mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-08 05:09:24 +00:00
Code Issues Projects Releases Wiki Activity

libsoup: fix CVE-2024-52531

Browse Source 
CVE-2024-52531:
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that
perform conversion to UTF-8 in soup_header_parse_param_list_strict.
Input received over the network cannot trigger this.

Refer:
https://nvd.nist.gov/vuln/detail/CVE-2024-52531
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/

(From OE-Core rev: 1159c7ef071fa2849f44e921c9b7c27fcbb6bfb3)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Changqing Li
2024-11-28 09:46:56 +08:00
committed by Steve Sakoman
parent 1eddf2a87f
commit e8c505f7a4
4 changed files with 295 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/libsoup/libsoup/CVE-2024-52531-1.patch
+116
View File
@@ -0,0 +1,116 @@
From 4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede Mon Sep 17 00:00:00 2001
From: Patrick Griffis <pgriffis@igalia.com>
Date: Tue, 27 Aug 2024 12:18:58 -0500
Subject: [PATCH] fuzzing: Cover soup_header_parse_param_list
CVE: CVE-2024-52531
Upstream-Status: Backport
[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede]
Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
fuzzing/fuzz.h | 9 +++++++--
fuzzing/fuzz_header_parsing.c | 19 +++++++++++++++++++
fuzzing/fuzz_header_parsing.dict | 8 ++++++++
fuzzing/meson.build | 2 ++
4 files changed, 36 insertions(+), 2 deletions(-)
create mode 100644 fuzzing/fuzz_header_parsing.c
create mode 100644 fuzzing/fuzz_header_parsing.dict
diff --git a/fuzzing/fuzz.h b/fuzzing/fuzz.h
index 0d380285..f3bd28ee 100644
--- a/fuzzing/fuzz.h
+++ b/fuzzing/fuzz.h
@@ -1,13 +1,14 @@
#include "libsoup/soup.h"
int LLVMFuzzerTestOneInput (const unsigned char *data, size_t size);
+static int set_logger = 0;
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
static GLogWriterOutput
empty_logging_func (GLogLevelFlags log_level, const GLogField *fields,
gsize n_fields, gpointer user_data)
{
- return G_LOG_WRITER_HANDLED;
+ return G_LOG_WRITER_HANDLED;
}
#endif
@@ -16,6 +17,10 @@ static void
fuzz_set_logging_func (void)
{
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
- g_log_set_writer_func (empty_logging_func, NULL, NULL);
+ if (!set_logger)
+ {
+ set_logger = 1;
+ g_log_set_writer_func (empty_logging_func, NULL, NULL);
+ }
#endif
}
diff --git a/fuzzing/fuzz_header_parsing.c b/fuzzing/fuzz_header_parsing.c
new file mode 100644
index 00000000..a8e5c1f9
--- /dev/null
+++ b/fuzzing/fuzz_header_parsing.c
@@ -0,0 +1,19 @@
+#include "fuzz.h"
+
+int
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
+{
+ GHashTable *elements;
+
+ // We only accept NUL terminated strings
+ if (!size || data[size - 1] != '\0')
+ return 0;
+
+ fuzz_set_logging_func ();
+
+ elements = soup_header_parse_param_list((char*)data);
+
+ g_hash_table_unref(elements);
+
+ return 0;
+}
\ No newline at end of file
diff --git a/fuzzing/fuzz_header_parsing.dict b/fuzzing/fuzz_header_parsing.dict
new file mode 100644
index 00000000..1562ca3a
--- /dev/null
+++ b/fuzzing/fuzz_header_parsing.dict
@@ -0,0 +1,8 @@
+"*=UTF-8''"
+"*=iso-8859-1''"
+"'"
+"''"
+"="
+"*="
+"""
+";"
\ No newline at end of file
diff --git a/fuzzing/meson.build b/fuzzing/meson.build
index b14cbb50..5dd0f417 100644
--- a/fuzzing/meson.build
+++ b/fuzzing/meson.build
@@ -5,6 +5,7 @@ fuzz_targets = [
'fuzz_cookie_parse',
'fuzz_content_sniffer',
'fuzz_date_time',
+ 'fuzz_header_parsing',
]
fuzzing_args = '-fsanitize=fuzzer,address,undefined'
@@ -34,6 +35,7 @@ if have_fuzzing and (fuzzing_feature.enabled() or fuzzing_feature.auto())
'-runs=200000',
'-artifact_prefix=meson-logs/' + target + '-',
'-print_final_stats=1',
+ '-max_len=4096',
] + extra_args,
env: [
'ASAN_OPTIONS=fast_unwind_on_malloc=0',
--
2.25.1
meta/recipes-support/libsoup/libsoup/CVE-2024-52531-2.patch
+40
View File
@@ -0,0 +1,40 @@
From 825fda3425546847b42ad5270544e9388ff349fe Mon Sep 17 00:00:00 2001
From: Patrick Griffis <pgriffis@igalia.com>
Date: Tue, 27 Aug 2024 13:52:08 -0500
Subject: [PATCH] tests: Add test for passing invalid UTF-8 to
soup_header_parse_semi_param_list()
CVE: CVE-2024-52531
Upstream-Status: Backport
[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=825fda3425546847b42ad5270544e9388ff349fe]
Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
tests/header-parsing-test.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
index 715c2c6f..5e423d2b 100644
--- a/tests/header-parsing-test.c
+++ b/tests/header-parsing-test.c
@@ -825,6 +825,17 @@ static struct ParamListTest {
{ "filename", "t\xC3\xA9st.txt" },
},
},
+
+ /* This tests invalid UTF-8 data which *should* never be passed here but it was designed to be robust against it. */
+ { TRUE,
+ "invalid*=\x69\x27\x27\x93\x93\x93\x93\xff\x61\x61\x61\x61\x61\x61\x61\x62\x63\x64\x65\x0a; filename*=iso-8859-1''\x69\x27\x27\x93\x93\x93\x93\xff\x61\x61\x61\x61\x61\x61\x61\x62\x63\x64\x65\x0a; foo",
+ {
+ { "filename", "i''\302\223\302\223\302\223\302\223\303\277aaaaaaabcde" },
+ { "invalid", "\302\223\302\223\302\223\302\223\303\277aaaaaaabcde" },
+ { "foo", NULL },
+
+ },
+ }
};
static const int num_paramlisttests = G_N_ELEMENTS (paramlisttests);
--
2.25.1
meta/recipes-support/libsoup/libsoup/CVE-2024-52531-3.patch
+136
View File
@@ -0,0 +1,136 @@
From a35222dd0bfab2ac97c10e86b95f762456628283 Mon Sep 17 00:00:00 2001
From: Patrick Griffis <pgriffis@igalia.com>
Date: Tue, 27 Aug 2024 13:53:26 -0500
Subject: [PATCH] headers: Be more robust against invalid input when parsing
params
If you pass invalid input to a function such as soup_header_parse_param_list_strict()
it can cause an overflow if it decodes the input to UTF-8.
This should never happen with valid UTF-8 input which libsoup's client API
ensures, however it's server API does not currently.
CVE: CVE-2024-52531
Upstream-Status: Backport
[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=a35222dd0bfab2ac97c10e86b95f762456628283]
Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
libsoup/soup-headers.c | 46 ++++++++++++++++++++++--------------------
1 file changed, 24 insertions(+), 22 deletions(-)
diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
index f30ee467..613e1905 100644
--- a/libsoup/soup-headers.c
+++ b/libsoup/soup-headers.c
@@ -646,8 +646,9 @@ soup_header_contains (const char *header, const char *token)
}
static void
-decode_quoted_string (char *quoted_string)
+decode_quoted_string_inplace (GString *quoted_gstring)
{
+ char *quoted_string = quoted_gstring->str;
char *src, *dst;
src = quoted_string + 1;
@@ -661,10 +662,11 @@ decode_quoted_string (char *quoted_string)
}
static gboolean
-decode_rfc5987 (char *encoded_string)
+decode_rfc5987_inplace (GString *encoded_gstring)
{
char *q, *decoded;
gboolean iso_8859_1 = FALSE;
+ const char *encoded_string = encoded_gstring->str;
q = strchr (encoded_string, '\'');
if (!q)
@@ -696,14 +698,7 @@ decode_rfc5987 (char *encoded_string)
decoded = utf8;
}
- /* If encoded_string was UTF-8, then each 3-character %-escape
- * will be converted to a single byte, and so decoded is
- * shorter than encoded_string. If encoded_string was
- * iso-8859-1, then each 3-character %-escape will be
- * converted into at most 2 bytes in UTF-8, and so it's still
- * shorter.
- */
- strcpy (encoded_string, decoded);
+ g_string_assign (encoded_gstring, decoded);
g_free (decoded);
return TRUE;
}
@@ -713,15 +708,17 @@ parse_param_list (const char *header, char delim, gboolean strict)
{
GHashTable *params;
GSList *list, *iter;
- char *item, *eq, *name_end, *value;
- gboolean override, duplicated;
params = g_hash_table_new_full (soup_str_case_hash,
soup_str_case_equal,
- g_free, NULL);
+ g_free, g_free);
list = parse_list (header, delim);
for (iter = list; iter; iter = iter->next) {
+ char *item, *eq, *name_end;
+ gboolean override, duplicated;
+ GString *parsed_value = NULL;
+
item = iter->data;
override = FALSE;
@@ -736,19 +733,19 @@ parse_param_list (const char *header, char delim, gboolean strict)
*name_end = '\0';
- value = (char *)skip_lws (eq + 1);
+ parsed_value = g_string_new ((char *)skip_lws (eq + 1));
if (name_end[-1] == '*' && name_end > item + 1) {
name_end[-1] = '\0';
- if (!decode_rfc5987 (value)) {
+ if (!decode_rfc5987_inplace (parsed_value)) {
+ g_string_free (parsed_value, TRUE);
g_free (item);
continue;
}
override = TRUE;
- } else if (*value == '"')
- decode_quoted_string (value);
- } else
- value = NULL;
+ } else if (parsed_value->str[0] == '"')
+ decode_quoted_string_inplace (parsed_value);
+ }
duplicated = g_hash_table_lookup_extended (params, item, NULL, NULL);
@@ -756,11 +753,16 @@ parse_param_list (const char *header, char delim, gboolean strict)
soup_header_free_param_list (params);
params = NULL;
g_slist_foreach (iter, (GFunc)g_free, NULL);
+ if (parsed_value)
+ g_string_free (parsed_value, TRUE);
break;
- } else if (override || !duplicated)
- g_hash_table_replace (params, item, value);
- else
+ } else if (override || !duplicated) {
+ g_hash_table_replace (params, item, parsed_value ? g_string_free (parsed_value, FALSE) : NULL);
+ } else {
+ if (parsed_value)
+ g_string_free (parsed_value, TRUE);
g_free (item);
+ }
}
g_slist_free (list);
--
2.25.1
meta/recipes-support/libsoup/libsoup_3.0.7.bb
+3
View File
@@ -15,6 +15,9 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2024-52530.patch \
file://CVE-2024-52532-1.patch \
file://CVE-2024-52532-2.patch \
file://CVE-2024-52531-1.patch \
file://CVE-2024-52531-2.patch \
file://CVE-2024-52531-3.patch \
"
SRC_URI[sha256sum] = "ebdf90cf3599c11acbb6818a9d9e3fc9d2c68e56eb829b93962972683e1bf7c8"