franciswang/openwrt_yocto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4c86c082a2b056cd48275d89abc35b4990ca4ed8
openwrt_yocto/poky/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32049-1.patch
T
francis.wang 4c86c082a2 Initial commit: OpenWrt-Yocto monorepo 
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and
meta-openwrt into a single repository.

Components:
- poky/             Yocto core framework (BitBake + OE-Core)
- meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking)
- meta-openwrt/     OpenWrt customization layer
- setup-env.sh      One-click build environment setup
- README.md         Project documentation
2026-07-11 13:28:01 +08:00

230 lines
8.3 KiB
Diff
Raw Blame History

From 176cb31003252a69d3fc7908e8f505c0ee006b7a Mon Sep 17 00:00:00 2001
From: Ignacio Casal Quinteiro <qignacio@amazon.com>
Date: Wed, 24 Jul 2024 15:20:35 +0200
Subject: [PATCH 1/4] websocket: add a way to restrict the total message size
Otherwise a client could send small packages smaller than
total-incoming-payload-size but still to break the server
with a big allocation
Fixes: #390
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/db87805ab565d67533dfed2cb409dbfd63c7fdce]
CVE: CVE-2025-32049
Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
libsoup/websocket/soup-websocket-connection.c | 107 +++++++++++++++++-
libsoup/websocket/soup-websocket-connection.h | 7 ++
2 files changed, 110 insertions(+), 4 deletions(-)
diff --git a/libsoup/websocket/soup-websocket-connection.c b/libsoup/websocket/soup-websocket-connection.c
index 5eb8150..19bdd39 100644
--- a/libsoup/websocket/soup-websocket-connection.c
+++ b/libsoup/websocket/soup-websocket-connection.c
@@ -84,7 +84,7 @@ enum {
PROP_MAX_INCOMING_PAYLOAD_SIZE,
PROP_KEEPALIVE_INTERVAL,
PROP_EXTENSIONS,
-
+ PROP_MAX_TOTAL_MESSAGE_SIZE,
LAST_PROPERTY
};
@@ -126,6 +126,7 @@ typedef struct {
char *origin;
char *protocol;
guint64 max_incoming_payload_size;
+ guint64 max_total_message_size;
guint keepalive_interval;
gushort peer_close_code;
@@ -156,6 +157,7 @@ typedef struct {
} SoupWebsocketConnectionPrivate;
#define MAX_INCOMING_PAYLOAD_SIZE_DEFAULT 128 * 1024
+#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT 128 * 1024
#define READ_BUFFER_SIZE 1024
#define MASK_LENGTH 4
@@ -670,8 +672,8 @@ bad_data_error_and_close (SoupWebsocketConnection *self)
}
static void
-too_big_error_and_close (SoupWebsocketConnection *self,
- guint64 payload_len)
+too_big_incoming_payload_error_and_close (SoupWebsocketConnection *self,
+ guint64 payload_len)
{
SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self);
GError *error;
@@ -687,6 +689,24 @@ too_big_error_and_close (SoupWebsocketConnection *self,
emit_error_and_close (self, error, TRUE);
}
+static void
+too_big_message_error_and_close (SoupWebsocketConnection *self,
+ guint64 len)
+{
+ SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self);
+ GError *error;
+
+ error = g_error_new_literal (SOUP_WEBSOCKET_ERROR,
+ SOUP_WEBSOCKET_CLOSE_TOO_BIG,
+ priv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ?
+ "Received WebSocket payload from the client larger than configured max-total-message-size" :
+ "Received WebSocket payload from the server larger than configured max-total-message-size");
+ g_debug ("%s received message of size %" G_GUINT64_FORMAT " or greater, but max supported size is %" G_GUINT64_FORMAT,
+ priv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ? "server" : "client",
+ len, priv->max_total_message_size);
+ emit_error_and_close (self, error, TRUE);
+}
+
static void
close_connection (SoupWebsocketConnection *self,
gushort code,
@@ -918,6 +938,12 @@ process_contents (SoupWebsocketConnection *self,
switch (priv->message_opcode) {
case 0x01:
case 0x02:
+ /* Safety valve */
+ if (priv->max_total_message_size > 0 &&
+ (priv->message_data->len + payload_len) > priv->max_total_message_size) {
+ too_big_message_error_and_close (self, (priv->message_data->len + payload_len));
+ return;
+ }
g_byte_array_append (priv->message_data, payload, payload_len);
break;
default:
@@ -1056,7 +1082,7 @@ process_frame (SoupWebsocketConnection *self)
/* Safety valve */
if (priv->max_incoming_payload_size > 0 &&
payload_len > priv->max_incoming_payload_size) {
- too_big_error_and_close (self, payload_len);
+ too_big_incoming_payload_error_and_close (self, payload_len);
return FALSE;
}
@@ -1363,6 +1389,10 @@ soup_websocket_connection_get_property (GObject *object,
g_value_set_pointer (value, priv->extensions);
break;
+ case PROP_MAX_TOTAL_MESSAGE_SIZE:
+ g_value_set_uint64 (value, priv->max_total_message_size);
+ break;
+
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -1416,6 +1446,10 @@ soup_websocket_connection_set_property (GObject *object,
priv->extensions = g_value_get_pointer (value);
break;
+ case PROP_MAX_TOTAL_MESSAGE_SIZE:
+ priv->max_total_message_size = g_value_get_uint64 (value);
+ break;
+
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -1628,6 +1662,26 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass)
G_PARAM_CONSTRUCT_ONLY |
G_PARAM_STATIC_STRINGS);
+ /**
+ * SoupWebsocketConnection:max-total-message-size:
+ *
+ * The total message size for incoming packets.
+ *
+ * The protocol expects or 0 to not limit it.
+ *
+ * Since: 3.8
+ */
+ properties[PROP_MAX_TOTAL_MESSAGE_SIZE] =
+ g_param_spec_uint64 ("max-total-message-size",
+ "Max total message size",
+ "Max total message size ",
+ 0,
+ G_MAXUINT64,
+ MAX_TOTAL_MESSAGE_SIZE_DEFAULT,
+ G_PARAM_READWRITE |
+ G_PARAM_CONSTRUCT |
+ G_PARAM_STATIC_STRINGS);
+
g_object_class_install_properties (gobject_class, LAST_PROPERTY, properties);
/**
@@ -2111,6 +2165,51 @@ soup_websocket_connection_set_max_incoming_payload_size (SoupWebsocketConnection
}
}
+/**
+ * soup_websocket_connection_get_max_total_message_size:
+ * @self: the WebSocket
+ *
+ * Gets the maximum total message size allowed for packets.
+ *
+ * Returns: the maximum total message size.
+ *
+ * Since: 3.8
+ */
+guint64
+soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self)
+{
+ SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self);
+
+ g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), MAX_TOTAL_MESSAGE_SIZE_DEFAULT);
+
+ return priv->max_total_message_size;
+}
+
+/**
+ * soup_websocket_connection_set_max_total_message_size:
+ * @self: the WebSocket
+ * @max_total_message_size: the maximum total message size
+ *
+ * Sets the maximum total message size allowed for packets.
+ *
+ * It does not limit the outgoing packet size.
+ *
+ * Since: 3.8
+ */
+void
+soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self,
+ guint64 max_total_message_size)
+{
+ SoupWebsocketConnectionPrivate *priv = soup_websocket_connection_get_instance_private (self);
+
+ g_return_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self));
+
+ if (priv->max_total_message_size != max_total_message_size) {
+ priv->max_total_message_size = max_total_message_size;
+ g_object_notify_by_pspec (G_OBJECT (self), properties[PROP_MAX_TOTAL_MESSAGE_SIZE]);
+ }
+}
+
/**
* soup_websocket_connection_get_keepalive_interval:
* @self: the WebSocket
diff --git a/libsoup/websocket/soup-websocket-connection.h b/libsoup/websocket/soup-websocket-connection.h
index eeb093d..922de56 100644
--- a/libsoup/websocket/soup-websocket-connection.h
+++ b/libsoup/websocket/soup-websocket-connection.h
@@ -88,6 +88,13 @@ SOUP_AVAILABLE_IN_ALL
void soup_websocket_connection_set_max_incoming_payload_size (SoupWebsocketConnection *self,
guint64 max_incoming_payload_size);
+SOUP_AVAILABLE_IN_3_0
+guint64 soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self);
+
+SOUP_AVAILABLE_IN_3_0
+void soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self,
+ guint64 max_total_message_size);
+
SOUP_AVAILABLE_IN_ALL
guint soup_websocket_connection_get_keepalive_interval (SoupWebsocketConnection *self);
--
2.34.1
Reference in New Issue View Git Blame Copy Permalink