File: CVE-2025-32911-2.patch

package info (click to toggle)
libsoup2.4 2.74.3-10.1
  • links: PTS, VCS
  • area: main
  • in suites: sid, trixie
  • size: 7,236 kB
  • sloc: ansic: 57,709; xml: 1,392; python: 84; php: 75; javascript: 64; sh: 49; makefile: 28
file content (38 lines) | stat: -rw-r--r-- 1,606 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
From: Patrick Griffis <pgriffis@igalia.com>
Date: Fri, 27 Dec 2024 18:00:39 -0600
Subject: soup_message_headers_get_content_disposition: strdup truncated
 filenames

This table frees the strings it contains.

(cherry picked from commit f4a761fb66512fff59798765e8ac5b9e57dceef0)
---
 libsoup/soup-message-headers.c | 2 +-
 tests/header-parsing-test.c    | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
index a577169..81e7cea 100644
--- a/libsoup/soup-message-headers.c
+++ b/libsoup/soup-message-headers.c
@@ -1458,7 +1458,7 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders  *hdrs,
                         char *filename = strrchr (orig_value, '/');
 
                         if (filename)
-                                g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
+                                g_hash_table_insert (*params, g_strdup (orig_key), g_strdup (filename + 1));
                 } else {
                         /* filename with no value isn't valid. */
                         g_hash_table_remove (*params, "filename");
diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
index 8e433ca..06e525c 100644
--- a/tests/header-parsing-test.c
+++ b/tests/header-parsing-test.c
@@ -1163,6 +1163,7 @@ do_content_disposition_tests (void)
 		soup_test_assert (FALSE, "empty filename decoding FAILED");
 		return;
 	}
+        g_free (disposition);
         g_assert_false (g_hash_table_contains (params, "filename"));
 	g_hash_table_destroy (params);