From b1d34de46a11323fccffa9fadeb33be670d602f5 Mon Sep 17 00:00:00 2001 From: Daniel Veillard Date: Mon, 14 Mar 2016 17:19:44 +0800 Subject: [PATCH] Fix inappropriate fetch of entities content For https://bugzilla.gnome.org/show_bug.cgi?id=761430 libfuzzer regression testing exposed another case where the parser would fetch content of an external entity while not in validating mode. Plug that hole Upstream-status: Backport CVE: CVE-2016-4449 Signed-off-by: Armin Kuster --- parser.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) Index: libxml2-2.9.2/parser.c =================================================================== --- libxml2-2.9.2.orig/parser.c +++ libxml2-2.9.2/parser.c @@ -2873,7 +2873,21 @@ xmlStringLenDecodeEntities(xmlParserCtxt ctxt->nbentities += ent->checked / 2; if (ent != NULL) { if (ent->content == NULL) { - xmlLoadEntityContent(ctxt, ent); + /* + * Note: external parsed entities will not be loaded, + * it is not required for a non-validating parser to + * complete external PEreferences coming from the + * internal subset + */ + if (((ctxt->options & XML_PARSE_NOENT) != 0) || + ((ctxt->options & XML_PARSE_DTDVALID) != 0) || + (ctxt->validate != 0)) { + xmlLoadEntityContent(ctxt, ent); + } else { + xmlWarningMsg(ctxt, XML_ERR_ENTITY_PROCESSING, + "not validating will not read content for PE entity %s\n", + ent->name, NULL); + } } ctxt->depth++; rep = xmlStringDecodeEntities(ctxt, ent->content, what,