From ad7cab35ffda97e753ce87958ce3de049c294f8e Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Sat, 9 Jul 2016 15:12:44 -0700 Subject: libxml2: Security fix for CVE-2016-4447 Affects libxml2 < 2.9.4 (From OE-Core rev: b817c98017cb64f902cdae514fb162b3199a0a14) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../libxml/libxml2/CVE-2016-4447.patch | 208 +++++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.9.2.bb | 1 + 2 files changed, 209 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2016-4447.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-4447.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-4447.patch new file mode 100644 index 0000000000..5957844433 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2016-4447.patch @@ -0,0 +1,208 @@ +From 00906759053986b8079985644172085f74331f83 Mon Sep 17 00:00:00 2001 +From: David Kilzer +Date: Tue, 26 Jan 2016 16:57:03 -0800 +Subject: [PATCH] Heap-based buffer-underreads due to xmlParseName + +For https://bugzilla.gnome.org/show_bug.cgi?id=759573 + +* parser.c: +(xmlParseElementDecl): Return early on invalid input to fix +non-minimized test case (759573-2.xml). Otherwise the parser +gets into a bad state in SKIP(3) at the end of the function. +(xmlParseConditionalSections): Halt parsing when hitting invalid +input that would otherwise caused xmlParserHandlePEReference() +to recurse unexpectedly. This fixes the minimized test case +(759573.xml). + +* result/errors/759573-2.xml: Add. +* result/errors/759573-2.xml.err: Add. +* result/errors/759573-2.xml.str: Add. +* result/errors/759573.xml: Add. +* result/errors/759573.xml.err: Add. +* result/errors/759573.xml.str: Add. +* test/errors/759573-2.xml: Add. +* test/errors/759573.xml: Add. + +Upstream-Status: Backport +CVE: CVE-2016-4447 +Signed-off-by: Armin Kuster + +--- + parser.c | 2 ++ + result/errors/759573-2.xml | 0 + result/errors/759573-2.xml.err | 58 ++++++++++++++++++++++++++++++++++++++++++ + result/errors/759573-2.xml.str | 4 +++ + result/errors/759573.xml | 0 + result/errors/759573.xml.err | 31 ++++++++++++++++++++++ + result/errors/759573.xml.str | 4 +++ + test/errors/759573-2.xml | 9 +++++++ + test/errors/759573.xml | 1 + + 9 files changed, 109 insertions(+) + create mode 100644 result/errors/759573-2.xml + create mode 100644 result/errors/759573-2.xml.err + create mode 100644 result/errors/759573-2.xml.str + create mode 100644 result/errors/759573.xml + create mode 100644 result/errors/759573.xml.err + create mode 100644 result/errors/759573.xml.str + create mode 100644 test/errors/759573-2.xml + create mode 100644 test/errors/759573.xml + +Index: libxml2-2.9.2/parser.c +=================================================================== +--- libxml2-2.9.2.orig/parser.c ++++ libxml2-2.9.2/parser.c +@@ -6723,6 +6723,7 @@ xmlParseElementDecl(xmlParserCtxtPtr ctx + if (!IS_BLANK_CH(CUR)) { + xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, + "Space required after 'ELEMENT'\n"); ++ return(-1); + } + SKIP_BLANKS; + name = xmlParseName(ctxt); +@@ -6874,6 +6875,7 @@ xmlParseConditionalSections(xmlParserCtx + + if ((CUR_PTR == check) && (cons == ctxt->input->consumed)) { + xmlFatalErr(ctxt, XML_ERR_EXT_SUBSET_NOT_FINISHED, NULL); ++ xmlHaltParser(ctxt); + break; + } + } +Index: libxml2-2.9.2/result/errors/759573-2.xml.err +=================================================================== +--- /dev/null ++++ libxml2-2.9.2/result/errors/759573-2.xml.err +@@ -0,0 +1,58 @@ ++Entity: line 1: parser error : Space required after ' ++ ^ ++Entity: line 1: parser error : xmlParseEntityDecl: no name ++ %zz; ++ ^ ++Entity: line 1: ++ ++ ^ ++Entity: line 1: parser error : ParsePI: PI xDOCTYPEm space expected ++ %zz; ++ ^ ++Entity: line 1: ++ ++ ^ ++Entity: line 1: parser error : Space required after ' ++ ^ ++Entity: line 1: parser error : xmlParseEntityDecl: no name ++ %zz; ++ ^ ++Entity: line 1: ++ ++ ^ ++Entity: line 1: parser error : ParsePI: PI xDOCTYPEm space expected ++ %zz; ++ ^ ++Entity: line 1: ++ ++ ^ ++Entity: line 1: parser error : Space required after 'ELEMENT' ++ %xx; ++ ^ ++Entity: line 3: ++%zz; ++ ^ ++./test/errors/759573-2.xml:6: parser error : DOCTYPE improperly terminated ++%xx;ÿggKENSMYNT#MENTDŴzz;'> ++ ^ ++./test/errors/759573-2.xml:6: parser error : Start tag expected, '<' not found ++%xx;ÿggKENSMYNT#MENTDŴzz;'> ++ ^ +Index: libxml2-2.9.2/result/errors/759573-2.xml.str +=================================================================== +--- /dev/null ++++ libxml2-2.9.2/result/errors/759573-2.xml.str +@@ -0,0 +1,4 @@ ++./test/errors/759573-2.xml:2: parser error : Extra content at the end of the document ++%xx; ++ ^ ++./test/errors/759573.xml:1: parser error : DOCTYPE improperly terminated ++T t (A)>%xx; ++ ^ ++./test/errors/759573.xml:1: parser error : Start tag expected, '<' not found ++T t (A)>%xx; ++ ^ +Index: libxml2-2.9.2/result/errors/759573.xml.str +=================================================================== +--- /dev/null ++++ libxml2-2.9.2/result/errors/759573.xml.str +@@ -0,0 +1,4 @@ ++./test/errors/759573.xml:1: parser error : Extra content at the end of the document ++ ++ ++ ++' > ++%xx;ÿggKENSMYNT#MENTDŴzz;'> ++r.B"/> ++e %xx; +\ No newline at end of file diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb index 90f7a7ab79..c7db1de14e 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.2.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb @@ -17,6 +17,7 @@ SRC_URI += "file://CVE-2016-1762.patch \ file://CVE-2016-1835.patch \ file://CVE-2016-1833.patch \ file://CVE-2016-3627.patch \ + file://CVE-2016-4447.patch \ " SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" -- cgit v1.2.3-54-g00ecf