A flaw was found in libsoups SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.
Weakness
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libsoup2.4 | Ubuntu | devel | * |
| Libsoup2.4 | Ubuntu | esm-apps/resolute | * |
| Libsoup2.4 | Ubuntu | esm-infra-legacy/xenial | * |
| Libsoup2.4 | Ubuntu | esm-infra/bionic | * |
| Libsoup2.4 | Ubuntu | esm-infra/focal | * |
| Libsoup2.4 | Ubuntu | jammy | * |
| Libsoup2.4 | Ubuntu | noble | * |
| Libsoup2.4 | Ubuntu | resolute | * |
| Libsoup3 | Ubuntu | devel | * |
| Libsoup3 | Ubuntu | esm-apps/jammy | * |
| Libsoup3 | Ubuntu | jammy | * |
| Libsoup3 | Ubuntu | noble | * |
| Libsoup3 | Ubuntu | resolute | * |