131 lines
16 KiB
Diff
131 lines
16 KiB
Diff
|
Fix CVE-2017-{9047,9048}:
|
||
|
|
|
||
|
|
https://bugzilla.gnome.org/show_bug.cgi?id=781333 (not yet public)
|
||
|
|
https://bugzilla.gnome.org/show_bug.cgi?id=781701 (not yet public)
|
||
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9047
|
||
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9048
|
||
|
|
http://www.openwall.com/lists/oss-security/2017/05/15/1
|
||
|
|
https://security-tracker.debian.org/tracker/CVE-2017-9047
|
||
|
|
https://security-tracker.debian.org/tracker/CVE-2017-9048
|
||
|
|
|
||
|
|
Patch copied from upstream source repository:
|
||
|
|
|
||
|
|
https://git.gnome.org/browse/libxml2/commit/?id=932cc9896ab41475d4aa429c27d9afd175959d74
|
||
|
|
|
||
|
|
From 932cc9896ab41475d4aa429c27d9afd175959d74 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
||
|
|
Date: Sat, 3 Jun 2017 02:01:29 +0200
|
||
|
|
Subject: [PATCH] Fix buffer size checks in xmlSnprintfElementContent
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
xmlSnprintfElementContent failed to correctly check the available
|
||
|
|
buffer space in two locations.
|
||
|
|
|
||
|
|
Fixes bug 781333 (CVE-2017-9047) and bug 781701 (CVE-2017-9048).
|
||
|
|
|
||
|
|
Thanks to Marcel Böhme and Thuan Pham for the report.
|
||
|
|
---
|
||
|
|
result/valid/781333.xml | 5 +++++
|
||
|
|
result/valid/781333.xml.err | 3 +++
|
||
|
|
result/valid/781333.xml.err.rdr | 6 ++++++
|
||
|
|
test/valid/781333.xml | 4 ++++
|
||
|
|
valid.c | 20 +++++++++++---------
|
||
|
|
5 files changed, 29 insertions(+), 9 deletions(-)
|
||
|
|
create mode 100644 result/valid/781333.xml
|
||
|
|
create mode 100644 result/valid/781333.xml.err
|
||
|
|
create mode 100644 result/valid/781333.xml.err.rdr
|
||
|
|
create mode 100644 test/valid/781333.xml
|
||
|
|
|
||
|
|
diff --git a/result/valid/781333.xml b/result/valid/781333.xml
|
||
|
|
new file mode 100644
|
||
|
|
index 00000000..45dc451d
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/result/valid/781333.xml
|
||
|
|
@@ -0,0 +1,5 @@
|
||
|
|
+<?xml version="1.0"?>
|
||
|
|
+<!DOCTYPE a [
|
||
|
|
+<!ELEMENT a (pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp:llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
|
||
|
|
+]>
|
||
|
|
+<a/>
|
||
|
|
diff --git a/result/valid/781333.xml.err b/result/valid/781333.xml.err
|
||
|
|
new file mode 100644
|
||
|
|
index 00000000..b401b49a
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/result/valid/781333.xml.err
|
||
|
|
@@ -0,0 +1,3 @@
|
||
|
|
+./test/valid/781333.xml:4: element a: validity error : Element a content does not follow the DTD, expecting ( ..., got
|
||
|
|
+<a/>
|
||
|
|
+ ^
|
||
|
|
diff --git a/result/valid/781333.xml.err.rdr b/result/valid/781333.xml.err.rdr
|
||
|
|
new file mode 100644
|
||
|
|
index 00000000..5ff56992
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/result/valid/781333.xml.err.rdr
|
||
|
|
@@ -0,0 +1,6 @@
|
||
|
|
+./test/valid/781333.xml:4: element a: validity error : Element a content does not follow the DTD, expecting ( ..., got
|
||
|
|
+<a/>
|
||
|
|
+ ^
|
||
|
|
+./test/valid/781333.xml:5: element a: validity error : Element a content does not follow the DTD, Expecting more child
|
||
|
|
+
|
||
|
|
+^
|
||
|
|
diff --git a/test/valid/781333.xml b/test/valid/781333.xml
|
||
|
|
new file mode 100644
|
||
|
|
index 00000000..b29e5a68
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/test/valid/781333.xml
|
||
|
|
@@ -0,0 +1,4 @@
|
||
|
|
+<!DOCTYPE a [
|
||
|
|
+ <!ELEMENT a (pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp:llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
|
||
|
|
+]>
|
||
|
|
+<a/>
|
||
|
|
diff --git a/valid.c b/valid.c
|
||
|
|
index 19f84b82..9b2df56a 100644
|
||
|
|
--- a/valid.c
|
||
|
|
+++ b/valid.c
|
||
|
|
@@ -1262,22 +1262,23 @@ xmlSnprintfElementContent(char *buf, int size, xmlElementContentPtr content, int
|
||
|
|
case XML_ELEMENT_CONTENT_PCDATA:
|
||
|
|
strcat(buf, "#PCDATA");
|
||
|
|
break;
|
||
|
|
- case XML_ELEMENT_CONTENT_ELEMENT:
|
||
|
|
+ case XML_ELEMENT_CONTENT_ELEMENT: {
|
||
|
|
+ int qnameLen = xmlStrlen(content->name);
|
||
|
|
+
|
||
|
|
+ if (content->prefix != NULL)
|
||
|
|
+ qnameLen += xmlStrlen(content->prefix) + 1;
|
||
|
|
+ if (size - len < qnameLen + 10) {
|
||
|
|
+ strcat(buf, " ...");
|
||
|
|
+ return;
|
||
|
|
+ }
|
||
|
|
if (content->prefix != NULL) {
|
||
|
|
- if (size - len < xmlStrlen(content->prefix) + 10) {
|
||
|
|
- strcat(buf, " ...");
|
||
|
|
- return;
|
||
|
|
- }
|
||
|
|
strcat(buf, (char *) content->prefix);
|
||
|
|
strcat(buf, ":");
|
||
|
|
}
|
||
|
|
- if (size - len < xmlStrlen(content->name) + 10) {
|
||
|
|
- strcat(buf, " ...");
|
||
|
|
- return;
|
||
|
|
- }
|
||
|
|
if (content->name != NULL)
|
||
|
|
strcat(buf, (char *) content->name);
|
||
|
|
break;
|
||
|
|
+ }
|
||
|
|
case XML_ELEMENT_CONTENT_SEQ:
|
||
|
|
if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
|
||
|
|
(content->c1->type == XML_ELEMENT_CONTENT_SEQ))
|
||
|
|
@@ -1319,6 +1320,7 @@ xmlSnprintfElementContent(char *buf, int size, xmlElementContentPtr content, int
|
||
|
|
xmlSnprintfElementContent(buf, size, content->c2, 0);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
+ if (size - strlen(buf) <= 2) return;
|
||
|
|
if (englob)
|
||
|
|
strcat(buf, ")");
|
||
|
|
switch (content->ocur) {
|
||
|
|
--
|
||
|
|
2.14.1
|
||
|
|
|