From 56b8eb061a02c4e99644d6f1e62e601d0d814beb Mon Sep 17 00:00:00 2001 From: Milan Crha Date: Tue, 15 Apr 2025 09:59:05 +0200 Subject: [PATCH 1/2] soup-server-http2: Check validity of the constructed connection URI The HTTP/2 pseudo-headers can contain invalid values, which the GUri rejects and returns NULL, but the soup-server did not check the validity and could abort the server itself later in the code. Closes #429 CVE: CVE-2025-32908 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/451/diffs?commit_id=a792b23ab87cacbf4dd9462bf7b675fa678efbae] Signed-off-by: Changqing Li --- .../http2/soup-server-message-io-http2.c | 4 +++ tests/http2-test.c | 28 +++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/libsoup/server/http2/soup-server-message-io-http2.c b/libsoup/server/http2/soup-server-message-io-http2.c index 943ecfd..f1fe2d5 100644 --- a/libsoup/server/http2/soup-server-message-io-http2.c +++ b/libsoup/server/http2/soup-server-message-io-http2.c @@ -771,9 +771,13 @@ on_frame_recv_callback (nghttp2_session *session, char *uri_string; GUri *uri; + if (msg_io->scheme == NULL || msg_io->authority == NULL || msg_io->path == NULL) + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; uri_string = g_strdup_printf ("%s://%s%s", msg_io->scheme, msg_io->authority, msg_io->path); uri = g_uri_parse (uri_string, SOUP_HTTP_URI_FLAGS, NULL); g_free (uri_string); + if (uri == NULL) + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; soup_server_message_set_uri (msg_io->msg, uri); g_uri_unref (uri); diff --git a/tests/http2-test.c b/tests/http2-test.c index ef097f4..df86d9b 100644 --- a/tests/http2-test.c +++ b/tests/http2-test.c @@ -1241,6 +1241,30 @@ do_connection_closed_test (Test *test, gconstpointer data) g_uri_unref (uri); } +static void +do_broken_pseudo_header_test (Test *test, gconstpointer data) +{ + char *path; + SoupMessage *msg; + GUri *uri; + GBytes *body = NULL; + GError *error = NULL; + + uri = g_uri_parse_relative (base_uri, "/ag", SOUP_HTTP_URI_FLAGS, NULL); + + /* an ugly cheat to construct a broken URI, which can be sent from other libs */ + path = (char *) g_uri_get_path (uri); + path[1] = '%'; + + msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri); + body = soup_test_session_async_send (test->session, msg, NULL, &error); + g_assert_error (error, G_IO_ERROR, G_IO_ERROR_PARTIAL_INPUT); + g_assert_null (body); + g_clear_error (&error); + g_object_unref (msg); + g_uri_unref (uri); +} + static gboolean unpause_message (SoupServerMessage *msg) { @@ -1549,6 +1573,10 @@ main (int argc, char **argv) setup_session, do_connection_closed_test, teardown_session); + g_test_add ("/http2/broken-pseudo-header", Test, NULL, + setup_session, + do_broken_pseudo_header_test, + teardown_session); ret = g_test_run (); -- 2.34.1