Star0
25
代码
代码
Issues15
Pull Requests1
项目讨论
Wiki
分析
Star0
25
已开启
fix CVE-2026-1801 #49
咸鱼.m创建于 2月6日
fix CVE-2026-1801 #49
已开启
咸鱼.m创建于 2月6日
从qq_37207042/libsoup3_1138openEuler-24.03-LTS-SP3合入到src-openeuler/libsoup3openEuler-24.03-LTS-SP3
共 2 个文件变更+194-1
Abackport-CVE-2026-1801.patch+186-0
@@ -0,0 +1,186 @@
1+From b9a1c0663ff8ab6e79715db4b35b54f560416ddd Mon Sep 17 00:00:00 2001
2+From: Carlos Garcia Campos <cgarcia@igalia.com>
3+Date: Thu, 29 Jan 2026 13:28:55 +0100
4+Subject: [PATCH] Use CRLF as line boundary when parsing chunked enconding data
5+ 
6+Closes #481
7+---
8+ libsoup/http1/soup-body-input-stream.c | 54 ++++++++++++++-------
9+ tests/server-test.c | 67 ++++++++++++++++++++++++++
10+ 2 files changed, 103 insertions(+), 18 deletions(-)
11+ 
12+diff --git a/libsoup/http1/soup-body-input-stream.c b/libsoup/http1/soup-body-input-stream.c
13+index 69a93c0..6bfa5e6 100644
14+--- a/libsoup/http1/soup-body-input-stream.c
15++++ b/libsoup/http1/soup-body-input-stream.c
16+@@ -176,15 +176,19 @@ soup_body_input_stream_read_chunked (SoupBodyInputStream *bistream,
17+ again:
18+ switch (priv->chunked_state) {
19+ case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_SIZE:
20+- nread = soup_filter_input_stream_read_line (
21+- fstream, metabuf, sizeof (metabuf), blocking,
22++ nread = soup_filter_input_stream_read_until (
23++ fstream, metabuf, sizeof (metabuf),
24++ "\r\n", 2, blocking, TRUE,
25+ &got_line, cancellable, error);
26+- if (nread <= 0)
27++ if (nread < 0)
28+ return nread;
29+- if (!got_line) {
30+- g_set_error_literal (error, G_IO_ERROR,
31+- G_IO_ERROR_PARTIAL_INPUT,
32+- _("Connection terminated unexpectedly"));
33++
34++ if (nread == 0 || !got_line) {
35++ if (error && *error == NULL) {
36++ g_set_error_literal (error, G_IO_ERROR,
37++ G_IO_ERROR_PARTIAL_INPUT,
38++ _("Connection terminated unexpectedly"));
39++ }
40+ return -1;
41+ }
42+
43+@@ -208,16 +212,20 @@ again:
44+ return nread;
45+
46+ case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_END:
47+- nread = soup_filter_input_stream_read_line (
48++ nread = soup_filter_input_stream_read_until (
49+ SOUP_FILTER_INPUT_STREAM (priv->base_stream),
50+- metabuf, sizeof (metabuf), blocking,
51++ metabuf, sizeof (metabuf),
52++ "\r\n", 2, blocking, TRUE,
53+ &got_line, cancellable, error);
54+- if (nread <= 0)
55++ if (nread < 0)
56+ return nread;
57+- if (!got_line) {
58+- g_set_error_literal (error, G_IO_ERROR,
59+- G_IO_ERROR_PARTIAL_INPUT,
60+- _("Connection terminated unexpectedly"));
61++
62++ if (nread == 0 || !got_line) {
63++ if (error && *error == NULL) {
64++ g_set_error_literal (error, G_IO_ERROR,
65++ G_IO_ERROR_PARTIAL_INPUT,
66++ _("Connection terminated unexpectedly"));
67++ }
68+ return -1;
69+ }
70+
71+@@ -225,13 +233,23 @@ again:
72+ break;
73+
74+ case SOUP_BODY_INPUT_STREAM_STATE_TRAILERS:
75+- nread = soup_filter_input_stream_read_line (
76+- fstream, metabuf, sizeof (metabuf), blocking,
77++ nread = soup_filter_input_stream_read_until (
78++ fstream, metabuf, sizeof (metabuf),
79++ "\r\n", 2, blocking, TRUE,
80+ &got_line, cancellable, error);
81+- if (nread <= 0)
82++ if (nread < 0)
83+ return nread;
84+
85+- if (strncmp (metabuf, "\r\n", nread) || strncmp (metabuf, "\n", nread)) {
86++ if (nread == 0 || !got_line) {
87++ if (error && *error == NULL) {
88++ g_set_error_literal (error, G_IO_ERROR,
89++ G_IO_ERROR_PARTIAL_INPUT,
90++ _("Connection terminated unexpectedly"));
91++ }
92++ return -1;
93++ }
94++
95++ if (nread == 2 && strncmp (metabuf, "\r\n", nread) == 0) {
96+ priv->chunked_state = SOUP_BODY_INPUT_STREAM_STATE_DONE;
97+ priv->eof = TRUE;
98+ }
99+diff --git a/tests/server-test.c b/tests/server-test.c
100+index 8d0c38b..32bad8e 100644
101+--- a/tests/server-test.c
102++++ b/tests/server-test.c
103+@@ -1355,6 +1355,71 @@ do_idle_connection_closed_test (ServerData *sd, gconstpointer test_data)
104+ g_main_context_iteration (NULL, FALSE);
105+ }
106+
107++static void
108++server_chunked_hundler (SoupServer *server,
109++ SoupServerMessage *msg,
110++ const char *path,
111++ GHashTable *query,
112++ gpointer data)
113++{
114++ g_assert_true (soup_server_message_get_method (msg) == SOUP_METHOD_POST);
115++ g_assert_cmpstr (path, ==, "/valid");
116++
117++ soup_server_message_set_status (msg, SOUP_STATUS_OK, NULL);
118++ soup_server_message_set_response (msg, "text/plain", SOUP_MEMORY_STATIC, "index", 5);
119++}
120++
121++#define CHUNKED_FORMAT_REQUEST "POST /valid HTTP/1.1\r\nHost: 127.0.0.1\r\n%sGET /invalid HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n"
122++
123++static void
124++do_chunked_test (ServerData *sd, gconstpointer test_data)
125++{
126++ gint i;
127++ struct {
128++ const char *description;
129++ const char *test;
130++ } tests[] = {
131++ { "Lone LF", "Transfer-Encoding: chunked\r\n\r\n5;ext\n data\r\n0\r\n\r\n" },
132++ };
133++
134++ sd->server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
135++ sd->base_uri = soup_test_server_get_uri (sd->server, "http", NULL);
136++ server_add_handler (sd, NULL, server_chunked_hundler, NULL, NULL);
137++
138++ for (i = 0; i < G_N_ELEMENTS (tests); i++) {
139++ GSocketClient *client;
140++ GSocketConnection *conn;
141++ GInputStream *input;
142++ GOutputStream *output;
143++ char *request;
144++ char buffer[4096];
145++ gssize nread;
146++ GError *error = NULL;
147++
148++ debug_printf (1, " %s\n", tests[i].description);
149++
150++ client = g_socket_client_new ();
151++ conn = g_socket_client_connect_to_host (client, g_uri_get_host (sd->base_uri), g_uri_get_port (sd->base_uri), NULL, &error);
152++ g_assert_no_error (error);
153++
154++ request = g_strdup_printf (CHUNKED_FORMAT_REQUEST, tests[i].test);
155++
156++ output = g_io_stream_get_output_stream (G_IO_STREAM (conn));
157++ g_output_stream_write_all (output, request, strlen (request), NULL, NULL, NULL);
158++ g_output_stream_close (output, NULL, NULL);
159++ g_socket_shutdown (g_socket_connection_get_socket (G_SOCKET_CONNECTION (conn)), FALSE, TRUE, &error);
160++
161++ input = g_io_stream_get_input_stream (G_IO_STREAM (conn));
162++ do {
163++ nread = g_input_stream_read (input, buffer, sizeof(buffer), NULL, NULL);
164++ } while (nread > 0);
165++
166++ g_free (request);
167++ g_object_unref (conn);
168++ g_object_unref (client);
169++ }
170++}
171++
172+ int
173+ main (int argc, char **argv)
174+ {
175+@@ -1395,6 +1460,8 @@ main (int argc, char **argv)
176+ server_setup_nohandler, do_early_multi_test, server_teardown);
177+ g_test_add ("/server/steal/CONNECT", ServerData, NULL,
178+ server_setup, do_steal_connect_test, server_teardown);
179++ g_test_add ("/server/chunked", ServerData, NULL,
180++ NULL, do_chunked_test, server_teardown);
181+
182+ ret = g_test_run ();
183+
184+--
185+2.43.0
186+ 
Mlibsoup3.spec+8-1
@@ -4,7 +4,7 @@
4 4 
5Name: libsoup35Name: libsoup3
6Version: 3.4.56Version: 3.4.5
7-Release: 17+Release: 2
8Summary: Soup, an HTTP library implementation8Summary: Soup, an HTTP library implementation
9License: LGPL-2.0-or-later9License: LGPL-2.0-or-later
10URL: https://wiki.gnome.org/Projects/libsoup10URL: https://wiki.gnome.org/Projects/libsoup
@@ -12,6 +12,7 @@ Source0: https://download.gnome.org/sources/libsoup/3.4/libsoup-%{version}
12 12 
13Patch0002: backport-CVE-2024-52530.patch13Patch0002: backport-CVE-2024-52530.patch
14Patch0004: backport-CVE-2025-4476.patch14Patch0004: backport-CVE-2025-4476.patch
15+Patch0006: backport-CVE-2026-1801.patch
15 16 
16BuildRequires: gcc gettext vala krb5-devel samba-winbind-clients17BuildRequires: gcc gettext vala krb5-devel samba-winbind-clients
17BuildRequires: meson >= 0.5418BuildRequires: meson >= 0.54
@@ -87,6 +88,12 @@ install -m 644 -D tests/libsoup.supp %{buildroot}%{_datadir}/libsoup-3.0/libsoup
87%doc %{_datadir}/doc/libsoup-3.088%doc %{_datadir}/doc/libsoup-3.0
88 89 
89%changelog90%changelog
91+* Thu Feb 05 2026 Yiming Ma <mayiming@xfusion.com> - 3.4.5-2
92+- Type:CVE
93+- ID:CVE-2026-1801
94+- SUG:NA
95+- DESC: fix CVE-2026-1801
96+ 
90* Fri Jan 17 2025 Funda Wang <fundawang@yeah.net> - 3.4.5-197* Fri Jan 17 2025 Funda Wang <fundawang@yeah.net> - 3.4.5-1
91- update to 3.4.598- update to 3.4.5
92 99