Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsoup for openSUSE:Factory checked in at 2026-09-19 22:19:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsoup (Old) and /work/SRC/openSUSE:Factory/.libsoup.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsoup" Sat Sep 19 22:19:37 2026 rev:173 rq:1378744 version:3.6.6 Changes: -------- --- /work/SRC/openSUSE:Factory/libsoup/libsoup.changes 2026-08-25 13:19:13.677136888 +0200 +++ /work/SRC/openSUSE:Factory/.libsoup.new.383539/libsoup.changes 2026-09-19 22:19:47.584231987 +0200 @@ -1,0 +2,8 @@ +Wed Sep 16 06:35:12 UTC 2026 - Xiaoguang Wang <[email protected]> + +- Add libsoup-CVE-2026-85534.patch: Never send more body bytes than + nghttp2 requested (bsc#1279239, CVE-2026-85534) +- Add libsoup-CVE-2026-85197.patch: fix crash in on_data_read after + connection has been destroyed (bsc#1279238, CVE-2026-85197) + +------------------------------------------------------------------- New: ---- libsoup-CVE-2026-85197.patch libsoup-CVE-2026-85534.patch ----------(New B)---------- New: nghttp2 requested (bsc#1279239, CVE-2026-85534) - Add libsoup-CVE-2026-85197.patch: fix crash in on_data_read after connection has been destroyed (bsc#1279238, CVE-2026-85197) New: - Add libsoup-CVE-2026-85534.patch: Never send more body bytes than nghttp2 requested (bsc#1279239, CVE-2026-85534) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsoup.spec ++++++ --- /var/tmp/diff_new_pack.PCvsKo/_old 2026-09-19 22:19:48.520270712 +0200 +++ /var/tmp/diff_new_pack.PCvsKo/_new 2026-09-19 22:19:48.521270754 +0200 @@ -42,6 +42,10 @@ Patch7: fix-samsung-tv-playback.patch # PATCH-FIX-UPSTREAM libsoup-CVE-2026-12548.patch bsc#1272196, glgo#GNOME/libsoup!524 [email protected] -- Fix heap out-of-bounds read flaw when parsing multipart HTTP messages Patch8: libsoup-CVE-2026-12548.patch +# PATCH-FIX-UPSTREAM libsoup-CVE-2026-85534.patch bsc#1279239 [email protected] -- Never send more body bytes than nghttp2 requested +Patch9: libsoup-CVE-2026-85534.patch +# PATCH-FIX-UPSTREAM libsoup-CVE-2026-85197.patch bsc#1279238 [email protected] -- fix crash in on_data_read after connection has been destroyed +Patch10: libsoup-CVE-2026-85197.patch # PATCH-FIX-SLE libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch [email protected] -- Revert upstream e315cf2d to make libsoup build with meson 0.54 for SLE-15-SP4/SP5. Patch1000: libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.PCvsKo/_old 2026-09-19 22:19:48.551271995 +0200 +++ /var/tmp/diff_new_pack.PCvsKo/_new 2026-09-19 22:19:48.554272119 +0200 @@ -1,6 +1,7 @@ -mtime: 1787584029 -commit: 229172b82414725c6b259e8277eae4de5b7888fd070da2872a91c2d8c0633a26 +mtime: 1789610422 +commit: eb757a42f477245cce235b44e81490497db259eaf8fee3285f161c5eab0ee74c url: https://src.opensuse.org/GNOME/libsoup -revision: 229172b82414725c6b259e8277eae4de5b7888fd070da2872a91c2d8c0633a26 +revision: eb757a42f477245cce235b44e81490497db259eaf8fee3285f161c5eab0ee74c +trackingbranch: factory projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-17 04:00:22.000000000 +0200 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +osc-collab.* ++++++ libsoup-CVE-2026-85197.patch ++++++ >From 0f79525f82f44c2c00c9ce2d9a9c32807aec6bfd Mon Sep 17 00:00:00 2001 From: Eugene Mutavchi <[email protected]> Date: Tue, 19 Aug 2025 20:02:48 +0000 Subject: [PATCH] http2: fix crash in on_data_read after connection has been destroyed wrap the item's cancellable object, so `on_data_read` can be canceled in soup_http2_message_data_close. Also keep a reference to the message cancellable, as the SoupMessage may be updated externally causing us to refer to the wrong cancellable later. Backport of ebf2d8ad8d2507787c286883a02874f0539c0206. Backport of 3bf4a56c2d7e516dd8809f8a4f7a24b22c5b07ba. --- libsoup/http2/soup-client-message-io-http2.c | 32 +++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/libsoup/http2/soup-client-message-io-http2.c b/libsoup/http2/soup-client-message-io-http2.c index 1e8e8a71..3e68409a 100644 --- a/libsoup/http2/soup-client-message-io-http2.c +++ b/libsoup/http2/soup-client-message-io-http2.c @@ -103,6 +103,9 @@ typedef struct { GByteArray *data_source_buffer; GError *data_source_error; gboolean data_source_eof; + GCancellable *data_source_cancellable; + GCancellable *data_source_message_cancellable; + gulong data_source_cancellable_id; SoupClientMessageIOHTTP2 *io; /* Unowned */ SoupMessageIOCompletionFn completion_cb; @@ -1184,6 +1187,14 @@ log_request_data (SoupHTTP2MessageData *data, soup_logger_log_request_data (data->logger, data->msg, (const char *)buffer, len); } +static void +on_data_source_cancelled (GCancellable *cancellable, + gpointer data) +{ + GCancellable *linked_cancellable = G_CANCELLABLE (data); + g_cancellable_cancel (linked_cancellable); +} + static ssize_t on_data_source_read_callback (nghttp2_session *session, int32_t stream_id, @@ -1315,9 +1326,18 @@ on_data_source_read_callback (nghttp2_session *session, } else { h2_debug (data->io, data, "[SEND_BODY] Reading async"); g_byte_array_set_size (data->data_source_buffer, length); + if (!data->data_source_cancellable) { + data->data_source_cancellable = g_cancellable_new (); + if (data->item->cancellable) { + data->data_source_message_cancellable = g_object_ref (data->item->cancellable); + data->data_source_cancellable_id = + g_cancellable_connect (data->data_source_message_cancellable, G_CALLBACK (on_data_source_cancelled), + g_object_ref (data->data_source_cancellable), g_object_unref); + } + } g_input_stream_read_async (in_stream, data->data_source_buffer->data, length, get_data_io_priority (data), - data->item->cancellable, + data->data_source_cancellable, (GAsyncReadyCallback)on_data_read, data); data->io->in_callback--; return NGHTTP2_ERR_DEFERRED; @@ -1402,6 +1422,16 @@ soup_http2_message_data_close (SoupHTTP2MessageData *data) g_clear_object (&data->body_istream); } + if (data->data_source_cancellable_id) { + g_cancellable_disconnect (data->data_source_message_cancellable, data->data_source_cancellable_id); + data->data_source_cancellable_id = 0; + g_clear_object (&data->data_source_message_cancellable); + } + if (data->data_source_cancellable) { + g_cancellable_cancel(data->data_source_cancellable); + g_clear_object(&data->data_source_cancellable); + } + if (data->msg) g_signal_handlers_disconnect_by_data (data->msg, data); -- 2.54.0 ++++++ libsoup-CVE-2026-85534.patch ++++++ >From 4f38c143553c77dc58c9d25ba9cac3ff3598e03c Mon Sep 17 00:00:00 2001 From: Patrick Griffis <[email protected]> Date: Fri, 4 Sep 2026 14:51:13 -0500 Subject: [PATCH] http2: Never send more body bytes than nghttp2 requested When a request body comes from a non-pollable GInputStream, the data is read asynchronously into data_source_buffer and copied out on the next data-source callback. The copy used the buffered length and only asserted that it did not exceed nghttp2's requested length. A peer that shrinks the stream window with a SETTINGS frame after the read was issued makes the callback's length smaller than the buffered amount, so the memcpy wrote past the output buffer (the assertion is compiled out in release builds). Copy at most the requested length and keep the remainder in the buffer for the following callback, only flagging EOF once the buffer is fully drained. A regression test would require an HTTP/2 peer that adversarially shrinks the window mid-upload, which the in-tree server cannot do; existing upload tests confirm the common path is unchanged. Fixes #551 (CVE-2026-85534) --- libsoup/http2/soup-client-message-io-http2.c | 27 +++++++++++++------- 1 file changed, 18 insertions(+), 9 deletions(-) Index: libsoup-3.6.6/libsoup/http2/soup-client-message-io-http2.c =================================================================== --- libsoup-3.6.6.orig/libsoup/http2/soup-client-message-io-http2.c +++ libsoup-3.6.6/libsoup/http2/soup-client-message-io-http2.c @@ -1283,7 +1283,7 @@ on_data_source_read_callback (nghttp2_se } else { GInputStream *in_stream = G_INPUT_STREAM (source->ptr); - /* To support non-pollable input streams we always deffer reads + /* To support non-pollable input streams we always defer reads * and read async into a local buffer. The next time around we will * send that buffer or error. */ @@ -1292,17 +1292,26 @@ on_data_source_read_callback (nghttp2_se guint buffer_len = data->data_source_buffer->len; if (buffer_len) { - if (data->data_source_eof) { - h2_debug (data->io, data, "[SEND_BODY] Sending %zu, EOF", buffer_len); + /* nghttp2 may accept fewer bytes than we buffered, for + * example after the peer shrinks the stream window with + * a SETTINGS frame. + */ + gsize to_send = MIN (buffer_len, length); + gboolean partial = to_send < buffer_len; + + if (data->data_source_eof && !partial) { + h2_debug (data->io, data, "[SEND_BODY] Sending %zu, EOF", to_send); *data_flags |= NGHTTP2_DATA_FLAG_EOF; } else - h2_debug (data->io, data, "[SEND_BODY] Sending %zu", buffer_len); - g_assert (buffer_len <= length); /* QUESTION: Maybe not reliable */ - memcpy (buf, data->data_source_buffer->data, buffer_len); - log_request_data (data, buf, buffer_len); - g_byte_array_set_size (data->data_source_buffer, 0); + h2_debug (data->io, data, "[SEND_BODY] Sending %zu", to_send); + memcpy (buf, data->data_source_buffer->data, to_send); + log_request_data (data, buf, to_send); + if (partial) + g_byte_array_remove_range (data->data_source_buffer, 0, to_send); + else + g_byte_array_set_size (data->data_source_buffer, 0); data->io->in_callback--; - return buffer_len; + return to_send; } else if (data->data_source_eof) { h2_debug (data->io, data, "[SEND_BODY] EOF"); *data_flags |= NGHTTP2_DATA_FLAG_EOF;
