diff options
Diffstat (limited to 'meta/recipes-core/libxml/libxml2/CVE-2020-7595.patch')
| -rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2020-7595.patch | 36 |
1 files changed, 0 insertions, 36 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2020-7595.patch b/meta/recipes-core/libxml/libxml2/CVE-2020-7595.patch deleted file mode 100644 index facfefd362..0000000000 --- a/meta/recipes-core/libxml/libxml2/CVE-2020-7595.patch +++ /dev/null | |||
| @@ -1,36 +0,0 @@ | |||
| 1 | From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Zhipeng Xie <xiezhipeng1@huawei.com> | ||
| 3 | Date: Thu, 12 Dec 2019 17:30:55 +0800 | ||
| 4 | Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities | ||
| 5 | |||
| 6 | When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef | ||
| 7 | return NULL which cause a infinite loop in xmlStringLenDecodeEntities | ||
| 8 | |||
| 9 | Found with libFuzzer. | ||
| 10 | |||
| 11 | Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com> | ||
| 12 | |||
| 13 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076] | ||
| 14 | CVE: CVE-2020-7595 | ||
| 15 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> | ||
| 16 | --- | ||
| 17 | parser.c | 3 ++- | ||
| 18 | 1 file changed, 2 insertions(+), 1 deletion(-) | ||
| 19 | |||
| 20 | diff --git a/parser.c b/parser.c | ||
| 21 | index d1c31963..a34bb6cd 100644 | ||
| 22 | --- a/parser.c | ||
| 23 | +++ b/parser.c | ||
| 24 | @@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len, | ||
| 25 | else | ||
| 26 | c = 0; | ||
| 27 | while ((c != 0) && (c != end) && /* non input consuming loop */ | ||
| 28 | - (c != end2) && (c != end3)) { | ||
| 29 | + (c != end2) && (c != end3) && | ||
| 30 | + (ctxt->instate != XML_PARSER_EOF)) { | ||
| 31 | |||
| 32 | if (c == 0) break; | ||
| 33 | if ((c == '&') && (str[1] == '#')) { | ||
| 34 | -- | ||
| 35 | 2.24.1 | ||
| 36 | |||
