CVE-2026-0719-soup-auth-ntlm-Reject-excessively-long-passwords.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2448046
+Patch: 0004-CVE-2026-4271-server-protect-message-io-while-reading-and-writing.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2499921
+Patch: 0005-CVE-2026-12478-websocket-Fix-out-of-bounds-read-when-reading-unmasked-frame.patch
+
BuildRequires: gcc
BuildRequires: gettext
BuildRequires: glib-networking >= %{glib2_version}
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-14 13:38 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-14 13:38 [rpms/libsoup3] f43: Fix CVE-2026-0719, CVE-2026-4271, CVE-2026-12478 Luigi Pavan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox