[AutoPR- Security] Patch libsoup for CVE-2026-1760, CVE-2026-2443, CVE-2026-2369 [MEDIUM]

SPECS/libsoup/CVE-2025-2784.patch

@@ -10,12 +10,12 @@ https://gitlab.gnome.org/GNOME/libsoup/-/commit/c415ad0b6771992e66c70edf373566c6
  .../content-sniffer/soup-content-sniffer.c    | 10 +--
  libsoup/soup-session.c                        |  6 ++
  tests/auth-test.c                             | 76 +++++++++++++++++++
- tests/meson.build                             |  3 +
+ tests/meson.build                             |  4 +-
  tests/sniffing-test.c                         | 48 ++++++++++++
- 5 files changed, 138 insertions(+), 5 deletions(-)
+ 5 files changed, 138 insertions(+), 6 deletions(-)
 
 diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
-index f6629ad..3c072c1 100644
+index 243d52e..4b4bbb0 100644
 --- a/libsoup/content-sniffer/soup-content-sniffer.c
 +++ b/libsoup/content-sniffer/soup-content-sniffer.c
 @@ -630,8 +630,11 @@ sniff_text_or_binary (SoupContentSniffer *sniffer, GBytes *buffer)
@@ -162,13 +162,14 @@ index 5dbc319..51431f2 100644
  main (int argc, char **argv)
  {
 diff --git a/tests/meson.build b/tests/meson.build
-index fc1cb3f..ff94a4f 100644
+index fc1cb3f..946395d 100644
 --- a/tests/meson.build
 +++ b/tests/meson.build
-@@ -91,6 +91,9 @@ tests = [
+@@ -90,7 +90,9 @@ tests = [
+   {'name': 'session'},
    {'name': 'server-auth'},
    {'name': 'server'},
-   {'name': 'sniffing'},
+-  {'name': 'sniffing'},
 +  {'name': 'sniffing',
 +    'depends': [test_resources],
 +  },
@@ -242,5 +243,5 @@ index 6116719..7857732 100644
 
  	g_uri_unref (base_uri);
 -- 
-2.45.3
+2.45.4
 

SPECS/libsoup/CVE-2025-32050.patch

@@ -10,10 +10,10 @@ https://gitlab.gnome.org/GNOME/libsoup/-/commit/9bb0a55de55c6940ced811a64fbca82f
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index 8382b8f..4468415 100644
+index 13fe683..40df826 100644
 --- a/libsoup/soup-headers.c
 +++ b/libsoup/soup-headers.c
-@@ -907,7 +907,7 @@ append_param_quoted (GString    *string,
+@@ -912,7 +912,7 @@ append_param_quoted (GString    *string,
  		     const char *name,
  		     const char *value)
  {
@@ -23,5 +23,5 @@ index 8382b8f..4468415 100644
  	g_string_append (string, name);
  	g_string_append (string, "=\"");
 -- 
-2.45.3
+2.45.4
 

SPECS/libsoup/CVE-2025-32051.patch

@@ -12,18 +12,18 @@ https://gitlab.gnome.org/GNOME/libsoup/-/commit/0713ba4a719da938dc8facc89fca99cd
  1 file changed, 11 insertions(+)
 
 diff --git a/libsoup/soup-uri-utils.c b/libsoup/soup-uri-utils.c
-index be2b79b..ad70fe6 100644
+index 8fea9a6..ce9b2a1 100644
 --- a/libsoup/soup-uri-utils.c
 +++ b/libsoup/soup-uri-utils.c
-@@ -286,6 +286,7 @@ soup_uri_decode_data_uri (const char *uri,
+@@ -294,6 +294,7 @@ soup_uri_decode_data_uri (const char *uri,
          gboolean base64 = FALSE;
          char *uri_string;
          GBytes *bytes;
 +        const char *path;
 
          g_return_val_if_fail (uri != NULL, NULL);
 
-@@ -300,9 +301,19 @@ soup_uri_decode_data_uri (const char *uri,
+@@ -308,9 +309,19 @@ soup_uri_decode_data_uri (const char *uri,
 
          if (content_type)
                  *content_type = NULL;
@@ -44,5 +44,5 @@ index be2b79b..ad70fe6 100644
          start = uri_string + 5;
          comma = strchr (start, ',');
 -- 
-2.45.3
+2.45.4
 

SPECS/libsoup/CVE-2025-32052.patch

@@ -12,10 +12,10 @@ https://gitlab.gnome.org/GNOME/libsoup/-/commit/f182429e5b1fc034050510da20c93256
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
-index 150d285..a772c7c 100644
+index 4b4bbb0..3c072c1 100644
 --- a/libsoup/content-sniffer/soup-content-sniffer.c
 +++ b/libsoup/content-sniffer/soup-content-sniffer.c
-@@ -529,7 +529,7 @@ sniff_unknown (SoupContentSniffer *sniffer, GBytes *buffer,
+@@ -521,7 +521,7 @@ sniff_unknown (SoupContentSniffer *sniffer, GBytes *buffer,
  			guint index_pattern = 0;
  			gboolean skip_row = FALSE;
 
@@ -25,5 +25,5 @@ index 150d285..a772c7c 100644
  				/* Skip insignificant white space ("WS" in the spec) */
  				if (type_row->pattern[index_pattern] == ' ') {
 -- 
-2.45.3
+2.45.4
 

SPECS/libsoup/CVE-2025-32053.patch

@@ -10,10 +10,10 @@ Upstream patch reference: https://gitlab.gnome.org/GNOME/libsoup/-/commit/eaed42
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
-index b62e4888..5a181ff1 100644
+index 3c072c1..55e5754 100644
 --- a/libsoup/content-sniffer/soup-content-sniffer.c
 +++ b/libsoup/content-sniffer/soup-content-sniffer.c
-@@ -641,7 +641,7 @@ skip_insignificant_space (const char *resource, int *pos, int resource_length)
+@@ -641,7 +641,7 @@ skip_insignificant_space (const char *resource, gsize *pos, gsize resource_lengt
  	       (resource[*pos] == '\x0D')) {
  		*pos = *pos + 1;
 
@@ -22,7 +22,7 @@ index b62e4888..5a181ff1 100644
  			return TRUE;
  	}
 
-@@ -704,7 +704,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, GBytes *buffer)
+@@ -701,7 +701,7 @@ sniff_feed_or_html (SoupContentSniffer *sniffer, GBytes *buffer)
  		do {
  			pos++;
 
@@ -32,5 +32,5 @@ index b62e4888..5a181ff1 100644
  		} while (resource[pos] != '>');
 
 -- 
-GitLab
+2.45.4
 

SPECS/libsoup/CVE-2025-32907.patch

@@ -10,11 +10,13 @@ Closes #428
 
 Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452>
 Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452/diffs?commit_id=9bb92f7a685e31e10e9e8221d0342280432ce836
+https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452/diffs?commit_id=eeace39ec686094ff6a05a43e5fce06e9c37f376
 ---
  libsoup/soup-message-headers.c |   1 +
+ meson.build                    |   4 +
  tests/meson.build              |   1 +
- tests/server-mem-limit-test.c  | 144 +++++++++++++++++++++++++++++++++
- 3 files changed, 146 insertions(+)
+ tests/server-mem-limit-test.c  | 149 +++++++++++++++++++++++++++++++++
+ 4 files changed, 155 insertions(+)
  create mode 100644 tests/server-mem-limit-test.c
 
 diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
@@ -29,8 +31,23 @@ index c5168ea..9123dc1 100644
  			}
  		}
  	}
+diff --git a/meson.build b/meson.build
+index ff5dc95..5ed4125 100644
+--- a/meson.build
++++ b/meson.build
+@@ -389,6 +389,10 @@ configinc = include_directories('.')
+
+ prefix = get_option('prefix')
+
++if get_option('b_sanitize') != 'none'
++  cdata.set_quoted('B_SANITIZE_OPTION', get_option('b_sanitize'))
++endif
++
+ cdata.set_quoted('PACKAGE_VERSION', soup_version)
+ cdata.set_quoted('LOCALEDIR', join_paths(prefix, get_option('localedir')))
+ cdata.set_quoted('GETTEXT_PACKAGE', libsoup_api_name)
 diff --git a/tests/meson.build b/tests/meson.build
-index ff94a4f..d78df11 100644
+index 946395d..bf85f2b 100644
 --- a/tests/meson.build
 +++ b/tests/meson.build
 @@ -89,6 +89,7 @@ tests = [
@@ -39,14 +56,14 @@ index ff94a4f..d78df11 100644
    {'name': 'server-auth'},
 +  {'name': 'server-mem-limit'},
    {'name': 'server'},
-   {'name': 'sniffing'},
    {'name': 'sniffing',
+     'depends': [test_resources],
 diff --git a/tests/server-mem-limit-test.c b/tests/server-mem-limit-test.c
 new file mode 100644
-index 0000000..98f1c40
+index 0000000..65dc875
 --- /dev/null
 +++ b/tests/server-mem-limit-test.c
-@@ -0,0 +1,144 @@
+@@ -0,0 +1,149 @@
 +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*- */
 +/*
 + * Copyright (C) 2025 Red Hat <www.redhat.com>
@@ -145,9 +162,9 @@ index 0000000..98f1c40
 +	return;
 +	#endif
 +
-+	range = g_string_sized_new (99 * 1024);
++	range = g_string_sized_new (60 * 1024);
 +	g_string_append (range, "bytes=1024");
-+	while (range->len < 99 * 1024)
++	while (range->len < 60 * 1024)
 +		g_string_append (range, chunk);
 +
 +	session = soup_test_session_new (NULL);
@@ -175,14 +192,19 @@ index 0000000..98f1c40
 +{
 +	int ret;
 +
-+	test_init (argc, argv, NULL);
-+
-+	#ifndef G_OS_WIN32
-+	struct rlimit new_rlimit = { 1024 * 1024 * 64, 1024 * 1024 * 64 };
++	/* a build with an address sanitizer may crash on mmap() with the limit,
++	   thus skip the limit set in such case, even it may not necessarily
++	   trigger the bug if it regresses */
++	#if !defined(G_OS_WIN32) && !defined(B_SANITIZE_OPTION)
++	struct rlimit new_rlimit = { 1024UL * 1024UL * 1024UL * 2UL, 1024UL * 1024UL * 1024UL * 2UL };
 +	/* limit memory usage, to trigger too large memory allocation abort */
 +	g_assert_cmpint (setrlimit (RLIMIT_DATA, &new_rlimit), ==, 0);
++	#else
++	g_message ("server-mem-limit-test: Running without memory limit");
 +	#endif
 +
++	test_init (argc, argv, NULL);
++
 +	g_test_add ("/server-mem/range-overlaps", ServerData, NULL,
 +		    server_setup, do_ranges_overlaps_test, server_teardown);
 +
@@ -192,70 +214,5 @@ index 0000000..98f1c40
 +	return ret;
 +}
 -- 
-2.34.1
-
-
-From abedf4259b478b2ad5c33af36fb163b5ace821c0 Mon Sep 17 00:00:00 2001
-From: Kevin Lockwood <v-klockwood@microsoft.com>
-Date: Fri, 13 Jun 2025 09:57:54 -0700
-Subject: [PATCH 2/2] server-mem-limit-test: Limit memory usage only when not
- built witha sanitizer
-
-A build with -Db_sanitize=address crashes with failed mmap(), which is done
-inside libasan. The test requires 20.0TB of virtual memory when running with
-the sanitizer, which is beyond unsigned integer limits and may not trigger
-the bug anyway.
-
-Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452>
-Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452/diffs?commit_id=eeace39ec686094ff6a05a43e5fce06e9c37f376
----
- meson.build                   |  4 ++++
- tests/server-mem-limit-test.c | 13 +++++++++----
- 2 files changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index ff5dc95..5ed4125 100644
---- a/meson.build
-+++ b/meson.build
-@@ -389,6 +389,10 @@ configinc = include_directories('.')
-
- prefix = get_option('prefix')
-
-+if get_option('b_sanitize') != 'none'
-+  cdata.set_quoted('B_SANITIZE_OPTION', get_option('b_sanitize'))
-+endif
-+
- cdata.set_quoted('PACKAGE_VERSION', soup_version)
- cdata.set_quoted('LOCALEDIR', join_paths(prefix, get_option('localedir')))
- cdata.set_quoted('GETTEXT_PACKAGE', libsoup_api_name)
-diff --git a/tests/server-mem-limit-test.c b/tests/server-mem-limit-test.c
-index 98f1c40..65dc875 100644
---- a/tests/server-mem-limit-test.c
-+++ b/tests/server-mem-limit-test.c
-@@ -126,14 +126,19 @@ main (int argc, char **argv)
- {
- 	int ret;
-
--	test_init (argc, argv, NULL);
--
--	#ifndef G_OS_WIN32
--	struct rlimit new_rlimit = { 1024 * 1024 * 64, 1024 * 1024 * 64 };
-+	/* a build with an address sanitizer may crash on mmap() with the limit,
-+	   thus skip the limit set in such case, even it may not necessarily
-+	   trigger the bug if it regresses */
-+	#if !defined(G_OS_WIN32) && !defined(B_SANITIZE_OPTION)
-+	struct rlimit new_rlimit = { 1024UL * 1024UL * 1024UL * 2UL, 1024UL * 1024UL * 1024UL * 2UL };
- 	/* limit memory usage, to trigger too large memory allocation abort */
- 	g_assert_cmpint (setrlimit (RLIMIT_DATA, &new_rlimit), ==, 0);
-+	#else
-+	g_message ("server-mem-limit-test: Running without memory limit");
- 	#endif
-
-+	test_init (argc, argv, NULL);
-+
- 	g_test_add ("/server-mem/range-overlaps", ServerData, NULL,
- 		    server_setup, do_ranges_overlaps_test, server_teardown);
-
--- 
-2.34.1
+2.45.4
 

SPECS/libsoup/CVE-2025-32909.patch

@@ -10,10 +10,10 @@ Link: https://gitlab.gnome.org/GNOME/libsoup/-/commit/ba4c3a6f988beff59e45801ab3
  1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
-index 5a181ff1..aeee2e25 100644
+index 55e5754..3d0e831 100644
 --- a/libsoup/content-sniffer/soup-content-sniffer.c
 +++ b/libsoup/content-sniffer/soup-content-sniffer.c
-@@ -243,9 +243,14 @@ sniff_mp4 (SoupContentSniffer *sniffer, GBytes *buffer)
+@@ -240,9 +240,14 @@ sniff_mp4 (SoupContentSniffer *sniffer, GBytes *buffer)
  	gsize resource_length;
  	const char *resource = g_bytes_get_data (buffer, &resource_length);
  	resource_length = MIN (512, resource_length);
@@ -30,5 +30,5 @@ index 5a181ff1..aeee2e25 100644
  	box_size = ((box_size >> 24) |
  		    ((box_size << 8) & 0x00FF0000) |
 -- 
-GitLab
+2.45.4
 

SPECS/libsoup/CVE-2025-4476.patch

@@ -16,10 +16,10 @@ Fixes #440
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c
-index d8bb2910..292f2045 100644
+index 1742903..d3a0ab3 100644
 --- a/libsoup/auth/soup-auth-digest.c
 +++ b/libsoup/auth/soup-auth-digest.c
-@@ -220,7 +220,7 @@ soup_auth_digest_get_protection_space (SoupAuth *auth, GUri *source_uri)
+@@ -235,7 +235,7 @@ soup_auth_digest_get_protection_space (SoupAuth *auth, GUri *source_uri)
  			if (uri &&
                              g_strcmp0 (g_uri_get_scheme (uri), g_uri_get_scheme (source_uri)) == 0 &&
  			    g_uri_get_port (uri) == g_uri_get_port (source_uri) &&
@@ -29,5 +29,5 @@ index d8bb2910..292f2045 100644
  			else
  				dir = NULL;
 -- 
-GitLab
+2.45.4
 

SPECS/libsoup/CVE-2025-46420.patch

@@ -12,10 +12,10 @@ https://gitlab.gnome.org/GNOME/libsoup/-/commit/c9083869ec2a3037e6df4bd86b45c419
  1 file changed, 5 insertions(+), 6 deletions(-)
 
 diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
-index 4468415..d28ddff 100644
+index 40df826..99ff5e9 100644
 --- a/libsoup/soup-headers.c
 +++ b/libsoup/soup-headers.c
-@@ -530,7 +530,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
+@@ -538,7 +538,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
  	GSList *unsorted;
  	QualityItem *array;
  	GSList *sorted, *iter;
@@ -24,7 +24,7 @@ index 4468415..d28ddff 100644
  	const char *param, *equal, *value;
  	double qval;
  	int n;
-@@ -543,9 +543,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
+@@ -551,9 +551,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
  	unsorted = soup_header_parse_list (header);
  	array = g_new0 (QualityItem, g_slist_length (unsorted));
  	for (iter = unsorted, n = 0; iter; iter = iter->next) {
@@ -35,7 +35,7 @@ index 4468415..d28ddff 100644
  			param = skip_lws (semi + 1);
  			if (*param != 'q')
  				continue;
-@@ -577,15 +576,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
+@@ -585,15 +584,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
  		if (qval == 0.0) {
  			if (unacceptable) {
  				*unacceptable = g_slist_prepend (*unacceptable,
@@ -55,5 +55,5 @@ index 4468415..d28ddff 100644
  	qsort (array, n, sizeof (QualityItem), sort_by_qval);
  	sorted = NULL;
 -- 
-2.45.3
+2.45.4