From e4887758a0e966ae399cdef03597f5460b1e77be Mon Sep 17 00:00:00 2001 From: wangzhe Date: Fri, 31 Jan 2025 09:58:45 +0800 Subject: [PATCH 1/2] [CVE] update to libsoup-2.62.3-7.src.rpm for CVE-2024-52531 to #bug16740 update to libsoup-2.62.3-7.src.rpm for CVE-2024-52531 Project: TC2024080204 Signed-off-by: wangzhe --- ...robust-against-invalid-input-when-pa.patch | 121 ++++++++++++++++++ libsoup.spec | 26 +--- 2 files changed, 128 insertions(+), 19 deletions(-) create mode 100644 0001-headers-Be-more-robust-against-invalid-input-when-pa.patch diff --git a/0001-headers-Be-more-robust-against-invalid-input-when-pa.patch b/0001-headers-Be-more-robust-against-invalid-input-when-pa.patch new file mode 100644 index 0000000..daa2730 --- /dev/null +++ b/0001-headers-Be-more-robust-against-invalid-input-when-pa.patch @@ -0,0 +1,121 @@ +From bbeb7d59f98d0073291ca4a7ee9ce1a946842734 Mon Sep 17 00:00:00 2001 +From: Patrick Griffis +Date: Tue, 27 Aug 2024 13:53:26 -0500 +Subject: [PATCH] headers: Be more robust against invalid input when parsing + params + +If you pass invalid input to a function such as soup_header_parse_param_list_strict() +it can cause an overflow if it decodes the input to UTF-8. + +This should never happen with valid UTF-8 input which libsoup's client API +ensures, however it's server API does not currently. +--- + libsoup/soup-headers.c | 46 +++++++++++++++++++++--------------------- + 1 file changed, 23 insertions(+), 23 deletions(-) + +diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c +index 271d2a63..8657483f 100644 +--- a/libsoup/soup-headers.c ++++ b/libsoup/soup-headers.c +@@ -650,8 +650,9 @@ soup_header_contains (const char *header, const char *token) + } + + static void +-decode_quoted_string (char *quoted_string) ++decode_quoted_string_inplace (GString *quoted_gstring) + { ++ char *quoted_string = quoted_gstring->str; + char *src, *dst; + + src = quoted_string + 1; +@@ -665,10 +666,11 @@ decode_quoted_string (char *quoted_string) + } + + static gboolean +-decode_rfc5987 (char *encoded_string) ++decode_rfc5987_inplace (GString *encoded_gstring) + { + char *q, *decoded; + gboolean iso_8859_1 = FALSE; ++ const char *encoded_string = encoded_gstring->str; + + q = strchr (encoded_string, '\''); + if (!q) +@@ -697,14 +699,7 @@ decode_rfc5987 (char *encoded_string) + decoded = utf8; + } + +- /* If encoded_string was UTF-8, then each 3-character %-escape +- * will be converted to a single byte, and so decoded is +- * shorter than encoded_string. If encoded_string was +- * iso-8859-1, then each 3-character %-escape will be +- * converted into at most 2 bytes in UTF-8, and so it's still +- * shorter. +- */ +- strcpy (encoded_string, decoded); ++ g_string_assign (encoded_gstring, decoded); + g_free (decoded); + return TRUE; + } +@@ -714,15 +709,17 @@ parse_param_list (const char *header, char delim) + { + GHashTable *params; + GSList *list, *iter; +- char *item, *eq, *name_end, *value; +- gboolean override; + + params = g_hash_table_new_full (soup_str_case_hash, + soup_str_case_equal, +- g_free, NULL); ++ g_free, g_free); + + list = parse_list (header, delim); + for (iter = list; iter; iter = iter->next) { ++ char *item, *eq, *name_end; ++ gboolean override, duplicated; ++ GString *parsed_value = NULL; ++ + item = iter->data; + override = FALSE; + +@@ -737,24 +734,27 @@ parse_param_list (const char *header, char delim) + + *name_end = '\0'; + +- value = (char *)skip_lws (eq + 1); ++ parsed_value = g_string_new ((char *)skip_lws (eq + 1)); + + if (name_end[-1] == '*' && name_end > item + 1) { + name_end[-1] = '\0'; +- if (!decode_rfc5987 (value)) { ++ if (!decode_rfc5987_inplace (parsed_value)) { ++ g_string_free (parsed_value, TRUE); + g_free (item); + continue; + } + override = TRUE; +- } else if (*value == '"') +- decode_quoted_string (value); +- } else +- value = NULL; +- +- if (override || !g_hash_table_lookup (params, item)) +- g_hash_table_replace (params, item, value); +- else ++ } else if (parsed_value->str[0] == '"') ++ decode_quoted_string_inplace (parsed_value); ++ } ++ ++ if (override || !g_hash_table_lookup (params, item)) { ++ g_hash_table_replace (params, item, parsed_value ? g_string_free (parsed_value, FALSE) : NULL); ++ } else { ++ if (parsed_value) ++ g_string_free (parsed_value, TRUE); + g_free (item); ++ } + } + + g_slist_free (list); +-- +2.48.1 + diff --git a/libsoup.spec b/libsoup.spec index b2558eb..4048110 100644 --- a/libsoup.spec +++ b/libsoup.spec @@ -1,9 +1,8 @@ -%define anolis_release .0.1 %define glib2_version 2.38.0 Name: libsoup Version: 2.62.3 -Release: 6%{anolis_release}%{?dist} +Release: 7%{?dist} Summary: Soup, an HTTP library implementation License: LGPLv2 @@ -17,6 +16,7 @@ Patch0004: 0004-ntlmv2.patch Patch0005: 0005-WebSockets-do-not-start-the-input-source-when-IO-is-closing.patch Patch0006: 0001-headers-Strictly-don-t-allow-NUL-bytes.patch Patch0007: 0001-websocket-process-the-frame-as-soon-as-we-read-data.patch +Patch0008: 0001-headers-Be-more-robust-against-invalid-input-when-pa.patch BuildRequires: chrpath BuildRequires: glib2-devel >= %{glib2_version} @@ -32,9 +32,6 @@ BuildRequires: vala Requires: glib2%{?_isa} >= %{glib2_version} Requires: glib-networking%{?_isa} >= %{glib2_version} -Requires: glibc -Requires: libxml2 - %description Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but @@ -54,14 +51,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release} Libsoup is an HTTP library implementation in C. This package allows you to develop applications that use the libsoup library. -%package doc -Summary: Documents for %{name} -BuildArch: noarch -Requires: %{name} = %{version}-%{release} - -%description doc -Doc pages for %{name}. - %prep %autosetup -p1 @@ -85,6 +74,7 @@ chrpath --delete $RPM_BUILD_ROOT%{_libdir}/*.so %files -f libsoup.lang %license COPYING +%doc README NEWS AUTHORS %{_libdir}/lib*.so.* %{_libdir}/girepository-1.0/Soup*2.4.typelib @@ -100,16 +90,14 @@ chrpath --delete $RPM_BUILD_ROOT%{_libdir}/*.so %{_datadir}/vala/vapi/libsoup-2.4.deps %{_datadir}/vala/vapi/libsoup-2.4.vapi -%files doc -%doc README NEWS AUTHORS - %changelog -* Thu Nov 14 2024 Weisson - 2.62.3-6.0.1 -- Add doc sub package +* Tue Jan 28 2025 Michael Catanzaro - 2.62.3-7 +- Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict + Resolves: RHEL-76376 * Tue Nov 12 2024 Tomas Popela - 2.62.3-6 - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names -- Backport upstream patch for CVE-2024-52530 - infinite loop while reading websocket data +- Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data - Resolves: RHEL-67076 - Resolves: RHEL-67067 -- Gitee From 9929ae4663de76804446a2f99380c0bb2d5de01b Mon Sep 17 00:00:00 2001 From: Weisson Date: Mon, 18 Jul 2022 10:59:52 +0800 Subject: [PATCH 2/2] spec: add doc sub package Signed-off-by: Weisson --- libsoup.spec | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/libsoup.spec b/libsoup.spec index 4048110..c683804 100644 --- a/libsoup.spec +++ b/libsoup.spec @@ -1,8 +1,9 @@ +%define anolis_release .0.1 %define glib2_version 2.38.0 Name: libsoup Version: 2.62.3 -Release: 7%{?dist} +Release: 7%{anolis_release}%{?dist} Summary: Soup, an HTTP library implementation License: LGPLv2 @@ -32,6 +33,9 @@ BuildRequires: vala Requires: glib2%{?_isa} >= %{glib2_version} Requires: glib-networking%{?_isa} >= %{glib2_version} +Requires: glibc +Requires: libxml2 + %description Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but @@ -51,6 +55,14 @@ Requires: %{name}%{?_isa} = %{version}-%{release} Libsoup is an HTTP library implementation in C. This package allows you to develop applications that use the libsoup library. +%package doc +Summary: Documents for %{name} +BuildArch: noarch +Requires: %{name} = %{version}-%{release} + +%description doc +Doc pages for %{name}. + %prep %autosetup -p1 @@ -74,7 +86,6 @@ chrpath --delete $RPM_BUILD_ROOT%{_libdir}/*.so %files -f libsoup.lang %license COPYING -%doc README NEWS AUTHORS %{_libdir}/lib*.so.* %{_libdir}/girepository-1.0/Soup*2.4.typelib @@ -90,7 +101,13 @@ chrpath --delete $RPM_BUILD_ROOT%{_libdir}/*.so %{_datadir}/vala/vapi/libsoup-2.4.deps %{_datadir}/vala/vapi/libsoup-2.4.vapi +%files doc +%doc README NEWS AUTHORS + %changelog +* Fri Jan 31 2025 Weisson - 2.62.3-7.0.1 +- Add doc sub package + * Tue Jan 28 2025 Michael Catanzaro - 2.62.3-7 - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict Resolves: RHEL-76376 -- Gitee