diff options
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch | 127 | ||||
-rw-r--r-- | meta/recipes-core/libxml/libxml2_2.9.2.bb | 1 |
2 files changed, 128 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch new file mode 100644 index 0000000000..b6cf883da7 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2016-1839.patch | |||
@@ -0,0 +1,127 @@ | |||
1 | From a820dbeac29d330bae4be05d9ecd939ad6b4aa33 Mon Sep 17 00:00:00 2001 | ||
2 | From: Pranjal Jumde <pjumde@apple.com> | ||
3 | Date: Tue, 1 Mar 2016 11:34:04 -0800 | ||
4 | Subject: [PATCH] Bug 758605: Heap-based buffer overread in xmlDictAddString | ||
5 | <https://bugzilla.gnome.org/show_bug.cgi?id=758605> | ||
6 | |||
7 | Reviewed by David Kilzer. | ||
8 | |||
9 | * HTMLparser.c: | ||
10 | (htmlParseName): Add bounds check. | ||
11 | (htmlParseNameComplex): Ditto. | ||
12 | * result/HTML/758605.html: Added. | ||
13 | * result/HTML/758605.html.err: Added. | ||
14 | * result/HTML/758605.html.sax: Added. | ||
15 | * runtest.c: | ||
16 | (pushParseTest): The input for the new test case was so small | ||
17 | (4 bytes) that htmlParseChunk() was never called after | ||
18 | htmlCreatePushParserCtxt(), thereby creating a false positive | ||
19 | test failure. Fixed by using a do-while loop so we always call | ||
20 | htmlParseChunk() at least once. | ||
21 | * test/HTML/758605.html: Added. | ||
22 | |||
23 | Upstream-Status: Backport | ||
24 | CVE: CVE-2016-1839 | ||
25 | |||
26 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
27 | --- | ||
28 | HTMLparser.c | 8 ++++++++ | ||
29 | result/HTML/758605.html | 3 +++ | ||
30 | result/HTML/758605.html.err | 3 +++ | ||
31 | result/HTML/758605.html.sax | 13 +++++++++++++ | ||
32 | runtest.c | 4 ++-- | ||
33 | test/HTML/758605.html | 1 + | ||
34 | 6 files changed, 30 insertions(+), 2 deletions(-) | ||
35 | create mode 100644 result/HTML/758605.html | ||
36 | create mode 100644 result/HTML/758605.html.err | ||
37 | create mode 100644 result/HTML/758605.html.sax | ||
38 | create mode 100644 test/HTML/758605.html | ||
39 | |||
40 | Index: libxml2-2.9.2/HTMLparser.c | ||
41 | =================================================================== | ||
42 | --- libxml2-2.9.2.orig/HTMLparser.c | ||
43 | +++ libxml2-2.9.2/HTMLparser.c | ||
44 | @@ -2471,6 +2471,10 @@ htmlParseName(htmlParserCtxtPtr ctxt) { | ||
45 | (*in == '_') || (*in == '-') || | ||
46 | (*in == ':') || (*in == '.')) | ||
47 | in++; | ||
48 | + | ||
49 | + if (in == ctxt->input->end) | ||
50 | + return(NULL); | ||
51 | + | ||
52 | if ((*in > 0) && (*in < 0x80)) { | ||
53 | count = in - ctxt->input->cur; | ||
54 | ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count); | ||
55 | @@ -2514,6 +2518,10 @@ htmlParseNameComplex(xmlParserCtxtPtr ct | ||
56 | NEXTL(l); | ||
57 | c = CUR_CHAR(l); | ||
58 | } | ||
59 | + | ||
60 | + if (ctxt->input->base > ctxt->input->cur - len) | ||
61 | + return(NULL); | ||
62 | + | ||
63 | return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len)); | ||
64 | } | ||
65 | |||
66 | Index: libxml2-2.9.2/result/HTML/758605.html | ||
67 | =================================================================== | ||
68 | --- /dev/null | ||
69 | +++ libxml2-2.9.2/result/HTML/758605.html | ||
70 | @@ -0,0 +1,3 @@ | ||
71 | +<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> | ||
72 | +<html><body><p>& | ||
73 | +</p></body></html> | ||
74 | Index: libxml2-2.9.2/result/HTML/758605.html.err | ||
75 | =================================================================== | ||
76 | --- /dev/null | ||
77 | +++ libxml2-2.9.2/result/HTML/758605.html.err | ||
78 | @@ -0,0 +1,3 @@ | ||
79 | +./test/HTML/758605.html:1: HTML parser error : htmlParseEntityRef: no name | ||
80 | +ê | ||
81 | + ^ | ||
82 | Index: libxml2-2.9.2/result/HTML/758605.html.sax | ||
83 | =================================================================== | ||
84 | --- /dev/null | ||
85 | +++ libxml2-2.9.2/result/HTML/758605.html.sax | ||
86 | @@ -0,0 +1,13 @@ | ||
87 | +SAX.setDocumentLocator() | ||
88 | +SAX.startDocument() | ||
89 | +SAX.error: htmlParseEntityRef: no name | ||
90 | +SAX.startElement(html) | ||
91 | +SAX.startElement(body) | ||
92 | +SAX.startElement(p) | ||
93 | +SAX.characters(&, 1) | ||
94 | +SAX.ignorableWhitespace( | ||
95 | +, 1) | ||
96 | +SAX.endElement(p) | ||
97 | +SAX.endElement(body) | ||
98 | +SAX.endElement(html) | ||
99 | +SAX.endDocument() | ||
100 | Index: libxml2-2.9.2/runtest.c | ||
101 | =================================================================== | ||
102 | --- libxml2-2.9.2.orig/runtest.c | ||
103 | +++ libxml2-2.9.2/runtest.c | ||
104 | @@ -1827,7 +1827,7 @@ pushParseTest(const char *filename, cons | ||
105 | ctxt = xmlCreatePushParserCtxt(NULL, NULL, base + cur, 4, filename); | ||
106 | xmlCtxtUseOptions(ctxt, options); | ||
107 | cur += 4; | ||
108 | - while (cur < size) { | ||
109 | + do { | ||
110 | if (cur + 1024 >= size) { | ||
111 | #ifdef LIBXML_HTML_ENABLED | ||
112 | if (options & XML_PARSE_HTML) | ||
113 | @@ -1845,7 +1845,7 @@ pushParseTest(const char *filename, cons | ||
114 | xmlParseChunk(ctxt, base + cur, 1024, 0); | ||
115 | cur += 1024; | ||
116 | } | ||
117 | - } | ||
118 | + } while (cur < size); | ||
119 | doc = ctxt->myDoc; | ||
120 | #ifdef LIBXML_HTML_ENABLED | ||
121 | if (options & XML_PARSE_HTML) | ||
122 | Index: libxml2-2.9.2/test/HTML/758605.html | ||
123 | =================================================================== | ||
124 | --- /dev/null | ||
125 | +++ libxml2-2.9.2/test/HTML/758605.html | ||
126 | @@ -0,0 +1 @@ | ||
127 | +&:ê | ||
diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb index a7c290434b..328e2a3dbd 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.2.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb | |||
@@ -10,6 +10,7 @@ SRC_URI += "file://CVE-2016-1762.patch \ | |||
10 | file://CVE-2016-4483.patch \ | 10 | file://CVE-2016-4483.patch \ |
11 | file://CVE-2016-1840.patch \ | 11 | file://CVE-2016-1840.patch \ |
12 | file://CVE-2016-1838.patch \ | 12 | file://CVE-2016-1838.patch \ |
13 | file://CVE-2016-1839.patch \ | ||
13 | " | 14 | " |
14 | 15 | ||
15 | SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" | 16 | SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" |