On Tue Sep 29, 2026 at 10:50 PM CEST, Jason Stasiak via lists.openembedded.org
wrote:
> Backport fix for CVE-2026-1801 from meta-oe to OE-core. Update CVE
> patch to restore the chunked server validation unit test from the
> upstream libsoup3 patch (b9a1c0663ff8ab6e79715db4b35b54f560416ddd).
>
> (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
>
> Signed-off-by: Jason Stasiak <[email protected]>
> ---
> .../libsoup/libsoup-2.4/CVE-2026-1801.patch | 217 ++++++++++++++++++
> .../libsoup/libsoup-2.4_2.74.3.bb | 1 +
> 2 files changed, 218 insertions(+)
> create mode 100644
> meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch
>
> diff --git a/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch
> b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch
> new file mode 100644
> index 0000000000..13666b6d87
> --- /dev/null
> +++ b/meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch
> @@ -0,0 +1,217 @@
> +From f9c933e258e9ef2f221cca6395f8092a1c4b93dd Mon Sep 17 00:00:00 2001
> +From: Changqing Li <[email protected]>
> +Date: Thu, 19 Mar 2026 17:10:36 +0800
> +Subject: [PATCH 2/4] Fix CVE-2026-1801
> +
> +This patch merges 3 upstream patches
> +
> +Chery-pick the first two patches to make the context is the same as the
> +third patch that fix CVE-2026-1801
> +
> +Upstream-Status: Backport
> +[https://gitlab.gnome.org/GNOME/libsoup/-/commit/1e32b5e123aa1689505472bdbfcbd897eac41977,
> +https://gitlab.gnome.org/GNOME/libsoup/-/commit/8a2e15c88512ae4517d2c2c887d39299725b22da,
> +https://gitlab.gnome.org/GNOME/libsoup/-/commit/b9a1c0663ff8ab6e79715db4b35b54f560416ddd]
> +CVE: CVE-2026-1801
> +
> +Signed-off-by: Changqing Li <[email protected]>
> +
> +Backport the chunked server validation unit test from the upstream
> +libsoup3 patch (b9a1c0663ff8ab6e79715db4b35b54f560416ddd).
> +
> +Signed-off-by: Jason Stasiak <[email protected]>
Hello,
This patch has formating issues:
> +---
> + libsoup/soup-body-input-stream.c | 66 +++++++++++++++++++------------
> + tests/server-test.c | 67 ++++++++++++++++++++++++++++++++
> + 2 files changed, 108 insertions(+), 25 deletions(-)
> +
> +diff --git a/libsoup/soup-body-input-stream.c
> b/libsoup/soup-body-input-stream.c
> +index 6b95884..25d9312 100644
> +--- a/libsoup/soup-body-input-stream.c
> ++++ b/libsoup/soup-body-input-stream.c
> +@@ -159,15 +159,18 @@ soup_body_input_stream_read_chunked
> (SoupBodyInputStream *bistream,
> + again:
> + switch (bistream->priv->chunked_state) {
> + case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_SIZE:
> +- nread = soup_filter_input_stream_read_line (
> +- fstream, metabuf, sizeof (metabuf), blocking,
> +- &got_line, cancellable, error);
> +- if (nread <= 0)
> ++ nread = soup_filter_input_stream_read_until (
> ++ fstream, metabuf, sizeof (metabuf),
> ++ "\r\n", 2, blocking, TRUE,
> ++ &got_line, cancellable, error);
> ++ if (nread < 0)
> + return nread;
> +- if (!got_line) {
> +- g_set_error_literal (error, G_IO_ERROR,
> +- G_IO_ERROR_PARTIAL_INPUT,
> +- _("Connection terminated
> unexpectedly"));
> ++ if (nread == 0 || !got_line) {
> ++ if (error && *error == NULL) {
> ++ g_set_error_literal (error, G_IO_ERROR,
> ++
> G_IO_ERROR_PARTIAL_INPUT,
> ++
> ("Connection terminated unexpectedly"));
> ++ }
> + return -1;
> + }
> +
^
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:58
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Other issues:
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:60
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:74
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:100
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:103
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:115
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:137
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:212
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Error: Malformed patch line at
meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch:214
Line content: '\n'
Context lines must start with exactly one space. This line is missing its
prefix.
Regards,
--
Yoann Congal
Smile ECS
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#247021):
https://lists.openembedded.org/g/openembedded-core/message/247021
Mute This Topic: https://lists.openembedded.org/mt/121498016/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
