From 4a89be11440e71cf991a602a1003e0e78dbca3d1 Mon Sep 17 00:00:00 2001 From: PengLAI Code Date: Thu, 6 Aug 2026 11:13:12 +0800 Subject: [PATCH] [CVE] [Distro] add patch to fix CVE-2026-12548 to #IK4Y5W commit-7334c38f1f6aa5e64207cb415cf2509838c52b37-upstream. project: TC2024080204 Assisted-by: PengLAI Code --- CVE-2026-12548.patch | 47 ++++++++++++++++++++++++++++++++++++++++++++ libsoup.spec | 10 +++++++++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 CVE-2026-12548.patch diff --git a/CVE-2026-12548.patch b/CVE-2026-12548.patch new file mode 100644 index 0000000..8058267 --- /dev/null +++ b/CVE-2026-12548.patch @@ -0,0 +1,47 @@ +From 7334c38f1f6aa5e64207cb415cf2509838c52b37 Mon Sep 17 00:00:00 2001 +From: Carlos Garcia Campos +Date: Tue, 28 Apr 2026 15:13:39 +0200 +Subject: [PATCH] Set a maximum size for the headers buffer + +Callers of soup_headers_parse() pass the buffer length in wider types than +the "int len" parameter it declares: soup_multipart_new_from_message() +passes a pointer difference and soup_multipart_input_stream_parse_headers() +casts a guint. An oversized multipart part therefore truncates the length +to a negative value, and memchr() reads out of bounds. Bound the accepted +length instead. + +Closes #512 + +Upstream: https://gitlab.gnome.org/GNOME/libsoup/-/commit/7334c38f1f6aa5e64207cb415cf2509838c52b37 + +Backported to 2.74.3: upstream defines MAX_HEADERS_BUFFER_SIZE in +libsoup/soup-message-headers-private.h, which does not exist on this +branch, so the definition is kept local to soup-headers.c. +--- + libsoup/soup-headers.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c +--- a/libsoup/soup-headers.c ++++ b/libsoup/soup-headers.c +@@ -15,6 +15,8 @@ + #include "soup-headers.h" + #include "soup.h" + ++#define MAX_HEADERS_BUFFER_SIZE 256 * 1024 /* 256K */ ++ + /** + * soup_headers_parse: + * @str: the header string (including the Request-Line or Status-Line, +@@ -45,6 +47,9 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest) + g_return_val_if_fail (str != NULL, FALSE); + g_return_val_if_fail (dest != NULL, FALSE); + ++ if (len <= 0 || len > MAX_HEADERS_BUFFER_SIZE) ++ return FALSE; ++ + /* As per RFC 2616 section 19.3, we treat '\n' as the + * line terminator, and '\r', if it appears, merely as + * ignorable trailing whitespace. +-- +2.43.0 diff --git a/libsoup.spec b/libsoup.spec index 7fa70c2..5dfdd2a 100644 --- a/libsoup.spec +++ b/libsoup.spec @@ -1,4 +1,4 @@ -%define anolis_release 25 +%define anolis_release 26 %define glib2_version 2.58 %{!?with_docs: %global with_docs 1} @@ -60,6 +60,9 @@ Patch29: 0028-bugfix-for-CVE-2025-4969.patch Patch30: 0029-bugfix-for-CVE-2026-0719.patch # https://gitlab.gnome.org/GNOME/libsoup/-/commit/96ac392b444d01bd5de1d1276b187c3ed49d048c Patch31: 0030-bugfix-for-CVE-2026-6324.patch +# CVE-2026-12548 +# Reference: https://gitlab.gnome.org/GNOME/libsoup/-/commit/7334c38f1f6aa5e64207cb415cf2509838c52b37 +Patch32: CVE-2026-12548.patch BuildRequires: gettext BuildRequires: glib-networking @@ -173,6 +176,11 @@ export CXXFLAGS="$RPM_OPT_FLAGS -Wno-error=incompatible-pointer-types" %endif %changelog +* Thu Aug 06 2026 PengLAI Code - 2.74.3-26 +- Fix CVE-2026-12548 +- Upstream patch: https://gitlab.gnome.org/GNOME/libsoup/-/commit/7334c38f1f6aa5e64207cb415cf2509838c52b37 +- Adapted by PengLAI Code + * Thu Jun 18 2026 Yihao Yan - 2.74.3-25 - ignore incompatible-pointer-types error on GCC14 -- Gitee