Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsoup2 for openSUSE:Factory checked in at 2026-08-22 21:33:44 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsoup2 (Old) and /work/SRC/openSUSE:Factory/.libsoup2.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsoup2" Sat Aug 22 21:33:44 2026 rev:26 rq:1372152 version:2.74.3 Changes: -------- --- /work/SRC/openSUSE:Factory/libsoup2/libsoup2.changes 2026-05-31 18:28:45.893277507 +0200 +++ /work/SRC/openSUSE:Factory/.libsoup2.new.1258/libsoup2.changes 2026-08-22 21:33:52.503354421 +0200 @@ -1,0 +2,13 @@ +Thu Aug 20 04:43:24 UTC 2026 - Alynx Zhou <[email protected]> + +- Add libsoup2-CVE-2026-12548.patch: Fix heap out-of-bounds read + flaw when parsing multipart HTTP messages. (bsc#1272196, + glgo#GNOME/libsoup!524) + +------------------------------------------------------------------- +Mon Aug 17 10:11:41 UTC 2026 - Zoltan Balogh <[email protected]> + +- Add libsoup2-tests subpackage with installed tests + for gnome-desktop-testing-runner + +------------------------------------------------------------------- @@ -3520 +3532,0 @@ - New: ---- libsoup2-CVE-2026-12548.patch ----------(New B)---------- New: - Add libsoup2-CVE-2026-12548.patch: Fix heap out-of-bounds read flaw when parsing multipart HTTP messages. (bsc#1272196, ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsoup2.spec ++++++ --- /var/tmp/diff_new_pack.uI6Pu5/_old 2026-08-22 21:33:53.706396704 +0200 +++ /var/tmp/diff_new_pack.uI6Pu5/_new 2026-08-22 21:33:53.708396774 +0200 @@ -108,6 +108,8 @@ Patch40: https://github.com/GNOME/libsoup/commit/35af2342.patch # PATCH-FIX-UPSTREAM libsoup2-CVE-2026-1801.patch bsc#1257649 [email protected] -- Use CRLF as line boundary when parsing chunk encoding data. Patch41: libsoup2-CVE-2026-1801.patch +# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-12548.patch bsc#1272196, glgo#GNOME/libsoup!524 [email protected] -- Fix heap out-of-bounds read flaw when parsing multipart HTTP messages +Patch42: libsoup2-CVE-2026-12548.patch BuildRequires: glib-networking BuildRequires: meson >= 0.50 @@ -205,6 +207,7 @@ -Dgtk_doc=true \ -Dntlm=disabled \ -Dsysprof=disabled \ + -Dinstalled_tests=true \ %{nil} %meson_build @@ -245,5 +248,22 @@ %{_datadir}/vala/vapi/libsoup-2.4.vapi %{_datadir}/vala/vapi/libsoup-2.4.deps +%package tests +Summary: Installed tests for %{name} +Group: Development/Libraries/Other +Requires: %{_name}-2_4-1 = %{version} +Requires: gnome-desktop-testing + +%description tests +Installed tests for libsoup2 (libsoup 2.4), compatible with gnome-desktop-testing-runner. +Tests cover HTTP client/server, GNOME authentication, and TLS. +Run with: gnome-desktop-testing-runner libsoup-2.4 + +%files tests +%dir %{_libexecdir}/installed-tests +%{_libexecdir}/installed-tests/libsoup-2.4/ +%dir %{_datadir}/installed-tests +%{_datadir}/installed-tests/libsoup-2.4/ + %files lang -f %{_name}.lang ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.uI6Pu5/_old 2026-08-22 21:33:53.772399023 +0200 +++ /var/tmp/diff_new_pack.uI6Pu5/_new 2026-08-22 21:33:53.777399199 +0200 @@ -1,6 +1,6 @@ -mtime: 1780084832 -commit: e061d2cdcf2a8e381421df8d18073d5a9fd33553d0d08d96dbf5285ffa0407db +mtime: 1787205793 +commit: 477fc31aece51ac6c883bd5c9d0c9e8282da564593c6c3fdf15e9378f47362a5 url: https://src.opensuse.org/GNOME/libsoup2 -revision: e061d2cdcf2a8e381421df8d18073d5a9fd33553d0d08d96dbf5285ffa0407db +revision: 477fc31aece51ac6c883bd5c9d0c9e8282da564593c6c3fdf15e9378f47362a5 projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-20 08:03:13.000000000 +0200 @@ -0,0 +1,4 @@ +*.obscpio +*.osc +_build.* +.pbuild ++++++ libsoup2-CVE-2026-12548.patch ++++++ diff --unified --recursive --text --new-file --color libsoup-2.74.3.old/libsoup/soup-headers.c libsoup-2.74.3.new/libsoup/soup-headers.c --- libsoup-2.74.3.old/libsoup/soup-headers.c 2026-08-20 13:57:59.079698886 +0800 +++ libsoup-2.74.3.new/libsoup/soup-headers.c 2026-08-20 13:58:09.705674817 +0800 @@ -46,6 +46,9 @@ g_return_val_if_fail (str != NULL, FALSE); g_return_val_if_fail (dest != NULL, FALSE); + if (len <= 0 || len > MAX_HEADERS_BUFFER_SIZE) + return FALSE; + /* As per RFC 2616 section 19.3, we treat '\n' as the * line terminator, and '\r', if it appears, merely as * ignorable trailing whitespace. diff --unified --recursive --text --new-file --color libsoup-2.74.3.old/libsoup/soup-message-headers.h libsoup-2.74.3.new/libsoup/soup-message-headers.h --- libsoup-2.74.3.old/libsoup/soup-message-headers.h 2022-10-12 02:27:22.000000000 +0800 +++ libsoup-2.74.3.new/libsoup/soup-message-headers.h 2026-08-20 13:58:09.706178455 +0800 @@ -10,6 +10,8 @@ G_BEGIN_DECLS +#define MAX_HEADERS_BUFFER_SIZE 256 * 1024 /* 256K */ + typedef struct SoupMessageHeaders SoupMessageHeaders; SOUP_AVAILABLE_IN_2_4 GType soup_message_headers_get_type (void); diff --unified --recursive --text --new-file --color libsoup-2.74.3.old/tests/header-parsing-test.c libsoup-2.74.3.new/tests/header-parsing-test.c --- libsoup-2.74.3.old/tests/header-parsing-test.c 2026-08-20 13:57:59.092644096 +0800 +++ libsoup-2.74.3.new/tests/header-parsing-test.c 2026-08-20 13:59:09.469903122 +0800 @@ -493,6 +493,14 @@ SOUP_STATUS_BAD_REQUEST, NULL, NULL, -1, { { NULL } }, 0 + }, + + { "Header fileds too large", NULL, + "GET / HTTP/1.1\r\n", + (18 + 256) * 1024, + SOUP_STATUS_BAD_REQUEST, + NULL, NULL, -1, + { { NULL } }, 0 } }; static const int num_reqtests = G_N_ELEMENTS (reqtests); @@ -810,6 +818,12 @@ -1, 0, NULL, { { NULL } } }, + + { "Header fileds too large", NULL, + "HTTP/1.0 200 ok\r\n", (20 + 256) * 1024, + -1, 0, NULL, + { { NULL } } + }, }; static const int num_resptests = G_N_ELEMENTS (resptests);
