blob: 6c7b1c11e7e14f638d8dd88bcce4ad31ad5cab63 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
From 245b70d7d2768572ae1b05b3668ca858b9ec4ed4 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Tue, 10 Dec 2024 16:52:05 +0100
Subject: [PATCH] [CVE-2024-56171] Fix use-after-free after
xmlSchemaItemListAdd
xmlSchemaItemListAdd can reallocate the items array. Update local
variables after adding item in
- xmlSchemaIDCFillNodeTables
- xmlSchemaBubbleIDCNodeTables
Fixes #828.
CVE: CVE-2024-56171
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/245b70d7d2768572ae1b05b3668ca858b9ec4ed4]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
xmlschemas.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/xmlschemas.c b/xmlschemas.c
index a089ebc5..18e35e75 100644
--- a/xmlschemas.c
+++ b/xmlschemas.c
@@ -23647,6 +23647,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
}
if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1)
goto internal_error;
+ dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items;
/*
* Remove the duplicate entry from the IDC node-table.
*/
@@ -23863,6 +23864,8 @@ xmlSchemaBubbleIDCNodeTables(xmlSchemaValidCtxtPtr vctxt)
goto internal_error;
}
xmlSchemaItemListAdd(parBind->dupls, parNode);
+ dupls = (xmlSchemaPSVIIDCNodePtr *)
+ parBind->dupls->items;
} else {
/*
* Add the node-table entry (node and key-sequence) of
|
