diff options
Diffstat (limited to 'meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch')
-rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch b/meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch new file mode 100644 index 0000000000..63d613cc21 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch | |||
@@ -0,0 +1,53 @@ | |||
1 | From b07251215ef48c70c6e56f7351406c47cfca4d5b Mon Sep 17 00:00:00 2001 | ||
2 | From: Nick Wellnhofer <wellnhofer@aevum.de> | ||
3 | Date: Fri, 10 Jan 2020 15:55:07 +0100 | ||
4 | Subject: [PATCH] Fix integer overflow in xmlBufferResize | ||
5 | |||
6 | Found by OSS-Fuzz. | ||
7 | |||
8 | CVE: CVE-2022-29824 | ||
9 | |||
10 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/b07251215ef48c70c6e56f7351406c47cfca4d5b] | ||
11 | |||
12 | Signed-off-by: Riyaz Ahmed Khan <Riyaz.Khan@kpit.com> | ||
13 | |||
14 | --- | ||
15 | tree.c | 9 +++++++-- | ||
16 | 1 file changed, 7 insertions(+), 2 deletions(-) | ||
17 | |||
18 | diff --git a/tree.c b/tree.c | ||
19 | index 0d7fc98c..f43f6de1 100644 | ||
20 | --- a/tree.c | ||
21 | +++ b/tree.c | ||
22 | @@ -7424,12 +7424,17 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size) | ||
23 | if (size < buf->size) | ||
24 | return 1; | ||
25 | |||
26 | + if (size > UINT_MAX - 10) { | ||
27 | + xmlTreeErrMemory("growing buffer"); | ||
28 | + return 0; | ||
29 | + } | ||
30 | + | ||
31 | /* figure out new size */ | ||
32 | switch (buf->alloc){ | ||
33 | case XML_BUFFER_ALLOC_IO: | ||
34 | case XML_BUFFER_ALLOC_DOUBLEIT: | ||
35 | /*take care of empty case*/ | ||
36 | - newSize = (buf->size ? buf->size*2 : size + 10); | ||
37 | + newSize = (buf->size ? buf->size : size + 10); | ||
38 | while (size > newSize) { | ||
39 | if (newSize > UINT_MAX / 2) { | ||
40 | xmlTreeErrMemory("growing buffer"); | ||
41 | @@ -7445,7 +7450,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size) | ||
42 | if (buf->use < BASE_BUFFER_SIZE) | ||
43 | newSize = size; | ||
44 | else { | ||
45 | - newSize = buf->size * 2; | ||
46 | + newSize = buf->size; | ||
47 | while (size > newSize) { | ||
48 | if (newSize > UINT_MAX / 2) { | ||
49 | xmlTreeErrMemory("growing buffer"); | ||
50 | -- | ||
51 | GitLab | ||
52 | |||
53 | |||