|
| 1 | +From 41e93c07278ce3d2f353c396045d757a7c4ed824 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Milan Crha < [email protected]> |
| 3 | +Date: Mon, 19 May 2025 17:48:27 +0200 |
| 4 | +Subject: [PATCH] soup-multipart: Verify array bounds before accessing its |
| 5 | + members |
| 6 | + |
| 7 | +The boundary could be at a place which, calculated, pointed |
| 8 | +before the beginning of the array. Check the bounds, to avoid |
| 9 | +read out of the array bounds. |
| 10 | + |
| 11 | +Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/447 |
| 12 | + |
| 13 | +Signed-off-by: Azure Linux Security Servicing Account < [email protected]> |
| 14 | +Upstream-reference: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/467.patch |
| 15 | +--- |
| 16 | + libsoup/soup-multipart.c | 2 +- |
| 17 | + tests/multipart-test.c | 22 ++++++++++++++++++++++ |
| 18 | + 2 files changed, 23 insertions(+), 1 deletion(-) |
| 19 | + |
| 20 | +diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c |
| 21 | +index a587fe7..27257e4 100644 |
| 22 | +--- a/libsoup/soup-multipart.c |
| 23 | ++++ b/libsoup/soup-multipart.c |
| 24 | +@@ -104,7 +104,7 @@ find_boundary (const char *start, const char *end, |
| 25 | + continue; |
| 26 | + |
| 27 | + /* Check that it's at start of line */ |
| 28 | +- if (!(b == start || (b[-1] == '\n' && b[-2] == '\r'))) |
| 29 | ++ if (!(b == start || (b - start >= 2 && b[-1] == '\n' && b[-2] == '\r'))) |
| 30 | + continue; |
| 31 | + |
| 32 | + /* Check for "--" or "\r\n" after boundary */ |
| 33 | +diff --git a/tests/multipart-test.c b/tests/multipart-test.c |
| 34 | +index a3a0b36..b07e4db 100644 |
| 35 | +--- a/tests/multipart-test.c |
| 36 | ++++ b/tests/multipart-test.c |
| 37 | +@@ -527,6 +527,27 @@ test_multipart_bounds_bad (void) |
| 38 | + g_bytes_unref (bytes); |
| 39 | + } |
| 40 | + |
| 41 | ++static void |
| 42 | ++test_multipart_bounds_bad_2 (void) |
| 43 | ++{ |
| 44 | ++ SoupMultipart *multipart; |
| 45 | ++ SoupMessageHeaders *headers; |
| 46 | ++ GBytes *bytes; |
| 47 | ++ const char *raw_data = "\n--123\r\nline\r\n--123--\r"; |
| 48 | ++ |
| 49 | ++ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART); |
| 50 | ++ soup_message_headers_append (headers, "Content-Type", "multipart/mixed; boundary=\"123\""); |
| 51 | ++ |
| 52 | ++ bytes = g_bytes_new (raw_data, strlen (raw_data)); |
| 53 | ++ |
| 54 | ++ multipart = soup_multipart_new_from_message (headers, bytes); |
| 55 | ++ g_assert_nonnull (multipart); |
| 56 | ++ |
| 57 | ++ soup_multipart_free (multipart); |
| 58 | ++ soup_message_headers_unref (headers); |
| 59 | ++ g_bytes_unref (bytes); |
| 60 | ++} |
| 61 | ++ |
| 62 | + static void |
| 63 | + test_multipart_too_large (void) |
| 64 | + { |
| 65 | +@@ -595,6 +616,7 @@ main (int argc, char **argv) |
| 66 | + g_test_add_data_func ("/multipart/async-small-reads", GINT_TO_POINTER (ASYNC_MULTIPART_SMALL_READS), test_multipart); |
| 67 | + g_test_add_func ("/multipart/bounds-good", test_multipart_bounds_good); |
| 68 | + g_test_add_func ("/multipart/bounds-bad", test_multipart_bounds_bad); |
| 69 | ++ g_test_add_func ("/multipart/bounds-bad-2", test_multipart_bounds_bad_2); |
| 70 | + g_test_add_func ("/multipart/too-large", test_multipart_too_large); |
| 71 | + |
| 72 | + ret = g_test_run (); |
| 73 | +-- |
| 74 | +2.45.4 |
| 75 | + |
0 commit comments