* [OE-core][kirkstone 01/14] libsoup: patch CVE-2025-4476
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
@ 2025-06-22 14:59 ` Steve Sakoman
2025-06-22 14:59 ` [OE-core][kirkstone 02/14] libsoup: Fix CVE-2025-4969 Steve Sakoman
` (12 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 14:59 UTC (permalink / raw)
To: openembedded-core
From: Ashish Sharma <asharma@mvista.com>
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e64c221f9c7d09b48b610c5626b3b8c400f0907c]
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup/CVE-2025-4476.patch | 38 +++++++++++++++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-4476.patch
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-4476.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-4476.patch
new file mode 100644
index 0000000000..cd5619d620
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-4476.patch
@@ -0,0 +1,38 @@
+From e64c221f9c7d09b48b610c5626b3b8c400f0907c Mon Sep 17 00:00:00 2001
+From: Michael Catanzaro <mcatanzaro@redhat.com>
+Date: Thu, 8 May 2025 09:27:01 -0500
+Subject: [PATCH] auth-digest: fix crash in
+ soup_auth_digest_get_protection_space()
+
+We need to validate the Domain parameter in the WWW-Authenticate header.
+
+Unfortunately this crash only occurs when listening on default ports 80
+and 443, so there's no good way to test for this. The test would require
+running as root.
+
+Fixes #440
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e64c221f9c7d09b48b610c5626b3b8c400f0907c]
+CVE: CVE-2025-4476
+Signed-off-by: Ashish Sharma <asharma@mvista.com>
+
+
+ libsoup/auth/soup-auth-digest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c
+index d8bb2910..292f2045 100644
+--- a/libsoup/auth/soup-auth-digest.c
++++ b/libsoup/auth/soup-auth-digest.c
+@@ -220,7 +220,7 @@ soup_auth_digest_get_protection_space (SoupAuth *auth, GUri *source_uri)
+ if (uri &&
+ g_strcmp0 (g_uri_get_scheme (uri), g_uri_get_scheme (source_uri)) == 0 &&
+ g_uri_get_port (uri) == g_uri_get_port (source_uri) &&
+- !strcmp (g_uri_get_host (uri), g_uri_get_host (source_uri)))
++ !g_strcmp0 (g_uri_get_host (uri), g_uri_get_host (source_uri)))
+ dir = g_strdup (g_uri_get_path (uri));
+ else
+ dir = NULL;
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index 67aa180612..83ed88e785 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -36,6 +36,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32052.patch \
file://CVE-2025-32053.patch \
file://CVE-2025-46420.patch \
+ file://CVE-2025-4476.patch \
"
SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 02/14] libsoup: Fix CVE-2025-4969
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
2025-06-22 14:59 ` [OE-core][kirkstone 01/14] libsoup: patch CVE-2025-4476 Steve Sakoman
@ 2025-06-22 14:59 ` Steve Sakoman
2025-06-22 14:59 ` [OE-core][kirkstone 03/14] libsoup: fix CVE-2025-32907 Steve Sakoman
` (11 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 14:59 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/07b94e27afafebf31ef3cd868866a1e383750086
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup/CVE-2025-4969.patch | 76 +++++++++++++++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 1 +
2 files changed, 77 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-4969.patch
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-4969.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-4969.patch
new file mode 100644
index 0000000000..70c5fd5593
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-4969.patch
@@ -0,0 +1,76 @@
+From 07b94e27afafebf31ef3cd868866a1e383750086 Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Mon, 19 May 2025 17:48:27 +0200
+Subject: [PATCH] soup-multipart: Verify array bounds before accessing its
+ members
+
+The boundary could be at a place which, calculated, pointed
+before the beginning of the array. Check the bounds, to avoid
+read out of the array bounds.
+
+Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/447
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/07b94e27afafebf31ef3cd868866a1e383750086]
+CVE: CVE-2025-4969
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ libsoup/soup-multipart.c | 2 +-
+ tests/multipart-test.c | 22 ++++++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
+index 102ce37..e1c442e 100644
+--- a/libsoup/soup-multipart.c
++++ b/libsoup/soup-multipart.c
+@@ -104,7 +104,7 @@ find_boundary (const char *start, const char *end,
+ continue;
+
+ /* Check that it's at start of line */
+- if (!(b == start || (b[-1] == '\n' && b[-2] == '\r')))
++ if (!(b == start || (b - start >= 2 && b[-1] == '\n' && b[-2] == '\r')))
+ continue;
+
+ /* Check for "--" or "\r\n" after boundary */
+diff --git a/tests/multipart-test.c b/tests/multipart-test.c
+index ab5f41c..84852e2 100644
+--- a/tests/multipart-test.c
++++ b/tests/multipart-test.c
+@@ -527,6 +527,27 @@ test_multipart_bounds_bad (void)
+ g_bytes_unref (bytes);
+ }
+
++static void
++test_multipart_bounds_bad_2 (void)
++{
++ SoupMultipart *multipart;
++ SoupMessageHeaders *headers;
++ GBytes *bytes;
++ const char *raw_data = "\n--123\r\nline\r\n--123--\r";
++
++ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART);
++ soup_message_headers_append (headers, "Content-Type", "multipart/mixed; boundary=\"123\"");
++
++ bytes = g_bytes_new (raw_data, strlen (raw_data));
++
++ multipart = soup_multipart_new_from_message (headers, bytes);
++ g_assert_nonnull (multipart);
++
++ soup_multipart_free (multipart);
++ soup_message_headers_unref (headers);
++ g_bytes_unref (bytes);
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -556,6 +577,7 @@ main (int argc, char **argv)
+ g_test_add_data_func ("/multipart/async-small-reads", GINT_TO_POINTER (ASYNC_MULTIPART_SMALL_READS), test_multipart);
+ g_test_add_func ("/multipart/bounds-good", test_multipart_bounds_good);
+ g_test_add_func ("/multipart/bounds-bad", test_multipart_bounds_bad);
++ g_test_add_func ("/multipart/bounds-bad-2", test_multipart_bounds_bad_2);
+
+ ret = g_test_run ();
+
+--
+2.49.0
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index 83ed88e785..d0cd1f436a 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -37,6 +37,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32053.patch \
file://CVE-2025-46420.patch \
file://CVE-2025-4476.patch \
+ file://CVE-2025-4969.patch \
"
SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 03/14] libsoup: fix CVE-2025-32907
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
2025-06-22 14:59 ` [OE-core][kirkstone 01/14] libsoup: patch CVE-2025-4476 Steve Sakoman
2025-06-22 14:59 ` [OE-core][kirkstone 02/14] libsoup: Fix CVE-2025-4969 Steve Sakoman
@ 2025-06-22 14:59 ` Steve Sakoman
2025-06-22 14:59 ` [OE-core][kirkstone 04/14] libsoup: fix CVE-2025-32051 Steve Sakoman
` (10 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 14:59 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/issues/429
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup/CVE-2025-32907-1.patch | 200 ++++++++++++++++++
.../libsoup/libsoup/CVE-2025-32907-2.patch | 68 ++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 2 +
3 files changed, 270 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32907-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32907-2.patch
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32907-1.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32907-1.patch
new file mode 100644
index 0000000000..41b7d276a4
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-32907-1.patch
@@ -0,0 +1,200 @@
+From 7507b0713c2f02af1cd561ebb99477e0a099419d Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Tue, 15 Apr 2025 12:17:39 +0200
+Subject: [PATCH 1/2] soup-message-headers: Correct merge of ranges
+
+It had been skipping every second range, which generated an array
+of a lot of insane ranges, causing large memory usage by the server.
+
+Closes #428
+
+Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452>
+
+CVE: CVE-2025-32907
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452/commits]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-message-headers.c | 1 +
+ tests/meson.build | 1 +
+ tests/server-mem-limit-test.c | 144 +++++++++++++++++++++++++++++++++
+ 3 files changed, 146 insertions(+)
+ create mode 100644 tests/server-mem-limit-test.c
+
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index ee7a3cb..f101d4b 100644
+--- a/libsoup/soup-message-headers.c
++++ b/libsoup/soup-message-headers.c
+@@ -1244,6 +1244,7 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders *hdrs,
+ if (cur->start <= prev->end) {
+ prev->end = MAX (prev->end, cur->end);
+ g_array_remove_index (array, i);
++ i--;
+ }
+ }
+ }
+diff --git a/tests/meson.build b/tests/meson.build
+index ee118a0..8e7b51d 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -102,6 +102,7 @@ tests = [
+ {'name': 'samesite'},
+ {'name': 'session'},
+ {'name': 'server-auth'},
++ {'name': 'server-mem-limit'},
+ {'name': 'server'},
+ {'name': 'sniffing',
+ 'depends': [test_resources],
+diff --git a/tests/server-mem-limit-test.c b/tests/server-mem-limit-test.c
+new file mode 100644
+index 0000000..98f1c40
+--- /dev/null
++++ b/tests/server-mem-limit-test.c
+@@ -0,0 +1,144 @@
++/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*- */
++/*
++ * Copyright (C) 2025 Red Hat <www.redhat.com>
++ */
++
++#include "test-utils.h"
++
++#include <sys/resource.h>
++
++/*
++ This test limits memory usage to trigger too large buffer allocation crash.
++ As restoring the limits back to what it was does not always work, it's split
++ out of the server-test.c test with copied minimal server code.
++ */
++
++typedef struct {
++ SoupServer *server;
++ GUri *base_uri, *ssl_base_uri;
++ GSList *handlers;
++} ServerData;
++
++static void
++server_setup_nohandler (ServerData *sd, gconstpointer test_data)
++{
++ sd->server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
++ sd->base_uri = soup_test_server_get_uri (sd->server, "http", NULL);
++ if (tls_available)
++ sd->ssl_base_uri = soup_test_server_get_uri (sd->server, "https", NULL);
++}
++
++static void
++server_add_handler (ServerData *sd,
++ const char *path,
++ SoupServerCallback callback,
++ gpointer user_data,
++ GDestroyNotify destroy)
++{
++ soup_server_add_handler (sd->server, path, callback, user_data, destroy);
++ sd->handlers = g_slist_prepend (sd->handlers, g_strdup (path));
++}
++
++static void
++server_setup (ServerData *sd, gconstpointer test_data)
++{
++ server_setup_nohandler (sd, test_data);
++}
++
++static void
++server_teardown (ServerData *sd, gconstpointer test_data)
++{
++ GSList *iter;
++
++ for (iter = sd->handlers; iter; iter = iter->next)
++ soup_server_remove_handler (sd->server, iter->data);
++ g_slist_free_full (sd->handlers, g_free);
++
++ g_clear_pointer (&sd->server, soup_test_server_quit_unref);
++ g_clear_pointer (&sd->base_uri, g_uri_unref);
++ g_clear_pointer (&sd->ssl_base_uri, g_uri_unref);
++}
++
++static void
++server_file_callback (SoupServer *server,
++ SoupServerMessage *msg,
++ const char *path,
++ GHashTable *query,
++ gpointer data)
++{
++ void *mem;
++
++ g_assert_cmpstr (path, ==, "/file");
++ g_assert_cmpstr (soup_server_message_get_method (msg), ==, SOUP_METHOD_GET);
++
++ mem = g_malloc0 (sizeof (char) * 1024 * 1024);
++ /* fedora-scan CI claims a warning about possibly leaked `mem` variable, thus use
++ the copy and free it explicitly, to workaround the false positive; the g_steal_pointer()
++ did not help for the malloc-ed memory */
++ soup_server_message_set_response (msg, "application/octet-stream", SOUP_MEMORY_COPY, mem, sizeof (char) * 1024 *1024);
++ soup_server_message_set_status (msg, SOUP_STATUS_OK, NULL);
++ g_free (mem);
++}
++
++static void
++do_ranges_overlaps_test (ServerData *sd, gconstpointer test_data)
++{
++ SoupSession *session;
++ SoupMessage *msg;
++ GString *range;
++ GUri *uri;
++ const char *chunk = ",0,0,0,0,0,0,0,0,0,0,0";
++
++ g_test_bug ("428");
++
++ #ifdef G_OS_WIN32
++ g_test_skip ("Cannot run under windows");
++ return;
++ #endif
++
++ range = g_string_sized_new (99 * 1024);
++ g_string_append (range, "bytes=1024");
++ while (range->len < 99 * 1024)
++ g_string_append (range, chunk);
++
++ session = soup_test_session_new (NULL);
++ server_add_handler (sd, "/file", server_file_callback, NULL, NULL);
++
++ uri = g_uri_parse_relative (sd->base_uri, "/file", SOUP_HTTP_URI_FLAGS, NULL);
++
++ msg = soup_message_new_from_uri ("GET", uri);
++ soup_message_headers_append (soup_message_get_request_headers (msg), "Range", range->str);
++
++ soup_test_session_send_message (session, msg);
++
++ soup_test_assert_message_status (msg, SOUP_STATUS_PARTIAL_CONTENT);
++
++ g_object_unref (msg);
++
++ g_string_free (range, TRUE);
++ g_uri_unref (uri);
++
++ soup_test_session_abort_unref (session);
++}
++
++int
++main (int argc, char **argv)
++{
++ int ret;
++
++ test_init (argc, argv, NULL);
++
++ #ifndef G_OS_WIN32
++ struct rlimit new_rlimit = { 1024 * 1024 * 64, 1024 * 1024 * 64 };
++ /* limit memory usage, to trigger too large memory allocation abort */
++ g_assert_cmpint (setrlimit (RLIMIT_DATA, &new_rlimit), ==, 0);
++ #endif
++
++ g_test_add ("/server-mem/range-overlaps", ServerData, NULL,
++ server_setup, do_ranges_overlaps_test, server_teardown);
++
++ ret = g_test_run ();
++
++ test_cleanup ();
++ return ret;
++}
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32907-2.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32907-2.patch
new file mode 100644
index 0000000000..9c838a55af
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-32907-2.patch
@@ -0,0 +1,68 @@
+From f31dfc357ffdd8d18d3593a06cd4acb888eaba70 Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Tue, 13 May 2025 14:20:46 +0200
+Subject: [PATCH 2/2] server-mem-limit-test: Limit memory usage only when not
+ built witha sanitizer
+
+A build with -Db_sanitize=address crashes with failed mmap(), which is done
+inside libasan. The test requires 20.0TB of virtual memory when running with
+the sanitizer, which is beyond unsigned integer limits and may not trigger
+the bug anyway.
+
+Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452>
+
+CVE: CVE-2025-32907
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452/commits]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ meson.build | 4 ++++
+ tests/server-mem-limit-test.c | 13 +++++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index d4110da..74323ea 100644
+--- a/meson.build
++++ b/meson.build
+@@ -357,6 +357,10 @@ configinc = include_directories('.')
+
+ prefix = get_option('prefix')
+
++if get_option('b_sanitize') != 'none'
++ cdata.set_quoted('B_SANITIZE_OPTION', get_option('b_sanitize'))
++endif
++
+ cdata.set_quoted('PACKAGE_VERSION', soup_version)
+ cdata.set_quoted('LOCALEDIR', join_paths(prefix, get_option('localedir')))
+ cdata.set_quoted('GETTEXT_PACKAGE', libsoup_api_name)
+diff --git a/tests/server-mem-limit-test.c b/tests/server-mem-limit-test.c
+index 98f1c40..65dc875 100644
+--- a/tests/server-mem-limit-test.c
++++ b/tests/server-mem-limit-test.c
+@@ -126,14 +126,19 @@ main (int argc, char **argv)
+ {
+ int ret;
+
+- test_init (argc, argv, NULL);
+-
+- #ifndef G_OS_WIN32
+- struct rlimit new_rlimit = { 1024 * 1024 * 64, 1024 * 1024 * 64 };
++ /* a build with an address sanitizer may crash on mmap() with the limit,
++ thus skip the limit set in such case, even it may not necessarily
++ trigger the bug if it regresses */
++ #if !defined(G_OS_WIN32) && !defined(B_SANITIZE_OPTION)
++ struct rlimit new_rlimit = { 1024UL * 1024UL * 1024UL * 2UL, 1024UL * 1024UL * 1024UL * 2UL };
+ /* limit memory usage, to trigger too large memory allocation abort */
+ g_assert_cmpint (setrlimit (RLIMIT_DATA, &new_rlimit), ==, 0);
++ #else
++ g_message ("server-mem-limit-test: Running without memory limit");
+ #endif
+
++ test_init (argc, argv, NULL);
++
+ g_test_add ("/server-mem/range-overlaps", ServerData, NULL,
+ server_setup, do_ranges_overlaps_test, server_teardown);
+
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index d0cd1f436a..90733a73e8 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -38,6 +38,8 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-46420.patch \
file://CVE-2025-4476.patch \
file://CVE-2025-4969.patch \
+ file://CVE-2025-32907-1.patch \
+ file://CVE-2025-32907-2.patch \
"
SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 04/14] libsoup: fix CVE-2025-32051
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-06-22 14:59 ` [OE-core][kirkstone 03/14] libsoup: fix CVE-2025-32907 Steve Sakoman
@ 2025-06-22 14:59 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 05/14] libsoup: fix CVE-2025-46421 Steve Sakoman
` (9 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 14:59 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/issues/401
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup/CVE-2025-32051-1.patch | 29 ++++++++++
.../libsoup/libsoup/CVE-2025-32051-2.patch | 57 +++++++++++++++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 2 +
3 files changed, 88 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32051-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32051-2.patch
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32051-1.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32051-1.patch
new file mode 100644
index 0000000000..efeda48b11
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-32051-1.patch
@@ -0,0 +1,29 @@
+From dc5db30989f385303c79ec3188c52e33f6f5886e Mon Sep 17 00:00:00 2001
+From: Ar Jun <pkillarjun@protonmail.com>
+Date: Sat, 16 Nov 2024 11:50:09 -0600
+Subject: [PATCH 1/2] Fix possible NULL deref in soup_uri_decode_data_uri
+
+CVE: CVE-2025-32051
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/0713ba4a719da938dc8facc89fca99cd0aa3069f]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-uri-utils.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libsoup/soup-uri-utils.c b/libsoup/soup-uri-utils.c
+index be2b79b..0251279 100644
+--- a/libsoup/soup-uri-utils.c
++++ b/libsoup/soup-uri-utils.c
+@@ -303,6 +303,8 @@ soup_uri_decode_data_uri (const char *uri,
+
+ uri_string = g_uri_to_string (soup_uri);
+ g_uri_unref (soup_uri);
++ if (!uri_string)
++ return NULL;
+
+ start = uri_string + 5;
+ comma = strchr (start, ',');
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-32051-2.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-32051-2.patch
new file mode 100644
index 0000000000..24c184bb86
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-32051-2.patch
@@ -0,0 +1,57 @@
+From 7d1557a60145927806c88d321e8322a9d9f49bb2 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Fri, 22 Nov 2024 13:39:51 -0600
+Subject: [PATCH 2/2] soup_uri_decode_data_uri(): Handle URIs with a path
+ starting with //
+
+CVE: CVE-2025-32051
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/79cfd65c9bd8024cd45dd725c284766329873709]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-uri-utils.c | 8 ++++++++
+ tests/uri-parsing-test.c | 2 ++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/libsoup/soup-uri-utils.c b/libsoup/soup-uri-utils.c
+index 0251279..1ff11cd 100644
+--- a/libsoup/soup-uri-utils.c
++++ b/libsoup/soup-uri-utils.c
+@@ -286,6 +286,7 @@ soup_uri_decode_data_uri (const char *uri,
+ gboolean base64 = FALSE;
+ char *uri_string;
+ GBytes *bytes;
++ const char *path;
+
+ g_return_val_if_fail (uri != NULL, NULL);
+
+@@ -301,6 +302,13 @@ soup_uri_decode_data_uri (const char *uri,
+ if (content_type)
+ *content_type = NULL;
+
++ /* g_uri_to_string() is picky about paths that start with `//` and will assert. */
++ path = g_uri_get_path (soup_uri);
++ if (path[0] == '/' && path[1] == '/') {
++ g_uri_unref (soup_uri);
++ return NULL;
++ }
++
+ uri_string = g_uri_to_string (soup_uri);
+ g_uri_unref (soup_uri);
+ if (!uri_string)
+diff --git a/tests/uri-parsing-test.c b/tests/uri-parsing-test.c
+index 1f16273..418391e 100644
+--- a/tests/uri-parsing-test.c
++++ b/tests/uri-parsing-test.c
+@@ -141,6 +141,8 @@ static struct {
+ { "data:text/plain;base64,aGVsbG8=", "hello", "text/plain" },
+ { "data:text/plain;base64,invalid=", "", "text/plain" },
+ { "data:,", "", CONTENT_TYPE_DEFAULT },
++ { "data:.///", NULL, NULL },
++ { "data:/.//", NULL, NULL },
+ };
+
+ static void
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index 90733a73e8..be29ff0e5d 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -40,6 +40,8 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-4969.patch \
file://CVE-2025-32907-1.patch \
file://CVE-2025-32907-2.patch \
+ file://CVE-2025-32051-1.patch \
+ file://CVE-2025-32051-2.patch \
"
SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 05/14] libsoup: fix CVE-2025-46421
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-06-22 14:59 ` [OE-core][kirkstone 04/14] libsoup: fix CVE-2025-32051 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 06/14] libsoup: fix CVE-2025-4948 Steve Sakoman
` (8 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/issues/439
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup/CVE-2025-46421.patch | 139 ++++++++++++++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 1 +
2 files changed, 140 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-46421.patch
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-46421.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-46421.patch
new file mode 100644
index 0000000000..72683d8fce
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-46421.patch
@@ -0,0 +1,139 @@
+From 85c5227eef7370832044eb918e8a99c0bcbab86f Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Wed, 5 Feb 2025 16:18:10 -0600
+Subject: [PATCH] session: Strip authentication credentails on cross-origin
+ redirect
+
+This should match the behavior of Firefox and Safari but not of Chromium.
+
+CVE: CVE-2025-46421
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/436/diffs?commit_id=3e5c26415811f19e7737238bb23305ffaf96f66b]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-session.c | 6 ++++
+ tests/auth-test.c | 77 ++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 83 insertions(+)
+
+diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
+index 631bec0..9f00b05 100644
+--- a/libsoup/soup-session.c
++++ b/libsoup/soup-session.c
+@@ -1230,6 +1230,12 @@ soup_session_redirect_message (SoupSession *session,
+ SOUP_ENCODING_NONE);
+ }
+
++ /* Strip all credentials on cross-origin redirect. */
++ if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
++ soup_message_headers_remove_common (soup_message_get_request_headers (msg), SOUP_HEADER_AUTHORIZATION);
++ soup_message_set_auth (msg, NULL);
++ }
++
+ soup_message_set_request_host_from_uri (msg, new_uri);
+ soup_message_set_uri (msg, new_uri);
+ g_uri_unref (new_uri);
+diff --git a/tests/auth-test.c b/tests/auth-test.c
+index 484097f..7c3b551 100644
+--- a/tests/auth-test.c
++++ b/tests/auth-test.c
+@@ -1,6 +1,7 @@
+ /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*- */
+
+ #include "test-utils.h"
++#include "soup-uri-utils-private.h"
+
+ static const char *base_uri;
+ static GMainLoop *loop;
+@@ -1916,6 +1917,81 @@ do_missing_params_test (gconstpointer auth_header)
+ soup_test_server_quit_unref (server);
+ }
+
++static void
++redirect_server_callback (SoupServer *server,
++ SoupServerMessage *msg,
++ const char *path,
++ GHashTable *query,
++ gpointer user_data)
++{
++ static gboolean redirected = FALSE;
++
++ if (!redirected) {
++ char *redirect_uri = g_uri_to_string (user_data);
++ soup_server_message_set_redirect (msg, SOUP_STATUS_MOVED_PERMANENTLY, redirect_uri);
++ g_free (redirect_uri);
++ redirected = TRUE;
++ return;
++ }
++
++ g_assert_not_reached ();
++}
++
++static gboolean
++auth_for_redirect_callback (SoupMessage *msg, SoupAuth *auth, gboolean retrying, gpointer user_data)
++{
++ GUri *known_server_uri = user_data;
++
++ if (!soup_uri_host_equal (known_server_uri, soup_message_get_uri (msg)))
++ return FALSE;
++
++ soup_auth_authenticate (auth, "user", "good-basic");
++
++ return TRUE;
++}
++
++static void
++do_strip_on_crossorigin_redirect (void)
++{
++ SoupSession *session;
++ SoupMessage *msg;
++ SoupServer *server1, *server2;
++ SoupAuthDomain *auth_domain;
++ GUri *uri;
++ gint status;
++
++ server1 = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
++ server2 = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
++
++ /* Both servers have the same credentials. */
++ auth_domain = soup_auth_domain_basic_new ("realm", "auth-test", "auth-callback", server_basic_auth_callback, NULL);
++ soup_auth_domain_add_path (auth_domain, "/");
++ soup_server_add_auth_domain (server1, auth_domain);
++ soup_server_add_auth_domain (server2, auth_domain);
++ g_object_unref (auth_domain);
++
++ /* Server 1 asks for auth, then redirects to Server 2. */
++ soup_server_add_handler (server1, NULL,
++ redirect_server_callback,
++ soup_test_server_get_uri (server2, "http", NULL), (GDestroyNotify)g_uri_unref);
++ /* Server 2 requires auth. */
++ soup_server_add_handler (server2, NULL, server_callback, NULL, NULL);
++
++ session = soup_test_session_new (NULL);
++ uri = soup_test_server_get_uri (server1, "http", NULL);
++ msg = soup_message_new_from_uri ("GET", uri);
++ /* The client only sends credentials for the host it knows. */
++ g_signal_connect (msg, "authenticate", G_CALLBACK (auth_for_redirect_callback), uri);
++
++ status = soup_test_session_send_message (session, msg);
++
++ g_assert_cmpint (status, ==, SOUP_STATUS_UNAUTHORIZED);
++
++ g_uri_unref (uri);
++ soup_test_server_quit_unref (server1);
++ soup_test_server_quit_unref (server2);
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -1949,6 +2025,7 @@ main (int argc, char **argv)
+ g_test_add_func ("/auth/auth-uri", do_auth_uri_test);
+ g_test_add_func ("/auth/cancel-request-on-authenticate", do_cancel_request_on_authenticate);
+ g_test_add_func ("/auth/multiple-algorithms", do_multiple_digest_algorithms);
++ g_test_add_func ("/auth/strip-on-crossorigin-redirect", do_strip_on_crossorigin_redirect);
+ g_test_add_data_func ("/auth/missing-params/realm", "Digest qop=\"auth\"", do_missing_params_test);
+ g_test_add_data_func ("/auth/missing-params/nonce", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\"", do_missing_params_test);
+ g_test_add_data_func ("/auth/missing-params/nonce-md5-sess", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\" algorithm=\"MD5-sess\"", do_missing_params_test);
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index be29ff0e5d..49aa28964c 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -42,6 +42,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32907-2.patch \
file://CVE-2025-32051-1.patch \
file://CVE-2025-32051-2.patch \
+ file://CVE-2025-46421.patch \
"
SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 06/14] libsoup: fix CVE-2025-4948
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 05/14] libsoup: fix CVE-2025-46421 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 07/14] libsoup-2.4: Fix CVE-2025-4969 Steve Sakoman
` (7 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup/CVE-2025-4948.patch | 97 +++++++++++++++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 1 +
2 files changed, 98 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-4948.patch
diff --git a/meta/recipes-support/libsoup/libsoup/CVE-2025-4948.patch b/meta/recipes-support/libsoup/libsoup/CVE-2025-4948.patch
new file mode 100644
index 0000000000..07c85f5381
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup/CVE-2025-4948.patch
@@ -0,0 +1,97 @@
+From a23ce8f8e60e79990e26376c8b0d40841aed4b81 Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Thu, 15 May 2025 17:49:11 +0200
+Subject: [PATCH] soup-multipart: Verify boundary limits for multipart body
+
+It could happen that the boundary started at a place which resulted into
+a negative number, which in an unsigned integer is a very large value.
+Check the body size is not a negative value before setting it.
+
+Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
+
+Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/463>
+
+CVE: CVE-2025-4948
+Upstream-Status: Backport
+[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/463/diffs?commit_id=f2f28afe0b3b2b3009ab67d6874457ec6bac70c0]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-multipart.c | 2 +-
+ tests/multipart-test.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
+index e1c442e..27257e4 100644
+--- a/libsoup/soup-multipart.c
++++ b/libsoup/soup-multipart.c
+@@ -204,7 +204,7 @@ soup_multipart_new_from_message (SoupMessageHeaders *headers,
+ */
+ part_body = g_bytes_new_from_bytes (body, // FIXME
+ split - body_data,
+- end - 2 - split);
++ end - 2 >= split ? end - 2 - split : 0);
+ g_ptr_array_add (multipart->bodies, part_body);
+
+ start = end;
+diff --git a/tests/multipart-test.c b/tests/multipart-test.c
+index 84852e2..2ae888c 100644
+--- a/tests/multipart-test.c
++++ b/tests/multipart-test.c
+@@ -548,6 +548,45 @@ test_multipart_bounds_bad_2 (void)
+ g_bytes_unref (bytes);
+ }
+
++static void
++test_multipart_too_large (void)
++{
++ const char *raw_body =
++ "-------------------\r\n"
++ "-\n"
++ "Cont\"\r\n"
++ "Content-Tynt----e:n\x8erQK\r\n"
++ "Content-Disposition: name= form-; name=\"file\"; filename=\"ype:i/ -d; ----\xae\r\n"
++ "Content-Typimag\x01/png--\\\n"
++ "\r\n"
++ "---:\n\r\n"
++ "\r\n"
++ "-------------------------------------\r\n"
++ "---------\r\n"
++ "----------------------";
++ GBytes *body;
++ GHashTable *params;
++ SoupMessageHeaders *headers;
++ SoupMultipart *multipart;
++
++ params = g_hash_table_new (g_str_hash, g_str_equal);
++ g_hash_table_insert (params, (gpointer) "boundary", (gpointer) "-----------------");
++ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART);
++ soup_message_headers_set_content_type (headers, "multipart/form-data", params);
++ g_hash_table_unref (params);
++
++ body = g_bytes_new_static (raw_body, strlen (raw_body));
++ multipart = soup_multipart_new_from_message (headers, body);
++ soup_message_headers_unref (headers);
++ g_bytes_unref (body);
++
++ g_assert_nonnull (multipart);
++ g_assert_cmpint (soup_multipart_get_length (multipart), ==, 1);
++ g_assert_true (soup_multipart_get_part (multipart, 0, &headers, &body));
++ g_assert_cmpint (g_bytes_get_size (body), ==, 0);
++ soup_multipart_free (multipart);
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -578,6 +617,7 @@ main (int argc, char **argv)
+ g_test_add_func ("/multipart/bounds-good", test_multipart_bounds_good);
+ g_test_add_func ("/multipart/bounds-bad", test_multipart_bounds_bad);
+ g_test_add_func ("/multipart/bounds-bad-2", test_multipart_bounds_bad_2);
++ g_test_add_func ("/multipart/too-large", test_multipart_too_large);
+
+ ret = g_test_run ();
+
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.0.7.bb b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
index 49aa28964c..3ddcb3e568 100644
--- a/meta/recipes-support/libsoup/libsoup_3.0.7.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.0.7.bb
@@ -43,6 +43,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32051-1.patch \
file://CVE-2025-32051-2.patch \
file://CVE-2025-46421.patch \
+ file://CVE-2025-4948.patch \
"
SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 07/14] libsoup-2.4: Fix CVE-2025-4969
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 06/14] libsoup: fix CVE-2025-4948 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 08/14] libsoup-2.4: fix CVE-2025-32907 Steve Sakoman
` (6 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/07b94e27afafebf31ef3cd868866a1e383750086
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup-2.4/CVE-2025-4969.patch | 76 +++++++++++++++++++
.../libsoup/libsoup-2.4_2.74.2.bb | 1 +
2 files changed, 77 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch
diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch
new file mode 100644
index 0000000000..d45b2a2cb0
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch
@@ -0,0 +1,76 @@
+From 07b94e27afafebf31ef3cd868866a1e383750086 Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Mon, 19 May 2025 17:48:27 +0200
+Subject: [PATCH] soup-multipart: Verify array bounds before accessing its
+ members
+
+The boundary could be at a place which, calculated, pointed
+before the beginning of the array. Check the bounds, to avoid
+read out of the array bounds.
+
+Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/447
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/07b94e27afafebf31ef3cd868866a1e383750086]
+CVE: CVE-2025-4969
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ libsoup/soup-multipart.c | 2 +-
+ tests/multipart-test.c | 22 ++++++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
+index dd93973..b3611db 100644
+--- a/libsoup/soup-multipart.c
++++ b/libsoup/soup-multipart.c
+@@ -108,7 +108,7 @@ find_boundary (const char *start, const char *end,
+ continue;
+
+ /* Check that it's at start of line */
+- if (!(b == start || (b[-1] == '\n' && b[-2] == '\r')))
++ if (!(b == start || (b - start >= 2 && b[-1] == '\n' && b[-2] == '\r')))
+ continue;
+
+ /* Check for "--" or "\r\n" after boundary */
+diff --git a/tests/multipart-test.c b/tests/multipart-test.c
+index 834b181..980eb68 100644
+--- a/tests/multipart-test.c
++++ b/tests/multipart-test.c
+@@ -562,6 +562,27 @@ test_multipart_bounds_bad (void)
+ g_bytes_unref (bytes);
+ }
+
++static void
++test_multipart_bounds_bad_2 (void)
++{
++ SoupMultipart *multipart;
++ SoupMessageHeaders *headers;
++ GBytes *bytes;
++ const char *raw_data = "\n--123\r\nline\r\n--123--\r";
++
++ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART);
++ soup_message_headers_append (headers, "Content-Type", "multipart/mixed; boundary=\"123\"");
++
++ bytes = g_bytes_new (raw_data, strlen (raw_data));
++
++ multipart = soup_multipart_new_from_message (headers, bytes);
++ g_assert_nonnull (multipart);
++
++ soup_multipart_free (multipart);
++ soup_message_headers_free (headers);
++ g_bytes_unref (bytes);
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -593,6 +614,7 @@ main (int argc, char **argv)
+ g_test_add_data_func ("/multipart/async-small-reads", GINT_TO_POINTER (ASYNC_MULTIPART_SMALL_READS), test_multipart);
+ g_test_add_func ("/multipart/bounds-good", test_multipart_bounds_good);
+ g_test_add_func ("/multipart/bounds-bad", test_multipart_bounds_bad);
++ g_test_add_func ("/multipart/bounds-bad-2", test_multipart_bounds_bad_2);
+
+ ret = g_test_run ();
+
+--
+2.49.0
+
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
index 61ebebeacd..11552df80a 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
@@ -37,6 +37,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32050.patch \
file://CVE-2025-32052.patch \
file://CVE-2025-32053.patch \
+ file://CVE-2025-4969.patch \
"
SRC_URI[sha256sum] = "f0a427656e5fe19e1df71c107e88dfa1b2e673c25c547b7823b6018b40d01159"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 08/14] libsoup-2.4: fix CVE-2025-32907
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 07/14] libsoup-2.4: Fix CVE-2025-4969 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 09/14] libsoup-2.4: fix CVE-2025-46421 Steve Sakoman
` (5 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/issues/428
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup-2.4/CVE-2025-32907.patch | 39 +++++++++++++++++++
.../libsoup/libsoup-2.4_2.74.2.bb | 1 +
2 files changed, 40 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch
diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch
new file mode 100644
index 0000000000..41dd3ff3f4
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch
@@ -0,0 +1,39 @@
+From 8158b4084dcba2a233dfcb7359c53ab2840148f7 Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Tue, 15 Apr 2025 12:17:39 +0200
+Subject: [PATCH 1/2] soup-message-headers: Correct merge of ranges
+
+It had been skipping every second range, which generated an array
+of a lot of insane ranges, causing large memory usage by the server.
+
+Closes #428
+
+Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452>
+
+CVE: CVE-2025-32907
+Upstream-Status: Backport
+[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452/diffs?commit_id=9bb92f7a685e31e10e9e8221d0342280432ce836]
+
+Test part not applied since test codes use some functions not in this
+version
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-message-headers.c | 1 +
+ 1 files changed, 1 insertions(+)
+
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index 78b2455..00b9763 100644
+--- a/libsoup/soup-message-headers.c
++++ b/libsoup/soup-message-headers.c
+@@ -1024,6 +1024,7 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders *hdrs,
+ if (cur->start <= prev->end) {
+ prev->end = MAX (prev->end, cur->end);
+ g_array_remove_index (array, i);
++ i--;
+ }
+ }
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
index 11552df80a..38307fa3d5 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
@@ -38,6 +38,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32052.patch \
file://CVE-2025-32053.patch \
file://CVE-2025-4969.patch \
+ file://CVE-2025-32907.patch \
"
SRC_URI[sha256sum] = "f0a427656e5fe19e1df71c107e88dfa1b2e673c25c547b7823b6018b40d01159"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 09/14] libsoup-2.4: fix CVE-2025-46421
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 08/14] libsoup-2.4: fix CVE-2025-32907 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 10/14] libsoup-2.4: fix CVE-2025-4948 Steve Sakoman
` (4 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/issues/439
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup-2.4/CVE-2025-46421.patch | 47 +++++++++++++++++++
.../libsoup/libsoup-2.4_2.74.2.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch
diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch
new file mode 100644
index 0000000000..26067c4bb8
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch
@@ -0,0 +1,47 @@
+From 5eb225f02bb35de56cfeedd87bde716bf1cb750b Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Wed, 5 Feb 2025 16:18:10 -0600
+Subject: [PATCH] session: Strip authentication credentails on
+ cross-origin redirect
+
+This should match the behavior of Firefox and Safari but not of Chromium.
+
+CVE: CVE-2025-46421
+Upstream-Status: Backport
+[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/436/diffs?commit_id=3e5c26415811f19e7737238bb23305ffaf96f66b]
+
+Test code not added since it included some headers not in version 2.74.3
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-session.c | 8 +++++++-
+ 1 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
+index 83421ef..8d6ac61 100644
+--- a/libsoup/soup-session.c
++++ b/libsoup/soup-session.c
+@@ -1189,12 +1189,18 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg)
+ SOUP_ENCODING_NONE);
+ }
+
++ /* Strip all credentials on cross-origin redirect. */
++ if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
++ soup_message_headers_remove (msg->request_headers, "Authorization");
++ soup_message_set_auth (msg, NULL);
++ }
++
+ soup_message_set_uri (msg, new_uri);
+ soup_uri_free (new_uri);
+
+ soup_session_requeue_message (session, msg);
+ return TRUE;
+-}
++}
+
+ static void
+ redirect_handler (SoupMessage *msg, gpointer user_data)
+
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
index 38307fa3d5..347fe1aa21 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
@@ -39,6 +39,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32053.patch \
file://CVE-2025-4969.patch \
file://CVE-2025-32907.patch \
+ file://CVE-2025-46421.patch \
"
SRC_URI[sha256sum] = "f0a427656e5fe19e1df71c107e88dfa1b2e673c25c547b7823b6018b40d01159"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 10/14] libsoup-2.4: fix CVE-2025-4948
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 09/14] libsoup-2.4: fix CVE-2025-46421 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 11/14] libsoup-2.4: fix CVE-2025-4476 Steve Sakoman
` (3 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
http://gitlab.gnome.org/GNOME/libsoup/-/issues/449
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup-2.4/CVE-2025-4948.patch | 38 +++++++++++++++++++
.../libsoup/libsoup-2.4_2.74.2.bb | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch
diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch
new file mode 100644
index 0000000000..b15b8c763d
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch
@@ -0,0 +1,38 @@
+From dfdc9b3cc73e6fe88cc12792ba00e14642572339 Mon Sep 17 00:00:00 2001
+From: Milan Crha <mcrha@redhat.com>
+Date: Thu, 15 May 2025 17:49:11 +0200
+Subject: [PATCH] soup-multipart: Verify boundary limits for multipart body
+
+It could happen that the boundary started at a place which resulted into
+a negative number, which in an unsigned integer is a very large value.
+Check the body size is not a negative value before setting it.
+
+Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/449
+
+Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/463>
+
+CVE: CVE-2025-4948
+Upstream-Status: Backport
+[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/463/diffs?commit_id=f2f28afe0b3b2b3009ab67d6874457ec6bac70c0]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-multipart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
+index dd93973..ce2fc10 100644
+--- a/libsoup/soup-multipart.c
++++ b/libsoup/soup-multipart.c
+@@ -214,7 +214,7 @@ soup_multipart_new_from_message (SoupMessageHeaders *headers,
+ */
+ part_body = soup_buffer_new_subbuffer (flattened,
+ split - flattened->data,
+- end - 2 - split);
++ end - 2 >= split ? end - 2 - split : 0);
+ g_ptr_array_add (multipart->bodies, part_body);
+
+ start = end;
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
index 347fe1aa21..aa2903030d 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
@@ -40,6 +40,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-4969.patch \
file://CVE-2025-32907.patch \
file://CVE-2025-46421.patch \
+ file://CVE-2025-4948.patch \
"
SRC_URI[sha256sum] = "f0a427656e5fe19e1df71c107e88dfa1b2e673c25c547b7823b6018b40d01159"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 11/14] libsoup-2.4: fix CVE-2025-4476
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (9 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 10/14] libsoup-2.4: fix CVE-2025-4948 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 12/14] go: ignore CVE-2024-3566 Steve Sakoman
` (2 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/issues/440
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsoup/libsoup-2.4/CVE-2025-4476.patch | 38 +++++++++++++++++++
.../libsoup/libsoup-2.4_2.74.2.bb | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch
diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch
new file mode 100644
index 0000000000..874f62e7ad
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch
@@ -0,0 +1,38 @@
+From 52a0f9234d384b9dab368835b22e5a5a01542168 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Fri, 16 May 2025 14:16:10 +0800
+Subject: [PATCH] auth-digest: fix crash in
+ soup_auth_digest_get_protection_space()
+
+We need to validate the Domain parameter in the WWW-Authenticate header.
+
+Unfortunately this crash only occurs when listening on default ports 80
+and 443, so there's no good way to test for this. The test would require
+running as root.
+
+Fixes #440
+
+CVE: CVE-2025-4476
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e64c221f9c7d09b48b610c5626b3b8c400f0907c?merge_request_iid=457]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-auth-digest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c
+index f1621ec..a2dc560 100644
+--- a/libsoup/soup-auth-digest.c
++++ b/libsoup/soup-auth-digest.c
+@@ -229,7 +229,7 @@ soup_auth_digest_get_protection_space (SoupAuth *auth, SoupURI *source_uri)
+ uri = soup_uri_new (d);
+ if (uri && uri->scheme == source_uri->scheme &&
+ uri->port == source_uri->port &&
+- !strcmp (uri->host, source_uri->host))
++ !g_strcmp0 (uri->host, source_uri->host))
+ dir = g_strdup (uri->path);
+ else
+ dir = NULL;
+--
+2.34.1
+
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
index aa2903030d..686e3b6720 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
@@ -41,6 +41,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32907.patch \
file://CVE-2025-46421.patch \
file://CVE-2025-4948.patch \
+ file://CVE-2025-4476.patch \
"
SRC_URI[sha256sum] = "f0a427656e5fe19e1df71c107e88dfa1b2e673c25c547b7823b6018b40d01159"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 12/14] go: ignore CVE-2024-3566
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (10 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 11/14] libsoup-2.4: fix CVE-2025-4476 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 13/14] systemtap: add sysroot Python paths to configure flags Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 14/14] cmake: Correctly handle cost data of tests with arbitrary chars in name Steve Sakoman
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
NVD ([1]) tracks this as:
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Running on/with
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Yocto cve-check ignores the "Running on/with", so it needs to be ignored
explicitly.
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-3566
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-binary-native_1.17.13.bb | 3 +++
meta/recipes-devtools/go/go-common.inc | 3 +++
2 files changed, 6 insertions(+)
diff --git a/meta/recipes-devtools/go/go-binary-native_1.17.13.bb b/meta/recipes-devtools/go/go-binary-native_1.17.13.bb
index 4ee0148417..0f356b0e79 100644
--- a/meta/recipes-devtools/go/go-binary-native_1.17.13.bb
+++ b/meta/recipes-devtools/go/go-binary-native_1.17.13.bb
@@ -14,6 +14,9 @@ SRC_URI[go_linux_arm64.sha256sum] = "914daad3f011cc2014dea799bb7490442677e4ad6de
UPSTREAM_CHECK_URI = "https://golang.org/dl/"
UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux"
+# not-applicable-platform: Issue only applies on Windows
+CVE_CHECK_IGNORE += "CVE-2024-3566"
+
S = "${WORKDIR}/go"
inherit goarch native
diff --git a/meta/recipes-devtools/go/go-common.inc b/meta/recipes-devtools/go/go-common.inc
index 83f8db7b39..e2ffba27bd 100644
--- a/meta/recipes-devtools/go/go-common.inc
+++ b/meta/recipes-devtools/go/go-common.inc
@@ -19,6 +19,9 @@ S = "${WORKDIR}/go"
B = "${S}"
UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)\.src\.tar"
+# not-applicable-platform: Issue only applies on Windows
+CVE_CHECK_IGNORE += "CVE-2024-3566"
+
INHIBIT_PACKAGE_DEBUG_SPLIT = "1"
SSTATE_SCAN_CMD = "true"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 13/14] systemtap: add sysroot Python paths to configure flags
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (11 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 12/14] go: ignore CVE-2024-3566 Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
2025-06-22 15:00 ` [OE-core][kirkstone 14/14] cmake: Correctly handle cost data of tests with arbitrary chars in name Steve Sakoman
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Soumya Sambu <soumya.sambu@windriver.com>
Explicitly set Python-related flags to use sysroot-staged headers and tools.
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-kernel/systemtap/systemtap_git.bb | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/meta/recipes-kernel/systemtap/systemtap_git.bb b/meta/recipes-kernel/systemtap/systemtap_git.bb
index c84fc27001..40ccf1d523 100644
--- a/meta/recipes-kernel/systemtap/systemtap_git.bb
+++ b/meta/recipes-kernel/systemtap/systemtap_git.bb
@@ -35,6 +35,13 @@ PACKAGECONFIG[python3-probes] = "--with-python3-probes,--without-python3-probes,
inherit autotools gettext pkgconfig systemd
inherit ${@bb.utils.contains('PACKAGECONFIG', 'python3-probes', 'setuptools3-base', '', d)}
+EXTRA_OECONF += " \
+ PYTHON_CPPFLAGS=-I${STAGING_INCDIR}/python${PYTHON_BASEVERSION} \
+ PYTHON3_CONFIG=${STAGING_BINDIR_NATIVE}/python3-config \
+"
+
+CPPFLAGS:append = " -I${STAGING_INCDIR}/python${PYTHON_BASEVERSION}"
+
# exporter comes with python3-probes
PACKAGES =+ "${PN}-exporter"
FILES:${PN}-exporter = "${sysconfdir}/stap-exporter/* \
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [OE-core][kirkstone 14/14] cmake: Correctly handle cost data of tests with arbitrary chars in name
2025-06-22 14:59 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (12 preceding siblings ...)
2025-06-22 15:00 ` [OE-core][kirkstone 13/14] systemtap: add sysroot Python paths to configure flags Steve Sakoman
@ 2025-06-22 15:00 ` Steve Sakoman
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 15:00 UTC (permalink / raw)
To: openembedded-core
From: Moritz Haase <Moritz.Haase@bmw.de>
ctest automatically optimizes the order of (parallel) test execution based on
historic test case runtime via the COST property (see [0]), which can have a
significant impact on overall test run times. Sadly this feature is broken in
CMake < 4.0.0 for test cases that have spaces in their name (see [1]).
This commit is a backport of f24178f3 (which itself backports the upstream fix).
the patch was adapted slightly to apply cleanly to the older CMake version in
kirkstone. As repeated test runs are expected to mainly take place inside the
SDK, the patch is only applied to 'nativesdk' builds.
[0]: https://cmake.org/cmake/help/latest/prop_test/COST.html
[1]: https://gitlab.kitware.com/cmake/cmake/-/issues/26594
Reported-By: John Drouhard <john@drouhard.dev>
Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../cmake/cmake-native_3.22.3.bb | 2 +-
...trary-characters-in-test-names-of-CT.patch | 205 ++++++++++++++++++
meta/recipes-devtools/cmake/cmake_3.22.3.bb | 1 +
3 files changed, 207 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/cmake/cmake/0001-ctest-Allow-arbitrary-characters-in-test-names-of-CT.patch
diff --git a/meta/recipes-devtools/cmake/cmake-native_3.22.3.bb b/meta/recipes-devtools/cmake/cmake-native_3.22.3.bb
index 45ea78ae00..447554aa2e 100644
--- a/meta/recipes-devtools/cmake/cmake-native_3.22.3.bb
+++ b/meta/recipes-devtools/cmake/cmake-native_3.22.3.bb
@@ -49,7 +49,7 @@ do_compile() {
do_install() {
oe_runmake 'DESTDIR=${D}' install
- # The following codes are here because eSDK needs to provide compatibilty
+ # The following codes are here because eSDK needs to provide compatibility
# for SDK. That is, eSDK could also be used like traditional SDK.
mkdir -p ${D}${datadir}/cmake
install -m 644 ${WORKDIR}/OEToolchainConfig.cmake ${D}${datadir}/cmake/
diff --git a/meta/recipes-devtools/cmake/cmake/0001-ctest-Allow-arbitrary-characters-in-test-names-of-CT.patch b/meta/recipes-devtools/cmake/cmake/0001-ctest-Allow-arbitrary-characters-in-test-names-of-CT.patch
new file mode 100644
index 0000000000..10fc4f545e
--- /dev/null
+++ b/meta/recipes-devtools/cmake/cmake/0001-ctest-Allow-arbitrary-characters-in-test-names-of-CT.patch
@@ -0,0 +1,205 @@
+From 4f992e105bf4a85062bb439ca63daefc8a992f94 Mon Sep 17 00:00:00 2001
+From: John Drouhard <john@drouhard.dev>
+Date: Thu, 9 Jan 2025 20:34:42 -0600
+Subject: [PATCH] ctest: Allow arbitrary characters in test names of
+ CTestCostData.txt
+
+This changes the way lines in CTestCostData.txt are parsed to allow for
+spaces in the test name.
+
+It does so by looking for space characters from the end; and once two
+have been found, assumes everything from the beginning up to that
+second-to-last-space is the test name.
+
+Additionally, parsing the file should be much more efficient since there
+is no string or vector heap allocation per line. The std::string used by
+the parse function to convert the int and float should be within most
+standard libraries' small string optimization.
+
+Fixes: #26594
+
+Upstream-Status: Backport [4.0.0, 040da7d83216ace59710407e8ce35d5fd38e1340]
+Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
+---
+ Source/CTest/cmCTestMultiProcessHandler.cxx | 80 +++++++++++++++------
+ Source/CTest/cmCTestMultiProcessHandler.h | 3 +-
+ Tests/CTestTestScheduler/CMakeLists.txt | 4 +-
+ 3 files changed, 64 insertions(+), 23 deletions(-)
+
+diff --git a/Source/CTest/cmCTestMultiProcessHandler.cxx b/Source/CTest/cmCTestMultiProcessHandler.cxx
+index d90c4a64651e4d53cc219abe76cb10a342e8aa35..311d2368bcc99abfb4b61c77032b26a440bc5bde 100644
+--- a/Source/CTest/cmCTestMultiProcessHandler.cxx
++++ b/Source/CTest/cmCTestMultiProcessHandler.cxx
+@@ -19,6 +19,7 @@
+ #include <vector>
+
+ #include <cm/memory>
++#include <cm/string_view>
+ #include <cmext/algorithm>
+
+ #include <cm3p/json/value.h>
+@@ -41,6 +42,51 @@
+ #include "cmUVSignalHackRAII.h" // IWYU pragma: keep
+ #include "cmWorkingDirectory.h"
+
++namespace {
++
++struct CostEntry
++{
++ cm::string_view name;
++ int prevRuns;
++ float cost;
++};
++
++cm::optional<CostEntry> splitCostLine(cm::string_view line)
++{
++ std::string part;
++ cm::string_view::size_type pos1 = line.size();
++ cm::string_view::size_type pos2 = line.find_last_of(' ', pos1);
++ auto findNext = [line, &part, &pos1, &pos2]() -> bool {
++ if (pos2 != cm::string_view::npos) {
++ cm::string_view sub = line.substr(pos2 + 1, pos1 - pos2 - 1);
++ part.assign(sub.begin(), sub.end());
++ pos1 = pos2;
++ if (pos1 > 0) {
++ pos2 = line.find_last_of(' ', pos1 - 1);
++ }
++ return true;
++ }
++ return false;
++ };
++
++ // parse the cost
++ if (!findNext()) {
++ return cm::nullopt;
++ }
++ float cost = static_cast<float>(atof(part.c_str()));
++
++ // parse the previous runs
++ if (!findNext()) {
++ return cm::nullopt;
++ }
++ int prev = atoi(part.c_str());
++
++ // from start to the last found space is the name
++ return CostEntry{ line.substr(0, pos1), prev, cost };
++}
++
++}
++
+ namespace cmsys {
+ class RegularExpression;
+ }
+@@ -691,24 +737,21 @@ void cmCTestMultiProcessHandler::UpdateCostData()
+ if (line == "---") {
+ break;
+ }
+- std::vector<std::string> parts = cmSystemTools::SplitString(line, ' ');
+ // Format: <name> <previous_runs> <avg_cost>
+- if (parts.size() < 3) {
++ cm::optional<CostEntry> entry = splitCostLine(line);
++ if (!entry) {
+ break;
+ }
+
+- std::string name = parts[0];
+- int prev = atoi(parts[1].c_str());
+- float cost = static_cast<float>(atof(parts[2].c_str()));
+-
+- int index = this->SearchByName(name);
++ int index = this->SearchByName(entry->name);
+ if (index == -1) {
+ // This test is not in memory. We just rewrite the entry
+- fout << name << " " << prev << " " << cost << "\n";
++ fout << entry->name << " " << entry->prevRuns << " " << entry->cost
++ << "\n";
+ } else {
+ // Update with our new average cost
+- fout << name << " " << this->Properties[index]->PreviousRuns << " "
+- << this->Properties[index]->Cost << "\n";
++ fout << entry->name << " " << this->Properties[index]->PreviousRuns
++ << " " << this->Properties[index]->Cost << "\n";
+ temp.erase(index);
+ }
+ }
+@@ -744,28 +787,25 @@ void cmCTestMultiProcessHandler::ReadCostData()
+ break;
+ }
+
+- std::vector<std::string> parts = cmSystemTools::SplitString(line, ' ');
++ // Format: <name> <previous_runs> <avg_cost>
++ cm::optional<CostEntry> entry = splitCostLine(line);
+
+ // Probably an older version of the file, will be fixed next run
+- if (parts.size() < 3) {
++ if (!entry) {
+ fin.close();
+ return;
+ }
+
+- std::string name = parts[0];
+- int prev = atoi(parts[1].c_str());
+- float cost = static_cast<float>(atof(parts[2].c_str()));
+-
+- int index = this->SearchByName(name);
++ int index = this->SearchByName(entry->name);
+ if (index == -1) {
+ continue;
+ }
+
+- this->Properties[index]->PreviousRuns = prev;
++ this->Properties[index]->PreviousRuns = entry->prevRuns;
+ // When not running in parallel mode, don't use cost data
+ if (this->ParallelLevel > 1 && this->Properties[index] &&
+ this->Properties[index]->Cost == 0) {
+- this->Properties[index]->Cost = cost;
++ this->Properties[index]->Cost = entry->cost;
+ }
+ }
+ // Next part of the file is the failed tests
+@@ -778,7 +818,7 @@ void cmCTestMultiProcessHandler::ReadCostData()
+ }
+ }
+
+-int cmCTestMultiProcessHandler::SearchByName(std::string const& name)
++int cmCTestMultiProcessHandler::SearchByName(cm::string_view name)
+ {
+ int index = -1;
+
+diff --git a/Source/CTest/cmCTestMultiProcessHandler.h b/Source/CTest/cmCTestMultiProcessHandler.h
+index 5de42f9e3209f4b7f0e856afc458e8b4a35d87b7..11e995d9e06ba9fdb0e086dc3e5e4175f8158cd0 100644
+--- a/Source/CTest/cmCTestMultiProcessHandler.h
++++ b/Source/CTest/cmCTestMultiProcessHandler.h
+@@ -10,6 +10,7 @@
+ #include <string>
+ #include <vector>
+
++#include <cm/string_view>
+ #include <cm3p/uv.h>
+ #include <stddef.h>
+
+@@ -111,7 +112,7 @@ protected:
+ void UpdateCostData();
+ void ReadCostData();
+ // Return index of a test based on its name
+- int SearchByName(std::string const& name);
++ int SearchByName(cm::string_view name);
+
+ void CreateTestCostList();
+
+diff --git a/Tests/CTestTestScheduler/CMakeLists.txt b/Tests/CTestTestScheduler/CMakeLists.txt
+index a3f0f27cdcb901bb309bb6cb6cd9307ce1ba20a2..daf6ce2b23d8c048334ae1047759130b246dccef 100644
+--- a/Tests/CTestTestScheduler/CMakeLists.txt
++++ b/Tests/CTestTestScheduler/CMakeLists.txt
+@@ -1,9 +1,9 @@
+-cmake_minimum_required (VERSION 2.8.12)
++cmake_minimum_required(VERSION 3.19)
+ project (CTestTestScheduler)
+ include (CTest)
+
+ add_executable (Sleep sleep.c)
+
+ foreach (time RANGE 1 4)
+- add_test (TestSleep${time} Sleep ${time})
++ add_test ("TestSleep ${time}" Sleep ${time})
+ endforeach ()
diff --git a/meta/recipes-devtools/cmake/cmake_3.22.3.bb b/meta/recipes-devtools/cmake/cmake_3.22.3.bb
index 752c37ba7d..04a0f0e793 100644
--- a/meta/recipes-devtools/cmake/cmake_3.22.3.bb
+++ b/meta/recipes-devtools/cmake/cmake_3.22.3.bb
@@ -10,6 +10,7 @@ SRC_URI:append:class-nativesdk = " \
file://cmake-setup.py \
file://environment.d-cmake.sh \
file://0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch \
+ file://0001-ctest-Allow-arbitrary-characters-in-test-names-of-CT.patch \
"
LICENSE:append = " & BSD-1-Clause & MIT"
--
2.43.0
^ permalink raw reply related [flat|nested] 20+ messages in thread