diff options
author | Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> | 2022-11-03 10:43:20 +0530 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-11-09 17:42:03 +0000 |
commit | 5502d7326cc5e8da56227457a2f874d22cd49389 (patch) | |
tree | 649940960ad54e3cfa7604651bfe5e8731d475d4 /meta/recipes-core/expat/expat/CVE-2022-43680.patch | |
parent | 32c25a02023aabb9add718ff1c398ec45b0105d6 (diff) | |
download | poky-5502d7326cc5e8da56227457a2f874d22cd49389.tar.gz |
expat: Fix CVE-2022-43680 for expat
Add a patch to fix CVE-2022-43680 issue where use-after free caused by
overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
in out-of-memory situations
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-43680
(From OE-Core rev: ac4476e6594417b14bfb05a110009ef245f419b0)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core/expat/expat/CVE-2022-43680.patch')
-rw-r--r-- | meta/recipes-core/expat/expat/CVE-2022-43680.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/meta/recipes-core/expat/expat/CVE-2022-43680.patch b/meta/recipes-core/expat/expat/CVE-2022-43680.patch new file mode 100644 index 0000000000..6f93bc3ed7 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2022-43680.patch | |||
@@ -0,0 +1,33 @@ | |||
1 | From 5290462a7ea1278a8d5c0d5b2860d4e244f997e4 Mon Sep 17 00:00:00 2001 | ||
2 | From: Sebastian Pipping <sebastian@pipping.org> | ||
3 | Date: Tue, 20 Sep 2022 02:44:34 +0200 | ||
4 | Subject: [PATCH] lib: Fix overeager DTD destruction in | ||
5 | XML_ExternalEntityParserCreate | ||
6 | |||
7 | CVE: CVE-2022-43680 | ||
8 | Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/5290462a7ea1278a8d5c0d5b2860d4e244f997e4.patch] | ||
9 | Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> | ||
10 | Comments: Hunk refreshed | ||
11 | --- | ||
12 | lib/xmlparse.c | 8 ++++++++ | ||
13 | 1 file changed, 8 insertions(+) | ||
14 | |||
15 | diff --git a/lib/xmlparse.c b/lib/xmlparse.c | ||
16 | index aacd6e7fc..57bf103cc 100644 | ||
17 | --- a/lib/xmlparse.c | ||
18 | +++ b/lib/xmlparse.c | ||
19 | @@ -1035,6 +1035,14 @@ parserCreate(const XML_Char *encodingNam | ||
20 | parserInit(parser, encodingName); | ||
21 | |||
22 | if (encodingName && ! parser->m_protocolEncodingName) { | ||
23 | + if (dtd) { | ||
24 | + // We need to stop the upcoming call to XML_ParserFree from happily | ||
25 | + // destroying parser->m_dtd because the DTD is shared with the parent | ||
26 | + // parser and the only guard that keeps XML_ParserFree from destroying | ||
27 | + // parser->m_dtd is parser->m_isParamEntity but it will be set to | ||
28 | + // XML_TRUE only later in XML_ExternalEntityParserCreate (or not at all). | ||
29 | + parser->m_dtd = NULL; | ||
30 | + } | ||
31 | XML_ParserFree(parser); | ||
32 | return NULL; | ||
33 | } | ||