File libsoup2-CVE-2026-0716.patch of Package libsoup2

diff -urp libsoup-2.74.3.orig/libsoup/soup-websocket-connection.c libsoup-2.74.3/libsoup/soup-websocket-connection.c
--- libsoup-2.74.3.orig/libsoup/soup-websocket-connection.c	2022-10-11 13:27:22.000000000 -0500
+++ libsoup-2.74.3/libsoup/soup-websocket-connection.c	2026-02-06 12:46:44.372111863 -0600
@@ -1064,6 +1064,12 @@ process_frame (SoupWebsocketConnection *
 		payload += 4;
 		at += 4;
 
+		/* at has a maximum value of 10 + 4 = 14 */
+		if (payload_len > G_MAXSIZE - 14) {
+			bad_data_error_and_close (self);
+			return FALSE;
+		}
+
 		if (len < at + payload_len)
 			return FALSE; /* need more data */
 
diff -urp libsoup-2.74.3.orig/tests/websocket-test.c libsoup-2.74.3/tests/websocket-test.c
--- libsoup-2.74.3.orig/tests/websocket-test.c	2022-10-11 13:27:22.000000000 -0500
+++ libsoup-2.74.3/tests/websocket-test.c	2026-02-06 12:46:44.372679228 -0600
@@ -1861,6 +1861,41 @@ test_cookies_in_response (Test *test,
         soup_cookie_free (cookie);
 }
 
+static void
+test_cve_2026_0716 (Test *test,
+                    gconstpointer unused)
+{
+	GError *error = NULL;
+	GIOStream *io;
+	gsize written;
+	const char *frame;
+	gboolean close_event = FALSE;
+
+	g_signal_handlers_disconnect_by_func (test->server, on_error_not_reached, NULL);
+	g_signal_connect (test->server, "error", G_CALLBACK (on_error_copy), &error);
+	g_signal_connect (test->client, "closed", G_CALLBACK (on_close_set_flag), &close_event);
+
+	io = soup_websocket_connection_get_io_stream (test->client);
+
+	soup_websocket_connection_set_max_incoming_payload_size (test->server, 0);
+
+	// Malicious masked frame header (10-byte header + 4-byte mask) */
+	frame = "\x82\xff\xff\xff\xff\xff\xff\xff\xff\xf6\xaa\xbb\xcc\xdd";
+	if (!g_output_stream_write_all (g_io_stream_get_output_stream (io),
+					frame, 14, &written, NULL, NULL))
+		g_assert_cmpstr ("This code", ==, "should not be reached");
+	g_assert_cmpuint (written, ==, 14);
+
+	WAIT_UNTIL (error != NULL);
+	g_assert_error (error, SOUP_WEBSOCKET_ERROR, SOUP_WEBSOCKET_CLOSE_BAD_DATA);
+	g_clear_error (&error);
+
+	WAIT_UNTIL (soup_websocket_connection_get_state (test->client) == SOUP_WEBSOCKET_STATE_CLOSED);
+	g_assert_true (close_event);
+
+	g_assert_cmpuint (soup_websocket_connection_get_close_code (test->client), ==, SOUP_WEBSOCKET_CLOSE_BAD_DATA);
+}
+
 int
 main (int argc,
       char *argv[])
@@ -2094,6 +2129,15 @@ main (int argc,
                     test_cookies_in_response,
                     teardown_soup_connection);
 
+	g_test_add ("/websocket/direct/cve-2026-0716", Test, NULL,
+		    setup_direct_connection,
+		    test_cve_2026_0716,
+		    teardown_direct_connection);
+	g_test_add ("/websocket/soup/cve-2026-0716", Test, NULL,
+		    setup_soup_connection,
+		    test_cve_2026_0716,
+		    teardown_soup_connection);
+
 	ret = g_test_run ();
 
 	test_cleanup ();