summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2016-07-09 14:57:08 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-07-27 08:29:58 +0100
commit3e93d609c0530597a251d6402aedc5074720cbf2 (patch)
tree7e08dd90e340960bc9d81713e333a6f17c7f5e6a
parent970a077b83930c15857ae84421b6b581ff9ea3bd (diff)
downloadpoky-3e93d609c0530597a251d6402aedc5074720cbf2.tar.gz
libxml2: Security fix for CVE-2016-1839
Affects libxml2 < 2.9.4 (From OE-Core rev: 689145fc5ae377eab088ee524c447223be29707f) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat
-rw-r--r--meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch127
-rw-r--r--meta/recipes-core/libxml/libxml2_2.9.2.bb1
2 files changed, 128 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch
new file mode 100644
index 0000000000..b6cf883da7
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch
@@ -0,0 +1,127 @@
1From a820dbeac29d330bae4be05d9ecd939ad6b4aa33 Mon Sep 17 00:00:00 2001
2From: Pranjal Jumde <pjumde@apple.com>
3Date: Tue, 1 Mar 2016 11:34:04 -0800
4Subject: [PATCH] Bug 758605: Heap-based buffer overread in xmlDictAddString
5 <https://bugzilla.gnome.org/show_bug.cgi?id=758605>
6
7Reviewed by David Kilzer.
8
9* HTMLparser.c:
10(htmlParseName): Add bounds check.
11(htmlParseNameComplex): Ditto.
12* result/HTML/758605.html: Added.
13* result/HTML/758605.html.err: Added.
14* result/HTML/758605.html.sax: Added.
15* runtest.c:
16(pushParseTest): The input for the new test case was so small
17(4 bytes) that htmlParseChunk() was never called after
18htmlCreatePushParserCtxt(), thereby creating a false positive
19test failure. Fixed by using a do-while loop so we always call
20htmlParseChunk() at least once.
21* test/HTML/758605.html: Added.
22
23Upstream-Status: Backport
24CVE: CVE-2016-1839
25
26Signed-off-by: Armin Kuster <akuster@mvista.com>
27---
28 HTMLparser.c | 8 ++++++++
29 result/HTML/758605.html | 3 +++
30 result/HTML/758605.html.err | 3 +++
31 result/HTML/758605.html.sax | 13 +++++++++++++
32 runtest.c | 4 ++--
33 test/HTML/758605.html | 1 +
34 6 files changed, 30 insertions(+), 2 deletions(-)
35 create mode 100644 result/HTML/758605.html
36 create mode 100644 result/HTML/758605.html.err
37 create mode 100644 result/HTML/758605.html.sax
38 create mode 100644 test/HTML/758605.html
39
40Index: libxml2-2.9.2/HTMLparser.c
41===================================================================
42--- libxml2-2.9.2.orig/HTMLparser.c
43+++ libxml2-2.9.2/HTMLparser.c
44@@ -2471,6 +2471,10 @@ htmlParseName(htmlParserCtxtPtr ctxt) {
45 (*in == '_') || (*in == '-') ||
46 (*in == ':') || (*in == '.'))
47 in++;
48+
49+ if (in == ctxt->input->end)
50+ return(NULL);
51+
52 if ((*in > 0) && (*in < 0x80)) {
53 count = in - ctxt->input->cur;
54 ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count);
55@@ -2514,6 +2518,10 @@ htmlParseNameComplex(xmlParserCtxtPtr ct
56 NEXTL(l);
57 c = CUR_CHAR(l);
58 }
59+
60+ if (ctxt->input->base > ctxt->input->cur - len)
61+ return(NULL);
62+
63 return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
64 }
65
66Index: libxml2-2.9.2/result/HTML/758605.html
67===================================================================
68--- /dev/null
69+++ libxml2-2.9.2/result/HTML/758605.html
70@@ -0,0 +1,3 @@
71+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
72+<html><body><p>&amp;
73+</p></body></html>
74Index: libxml2-2.9.2/result/HTML/758605.html.err
75===================================================================
76--- /dev/null
77+++ libxml2-2.9.2/result/HTML/758605.html.err
78@@ -0,0 +1,3 @@
79+./test/HTML/758605.html:1: HTML parser error : htmlParseEntityRef: no name
80+ê
81+ ^
82Index: libxml2-2.9.2/result/HTML/758605.html.sax
83===================================================================
84--- /dev/null
85+++ libxml2-2.9.2/result/HTML/758605.html.sax
86@@ -0,0 +1,13 @@
87+SAX.setDocumentLocator()
88+SAX.startDocument()
89+SAX.error: htmlParseEntityRef: no name
90+SAX.startElement(html)
91+SAX.startElement(body)
92+SAX.startElement(p)
93+SAX.characters(&amp;, 1)
94+SAX.ignorableWhitespace(
95+, 1)
96+SAX.endElement(p)
97+SAX.endElement(body)
98+SAX.endElement(html)
99+SAX.endDocument()
100Index: libxml2-2.9.2/runtest.c
101===================================================================
102--- libxml2-2.9.2.orig/runtest.c
103+++ libxml2-2.9.2/runtest.c
104@@ -1827,7 +1827,7 @@ pushParseTest(const char *filename, cons
105 ctxt = xmlCreatePushParserCtxt(NULL, NULL, base + cur, 4, filename);
106 xmlCtxtUseOptions(ctxt, options);
107 cur += 4;
108- while (cur < size) {
109+ do {
110 if (cur + 1024 >= size) {
111 #ifdef LIBXML_HTML_ENABLED
112 if (options & XML_PARSE_HTML)
113@@ -1845,7 +1845,7 @@ pushParseTest(const char *filename, cons
114 xmlParseChunk(ctxt, base + cur, 1024, 0);
115 cur += 1024;
116 }
117- }
118+ } while (cur < size);
119 doc = ctxt->myDoc;
120 #ifdef LIBXML_HTML_ENABLED
121 if (options & XML_PARSE_HTML)
122Index: libxml2-2.9.2/test/HTML/758605.html
123===================================================================
124--- /dev/null
125+++ libxml2-2.9.2/test/HTML/758605.html
126@@ -0,0 +1 @@
127+&:ê
diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb
index a7c290434b..328e2a3dbd 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.2.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb
@@ -10,6 +10,7 @@ SRC_URI += "file://CVE-2016-1762.patch \
10 file://CVE-2016-4483.patch \ 10 file://CVE-2016-4483.patch \
11 file://CVE-2016-1840.patch \ 11 file://CVE-2016-1840.patch \
12 file://CVE-2016-1838.patch \ 12 file://CVE-2016-1838.patch \
13 file://CVE-2016-1839.patch \
13 " 14 "
14 15
15SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" 16SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-04-25 12:06:02 +0000