diff options
author | Ovidiu Panait <ovidiu.panait@windriver.com> | 2020-09-09 11:11:53 +0300 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-09-17 12:51:24 +0100 |
commit | f2422aad3b7ea08935df880a63b3be81daf0c898 (patch) | |
tree | 5d1417f0432d947ba498022669e7435fa22a498f /meta | |
parent | c68c4aa22c86b91b5f2c7c4c175c7ad7b38105c7 (diff) | |
download | poky-f2422aad3b7ea08935df880a63b3be81daf0c898.tar.gz |
libxml2: Fix CVE-2020-24977
GNOME project libxml2 v2.9.10 and earlier have a global Buffer Overflow
vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has
been fixed in commit 8e7c20a1 (20910-GITv2.9.10-103-g8e7c20a1).
Reference:
https://gitlab.gnome.org/GNOME/libxml2/-/issues/178
Upstream patch:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
(From OE-Core rev: d5406b389fcae8fb0f5fc9cc7dbf7ee819c04bc8)
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 92dc02b8f03f3586de0a2ec1463b189a3918e303)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2020-24977.patch | 41 | ||||
-rw-r--r-- | meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 |
2 files changed, 42 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2020-24977.patch b/meta/recipes-core/libxml/libxml2/CVE-2020-24977.patch new file mode 100644 index 0000000000..8224346660 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2020-24977.patch | |||
@@ -0,0 +1,41 @@ | |||
1 | From 50f06b3efb638efb0abd95dc62dca05ae67882c2 Mon Sep 17 00:00:00 2001 | ||
2 | From: Nick Wellnhofer <wellnhofer@aevum.de> | ||
3 | Date: Fri, 7 Aug 2020 21:54:27 +0200 | ||
4 | Subject: [PATCH] Fix out-of-bounds read with 'xmllint --htmlout' | ||
5 | |||
6 | Make sure that truncated UTF-8 sequences don't cause an out-of-bounds | ||
7 | array access. | ||
8 | |||
9 | Thanks to @SuhwanSong and the Agency for Defense Development (ADD) for | ||
10 | the report. | ||
11 | |||
12 | Fixes #178. | ||
13 | |||
14 | CVE: CVE-2020-24977 | ||
15 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2] | ||
16 | |||
17 | Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> | ||
18 | --- | ||
19 | xmllint.c | 6 ++++++ | ||
20 | 1 file changed, 6 insertions(+) | ||
21 | |||
22 | diff --git a/xmllint.c b/xmllint.c | ||
23 | index f6a8e463..c647486f 100644 | ||
24 | --- a/xmllint.c | ||
25 | +++ b/xmllint.c | ||
26 | @@ -528,6 +528,12 @@ static void | ||
27 | xmlHTMLEncodeSend(void) { | ||
28 | char *result; | ||
29 | |||
30 | + /* | ||
31 | + * xmlEncodeEntitiesReentrant assumes valid UTF-8, but the buffer might | ||
32 | + * end with a truncated UTF-8 sequence. This is a hack to at least avoid | ||
33 | + * an out-of-bounds read. | ||
34 | + */ | ||
35 | + memset(&buffer[sizeof(buffer)-4], 0, 4); | ||
36 | result = (char *) xmlEncodeEntitiesReentrant(NULL, BAD_CAST buffer); | ||
37 | if (result) { | ||
38 | xmlGenericError(xmlGenericErrorContext, "%s", result); | ||
39 | -- | ||
40 | 2.17.1 | ||
41 | |||
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb index 097aceb2c0..4ebfb9e556 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb | |||
@@ -22,6 +22,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \ | |||
22 | file://fix-execution-of-ptests.patch \ | 22 | file://fix-execution-of-ptests.patch \ |
23 | file://CVE-2020-7595.patch \ | 23 | file://CVE-2020-7595.patch \ |
24 | file://CVE-2019-20388.patch \ | 24 | file://CVE-2019-20388.patch \ |
25 | file://CVE-2020-24977.patch \ | ||
25 | " | 26 | " |
26 | 27 | ||
27 | SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5" | 28 | SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5" |