REDHAT-BUG-2439091: Medium severity Gnome libsoup vulnerability

Integer underflow in CVE-2025-32052 fix when resourcelength=0

The fix for CVE-2025-32052 (commit a5b86bfc) introduces a potential integer underflow vulnerability when resourcelength is 0.

Affected Code: libsoup/soup-content-sniffer.c, line 507

Issue: The patch changes the condition from: while ((indexstream < resourcelength) && ...) to: while ((indexstream < resourcelength - 1) && ...)

When buffer->length = 0:

resourcelength = MIN(512, 0) = 0 resourcelength - 1 underflows to UINTMAX (gsize is unsigned) Condition (0 < UINTMAX) = TRUE Loop executes on empty buffer → buffer overread Fix: Add guard before hasws path: if (resourcelength == 0) continue;

This matches the pattern used in the else branch which already checks: if (resourcelength < typerow->patternlength) continue;

Patch :

--- a/libsoup/soup-content-sniffer.c +++ b/libsoup/soup-content-sniffer.c @@ -498,6 +498,11 @@ sniffunknown (SoupContentSniffer sniffer, SoupBuffer buffer, if (!sniffscriptable && typerow->scriptable) continue; + / Ensure we have data to sniff - prevents underflow in resourcelength - 1 / + if (resourcelength == 0) + continue; + if (typerow->hasws) { guint indexstream = 0; guint indexpattern = 0;