mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-07 13:44:50 +00:00
Darsh Kelaiya
627d177c3e
This patch applies the reviewed upstream fix shown in [1]. The advisory identifying the fix is referenced in [2]. [1] https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-34517 Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
66 lines
2.8 KiB
Diff
66 lines
2.8 KiB
Diff
From 70f4c611ec466b6a33f1bce57d5776fac964919f Mon Sep 17 00:00:00 2001
|
|
From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
|
|
Date: Tue, 10 Mar 2026 22:14:02 +0000
|
|
Subject: [PATCH] [PR #12216/9cc4b917 backport][3.13] Check multipart max_size
|
|
during iteration (#12229)
|
|
|
|
**This is a backport of PR #12216 as merged into master
|
|
(9cc4b917c54833a22f65edae7963d16a6eeb1f54).**
|
|
|
|
---------
|
|
|
|
CVE: CVE-2026-34517
|
|
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145]
|
|
|
|
Backport Changes:
|
|
- Replaced BodyPartReader.decode_iter() with aiohttp 3.9.5's
|
|
synchronous decode() API. Form-data does not support content
|
|
compression, so this preserves upstream's single-decode behavior
|
|
after bounded chunk reads.
|
|
|
|
Co-authored-by: Sam Bull <git@sambull.org>
|
|
(cherry picked from commit cbb774f38330563422ca0c413a71021d7b944145)
|
|
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
|
|
---
|
|
aiohttp/web_request.py | 19 +++++++++++++------
|
|
1 file changed, 13 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/aiohttp/web_request.py b/aiohttp/web_request.py
|
|
index 2ec09565c..f9de59573 100644
|
|
--- a/aiohttp/web_request.py
|
|
+++ b/aiohttp/web_request.py
|
|
@@ -760,17 +760,24 @@ class BaseRequest(MutableMapping[str, Any], HeadersMixin):
|
|
out.add(field.name, ff)
|
|
else:
|
|
# deal with ordinary data
|
|
- value = await field.read(decode=True)
|
|
+ raw_data = bytearray()
|
|
+ while chunk := await field.read_chunk():
|
|
+ size += len(chunk)
|
|
+ if 0 < max_size < size:
|
|
+ raise HTTPRequestEntityTooLarge(
|
|
+ max_size=max_size, actual_size=size
|
|
+ )
|
|
+ raw_data.extend(chunk)
|
|
+
|
|
+ # aiohttp 3.9.5 has synchronous BodyPartReader.decode()
|
|
+ # and form-data does not support content compression.
|
|
+ value = field.decode(raw_data)
|
|
+
|
|
if field_ct is None or field_ct.startswith("text/"):
|
|
charset = field.get_charset(default="utf-8")
|
|
out.add(field.name, value.decode(charset))
|
|
else:
|
|
out.add(field.name, value)
|
|
- size += len(value)
|
|
- if 0 < max_size < size:
|
|
- raise HTTPRequestEntityTooLarge(
|
|
- max_size=max_size, actual_size=size
|
|
- )
|
|
else:
|
|
raise ValueError(
|
|
"To decode nested multipart you need " "to use custom reader",
|
|
--
|
|
2.35.6
|
|
|