Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsoup for openSUSE:Factory checked in at 2026-08-25 13:19:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsoup (Old) and /work/SRC/openSUSE:Factory/.libsoup.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsoup" Tue Aug 25 13:19:00 2026 rev:172 rq:1373439 version:3.6.6 Changes: -------- --- /work/SRC/openSUSE:Factory/libsoup/libsoup.changes 2026-07-20 09:59:50.141130861 +0200 +++ /work/SRC/openSUSE:Factory/.libsoup.new.1258/libsoup.changes 2026-08-25 13:19:13.677136888 +0200 @@ -1,0 +2,19 @@ +Mon Aug 24 15:06:13 UTC 2026 - Dominique Leuenberger <[email protected]> + +- Fix runtime dependency of libsoup-tests, correctly requiring + libsoup-3_0-0 + +------------------------------------------------------------------- +Thu Aug 20 03:38:19 UTC 2026 - Alynx Zhou <[email protected]> + +- Add libsoup-CVE-2026-12548.patch: Fix heap out-of-bounds read + flaw when parsing multipart HTTP messages. (bsc#1272196, + glgo#GNOME/libsoup!524) + +------------------------------------------------------------------- +Mon Aug 17 10:11:41 UTC 2026 - Zoltan Balogh <[email protected]> + +- Add libsoup-tests subpackage with installed tests + for gnome-desktop-testing-runner + +------------------------------------------------------------------- @@ -4022 +4040,0 @@ - New: ---- libsoup-CVE-2026-12548.patch ----------(New B)---------- New: - Add libsoup-CVE-2026-12548.patch: Fix heap out-of-bounds read flaw when parsing multipart HTTP messages. (bsc#1272196, ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsoup.spec ++++++ --- /var/tmp/diff_new_pack.cS9aA9/_old 2026-08-25 13:19:14.569168299 +0200 +++ /var/tmp/diff_new_pack.cS9aA9/_new 2026-08-25 13:19:14.571168369 +0200 @@ -40,7 +40,8 @@ Patch6: libsoup-CVE-2026-4271.patch # PATCH-FIX-UPSTREAM fix-samsung-tv-playback.patch -- Update the content length decimal value when encoding is set to SOUP_ENCODING_CONTENT_LENGTH Patch7: fix-samsung-tv-playback.patch - +# PATCH-FIX-UPSTREAM libsoup-CVE-2026-12548.patch bsc#1272196, glgo#GNOME/libsoup!524 [email protected] -- Fix heap out-of-bounds read flaw when parsing multipart HTTP messages +Patch8: libsoup-CVE-2026-12548.patch # PATCH-FIX-SLE libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch [email protected] -- Revert upstream e315cf2d to make libsoup build with meson 0.54 for SLE-15-SP4/SP5. Patch1000: libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch @@ -136,6 +137,17 @@ * Server support for Digest and Basic authentication * XML-RPC support +%package tests +Summary: Installed tests for %{name} +Group: Development/Libraries/Other +Requires: %{name}-3_0-0 = %{version} +Requires: gnome-desktop-testing + +%description tests +Installed tests for libsoup (libsoup3), compatible with gnome-desktop-testing-runner. +Tests cover HTTP client/server, authentication, cookies, and TLS. +Run with: gnome-desktop-testing-runner libsoup-3.0 + %lang_package %prep @@ -153,6 +165,7 @@ -D ntlm=disabled \ -D sysprof=disabled \ -D autobahn=disabled \ + -D installed_tests=true \ %{nil} %meson_build @@ -194,5 +207,11 @@ %{_datadir}/vala/vapi/libsoup-%{api_version}.vapi %{_datadir}/vala/vapi/libsoup-%{api_version}.deps +%files tests +%dir %{_libexecdir}/installed-tests +%{_libexecdir}/installed-tests/libsoup-3.0/ +%dir %{_datadir}/installed-tests +%{_datadir}/installed-tests/libsoup-3.0/ + %files lang -f %{name}-3.0.lang ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.cS9aA9/_old 2026-08-25 13:19:14.606169602 +0200 +++ /var/tmp/diff_new_pack.cS9aA9/_new 2026-08-25 13:19:14.610169742 +0200 @@ -1,6 +1,6 @@ -mtime: 1784209660 -commit: 0b94164ede6b8ccc6d762fd653eb57f5dc8fa09d683fffa2647090ff189d313a +mtime: 1787584029 +commit: 229172b82414725c6b259e8277eae4de5b7888fd070da2872a91c2d8c0633a26 url: https://src.opensuse.org/GNOME/libsoup -revision: 0b94164ede6b8ccc6d762fd653eb57f5dc8fa09d683fffa2647090ff189d313a +revision: 229172b82414725c6b259e8277eae4de5b7888fd070da2872a91c2d8c0633a26 projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-24 17:07:09.000000000 +0200 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +osc-collab.* ++++++ libsoup-CVE-2026-12548.patch ++++++ >From 7334c38f1f6aa5e64207cb415cf2509838c52b37 Mon Sep 17 00:00:00 2001 From: Carlos Garcia Campos <[email protected]> Date: Tue, 28 Apr 2026 15:13:39 +0200 Subject: [PATCH] Set a maximum size for the headers buffer Closes #512 --- libsoup/soup-headers.c | 3 +++ libsoup/soup-message-headers-private.h | 2 ++ tests/header-parsing-test.c | 14 ++++++++++++++ 3 files changed, 19 insertions(+) diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c index 28a4c998..6572692b 100644 --- a/libsoup/soup-headers.c +++ b/libsoup/soup-headers.c @@ -46,6 +46,9 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest) g_return_val_if_fail (str != NULL, FALSE); g_return_val_if_fail (dest != NULL, FALSE); + if (len <= 0 || len > MAX_HEADERS_BUFFER_SIZE) + return FALSE; + /* As per RFC 2616 section 19.3, we treat '\n' as the * line terminator, and '\r', if it appears, merely as * ignorable trailing whitespace. diff --git a/libsoup/soup-message-headers-private.h b/libsoup/soup-message-headers-private.h index 3eba92b0..708afe98 100644 --- a/libsoup/soup-message-headers-private.h +++ b/libsoup/soup-message-headers-private.h @@ -10,6 +10,8 @@ G_BEGIN_DECLS +#define MAX_HEADERS_BUFFER_SIZE 256 * 1024 /* 256K */ + typedef enum { SOUP_HEADER_VALUE_UNTRUSTED, SOUP_HEADER_VALUE_TRUSTED diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c index c7520791..53baa28d 100644 --- a/tests/header-parsing-test.c +++ b/tests/header-parsing-test.c @@ -532,6 +532,14 @@ static struct RequestTest { SOUP_STATUS_BAD_REQUEST, NULL, NULL, -1, { { NULL } }, 0 + }, + + { "Header fileds too large", NULL, + "GET / HTTP/1.1\r\n", + (18 + 256) * 1024, + SOUP_STATUS_BAD_REQUEST, + NULL, NULL, -1, + { { NULL } }, 0 } }; static const int num_reqtests = G_N_ELEMENTS (reqtests); @@ -849,6 +857,12 @@ static struct ResponseTest { -1, 0, NULL, { { NULL } } }, + + { "Header fileds too large", NULL, + "HTTP/1.0 200 ok\r\n", (20 + 256) * 1024, + -1, 0, NULL, + { { NULL } } + }, }; static const int num_resptests = G_N_ELEMENTS (resptests); -- GitLab
