|
 |
6ce3da |
From 752e5f71d7cea2ca5a7e7c0b8f72ed04ce654be4 Mon Sep 17 00:00:00 2001
|
|
|
6ce3da |
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
|
6ce3da |
Date: Wed, 10 Jun 2020 16:34:52 +0200
|
|
|
6ce3da |
Subject: [PATCH 1/2] Don't recurse into xi:include children in
|
|
|
6ce3da |
xmlXIncludeDoProcess
|
|
|
6ce3da |
|
|
|
6ce3da |
Otherwise, nested xi:include nodes might result in a use-after-free
|
|
|
6ce3da |
if XML_PARSE_NOXINCNODE is specified.
|
|
|
6ce3da |
|
|
|
6ce3da |
Found with libFuzzer and ASan.
|
|
|
6ce3da |
---
|
|
|
6ce3da |
result/XInclude/fallback3.xml | 8 ++++++++
|
|
|
6ce3da |
result/XInclude/fallback3.xml.err | 0
|
|
|
6ce3da |
result/XInclude/fallback3.xml.rdr | 25 +++++++++++++++++++++++++
|
|
|
6ce3da |
result/XInclude/fallback4.xml | 10 ++++++++++
|
|
|
6ce3da |
result/XInclude/fallback4.xml.err | 0
|
|
|
6ce3da |
result/XInclude/fallback4.xml.rdr | 29 +++++++++++++++++++++++++++++
|
|
|
6ce3da |
test/XInclude/docs/fallback3.xml | 9 +++++++++
|
|
|
6ce3da |
test/XInclude/docs/fallback4.xml | 7 +++++++
|
|
|
6ce3da |
xinclude.c | 24 ++++++++++--------------
|
|
|
6ce3da |
9 files changed, 98 insertions(+), 14 deletions(-)
|
|
|
6ce3da |
create mode 100644 result/XInclude/fallback3.xml
|
|
|
6ce3da |
create mode 100644 result/XInclude/fallback3.xml.err
|
|
|
6ce3da |
create mode 100644 result/XInclude/fallback3.xml.rdr
|
|
|
6ce3da |
create mode 100644 result/XInclude/fallback4.xml
|
|
|
6ce3da |
create mode 100644 result/XInclude/fallback4.xml.err
|
|
|
6ce3da |
create mode 100644 result/XInclude/fallback4.xml.rdr
|
|
|
6ce3da |
create mode 100644 test/XInclude/docs/fallback3.xml
|
|
|
6ce3da |
create mode 100644 test/XInclude/docs/fallback4.xml
|
|
|
6ce3da |
|
|
|
6ce3da |
diff --git a/result/XInclude/fallback3.xml b/result/XInclude/fallback3.xml
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..b4235514
|
|
|
6ce3da |
--- /dev/null
|
|
|
6ce3da |
+++ b/result/XInclude/fallback3.xml
|
|
|
6ce3da |
@@ -0,0 +1,8 @@
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+ <doc xml:base="../ents/something.xml">
|
|
|
6ce3da |
+something
|
|
|
6ce3da |
+really
|
|
|
6ce3da |
+simple
|
|
|
6ce3da |
+</doc>
|
|
|
6ce3da |
+
|
|
|
6ce3da |
diff --git a/result/XInclude/fallback3.xml.err b/result/XInclude/fallback3.xml.err
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..e69de29b
|
|
|
6ce3da |
diff --git a/result/XInclude/fallback3.xml.rdr b/result/XInclude/fallback3.xml.rdr
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..aa2f1374
|
|
|
6ce3da |
--- /dev/null
|
|
|
6ce3da |
+++ b/result/XInclude/fallback3.xml.rdr
|
|
|
6ce3da |
@@ -0,0 +1,25 @@
|
|
|
6ce3da |
+0 1 a 0 0
|
|
|
6ce3da |
+1 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+1 1 doc 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+2 1 p 0 0
|
|
|
6ce3da |
+3 3 #text 0 1 something
|
|
|
6ce3da |
+2 15 p 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+2 1 p 0 0
|
|
|
6ce3da |
+3 3 #text 0 1 really
|
|
|
6ce3da |
+2 15 p 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+2 1 p 0 0
|
|
|
6ce3da |
+3 3 #text 0 1 simple
|
|
|
6ce3da |
+2 15 p 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+1 15 doc 0 0
|
|
|
6ce3da |
+1 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+0 15 a 0 0
|
|
|
6ce3da |
diff --git a/result/XInclude/fallback4.xml b/result/XInclude/fallback4.xml
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..9883fd54
|
|
|
6ce3da |
--- /dev/null
|
|
|
6ce3da |
+++ b/result/XInclude/fallback4.xml
|
|
|
6ce3da |
@@ -0,0 +1,10 @@
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+ <doc xml:base="../ents/something.xml">
|
|
|
6ce3da |
+something
|
|
|
6ce3da |
+really
|
|
|
6ce3da |
+simple
|
|
|
6ce3da |
+</doc>
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+
|
|
|
6ce3da |
diff --git a/result/XInclude/fallback4.xml.err b/result/XInclude/fallback4.xml.err
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..e69de29b
|
|
|
6ce3da |
diff --git a/result/XInclude/fallback4.xml.rdr b/result/XInclude/fallback4.xml.rdr
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..628b9513
|
|
|
6ce3da |
--- /dev/null
|
|
|
6ce3da |
+++ b/result/XInclude/fallback4.xml.rdr
|
|
|
6ce3da |
@@ -0,0 +1,29 @@
|
|
|
6ce3da |
+0 1 a 0 0
|
|
|
6ce3da |
+1 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+1 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+1 1 doc 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+2 1 p 0 0
|
|
|
6ce3da |
+3 3 #text 0 1 something
|
|
|
6ce3da |
+2 15 p 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+2 1 p 0 0
|
|
|
6ce3da |
+3 3 #text 0 1 really
|
|
|
6ce3da |
+2 15 p 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+2 1 p 0 0
|
|
|
6ce3da |
+3 3 #text 0 1 simple
|
|
|
6ce3da |
+2 15 p 0 0
|
|
|
6ce3da |
+2 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+1 15 doc 0 0
|
|
|
6ce3da |
+1 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+1 14 #text 0 1
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+0 15 a 0 0
|
|
|
6ce3da |
diff --git a/test/XInclude/docs/fallback3.xml b/test/XInclude/docs/fallback3.xml
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..0c8b6c9e
|
|
|
6ce3da |
--- /dev/null
|
|
|
6ce3da |
+++ b/test/XInclude/docs/fallback3.xml
|
|
|
6ce3da |
@@ -0,0 +1,9 @@
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+ <xi:include href="../ents/something.xml" xmlns:xi="http://www.w3.org/2001/XInclude">
|
|
|
6ce3da |
+ <xi:fallback>
|
|
|
6ce3da |
+ <xi:include href="c.xml">
|
|
|
6ce3da |
+ <xi:fallback>There is no c.xml ... </xi:fallback>
|
|
|
6ce3da |
+ </xi:include>
|
|
|
6ce3da |
+ </xi:fallback>
|
|
|
6ce3da |
+ </xi:include>
|
|
|
6ce3da |
+
|
|
|
6ce3da |
diff --git a/test/XInclude/docs/fallback4.xml b/test/XInclude/docs/fallback4.xml
|
|
|
6ce3da |
new file mode 100644
|
|
|
6ce3da |
index 00000000..b500a635
|
|
|
6ce3da |
--- /dev/null
|
|
|
6ce3da |
+++ b/test/XInclude/docs/fallback4.xml
|
|
|
6ce3da |
@@ -0,0 +1,7 @@
|
|
|
6ce3da |
+
|
|
|
6ce3da |
+ <xi:include href="c.xml" xmlns:xi="http://www.w3.org/2001/XInclude">
|
|
|
6ce3da |
+ <xi:fallback>
|
|
|
6ce3da |
+ <xi:include href="../ents/something.xml"/>
|
|
|
6ce3da |
+ </xi:fallback>
|
|
|
6ce3da |
+ </xi:include>
|
|
|
6ce3da |
+
|
|
|
6ce3da |
diff --git a/xinclude.c b/xinclude.c
|
|
|
6ce3da |
index ba850fa5..f260c1a7 100644
|
|
|
6ce3da |
--- a/xinclude.c
|
|
|
6ce3da |
+++ b/xinclude.c
|
|
|
6ce3da |
@@ -2392,21 +2392,19 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
|
|
|
6ce3da |
* First phase: lookup the elements in the document
|
|
|
6ce3da |
*/
|
|
|
6ce3da |
cur = tree;
|
|
|
6ce3da |
- if (xmlXIncludeTestNode(ctxt, cur) == 1)
|
|
|
6ce3da |
- xmlXIncludePreProcessNode(ctxt, cur);
|
|
|
6ce3da |
while ((cur != NULL) && (cur != tree->parent)) {
|
|
|
6ce3da |
/* TODO: need to work on entities -> stack */
|
|
|
6ce3da |
- if ((cur->children != NULL) &&
|
|
|
6ce3da |
- (cur->children->type != XML_ENTITY_DECL) &&
|
|
|
6ce3da |
- (cur->children->type != XML_XINCLUDE_START) &&
|
|
|
6ce3da |
- (cur->children->type != XML_XINCLUDE_END)) {
|
|
|
6ce3da |
- cur = cur->children;
|
|
|
6ce3da |
- if (xmlXIncludeTestNode(ctxt, cur))
|
|
|
6ce3da |
- xmlXIncludePreProcessNode(ctxt, cur);
|
|
|
6ce3da |
- } else if (cur->next != NULL) {
|
|
|
6ce3da |
+ if (xmlXIncludeTestNode(ctxt, cur) == 1) {
|
|
|
6ce3da |
+ xmlXIncludePreProcessNode(ctxt, cur);
|
|
|
6ce3da |
+ } else if ((cur->children != NULL) &&
|
|
|
6ce3da |
+ (cur->children->type != XML_ENTITY_DECL) &&
|
|
|
6ce3da |
+ (cur->children->type != XML_XINCLUDE_START) &&
|
|
|
6ce3da |
+ (cur->children->type != XML_XINCLUDE_END)) {
|
|
|
6ce3da |
+ cur = cur->children;
|
|
|
6ce3da |
+ continue;
|
|
|
6ce3da |
+ }
|
|
|
6ce3da |
+ if (cur->next != NULL) {
|
|
|
6ce3da |
cur = cur->next;
|
|
|
6ce3da |
- if (xmlXIncludeTestNode(ctxt, cur))
|
|
|
6ce3da |
- xmlXIncludePreProcessNode(ctxt, cur);
|
|
|
6ce3da |
} else {
|
|
|
6ce3da |
if (cur == tree)
|
|
|
6ce3da |
break;
|
|
|
6ce3da |
@@ -2416,8 +2414,6 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
|
|
|
6ce3da |
break; /* do */
|
|
|
6ce3da |
if (cur->next != NULL) {
|
|
|
6ce3da |
cur = cur->next;
|
|
|
6ce3da |
- if (xmlXIncludeTestNode(ctxt, cur))
|
|
|
6ce3da |
- xmlXIncludePreProcessNode(ctxt, cur);
|
|
|
6ce3da |
break; /* do */
|
|
|
6ce3da |
}
|
|
|
6ce3da |
} while (cur != NULL);
|
|
|
6ce3da |
--
|
|
|
6ce3da |
2.31.1
|
|
|
6ce3da |
|
|
|
6ce3da |
|
|
|
6ce3da |
From 49cc4182543dba73216add4021994a81678763bd Mon Sep 17 00:00:00 2001
|
|
|
6ce3da |
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
|
6ce3da |
Date: Thu, 22 Apr 2021 19:26:28 +0200
|
|
|
6ce3da |
Subject: [PATCH 2/2] Fix user-after-free with `xmllint --xinclude --dropdtd`
|
|
|
6ce3da |
|
|
|
6ce3da |
The --dropdtd option can leave dangling pointers in entity reference
|
|
|
6ce3da |
nodes. Make sure to skip these nodes when processing XIncludes.
|
|
|
6ce3da |
|
|
|
6ce3da |
This also avoids scanning entity declarations and even modifying
|
|
|
6ce3da |
them inadvertently during XInclude processing.
|
|
|
6ce3da |
|
|
|
6ce3da |
Move from a block list to an allow list approach to avoid descending
|
|
|
6ce3da |
into other node types that can't contain elements.
|
|
|
6ce3da |
|
|
|
6ce3da |
Fixes #237.
|
|
|
6ce3da |
---
|
|
|
6ce3da |
xinclude.c | 5 ++---
|
|
|
6ce3da |
1 file changed, 2 insertions(+), 3 deletions(-)
|
|
|
6ce3da |
|
|
|
6ce3da |
diff --git a/xinclude.c b/xinclude.c
|
|
|
6ce3da |
index f260c1a7..d7648529 100644
|
|
|
6ce3da |
--- a/xinclude.c
|
|
|
6ce3da |
+++ b/xinclude.c
|
|
|
6ce3da |
@@ -2397,9 +2397,8 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
|
|
|
6ce3da |
if (xmlXIncludeTestNode(ctxt, cur) == 1) {
|
|
|
6ce3da |
xmlXIncludePreProcessNode(ctxt, cur);
|
|
|
6ce3da |
} else if ((cur->children != NULL) &&
|
|
|
6ce3da |
- (cur->children->type != XML_ENTITY_DECL) &&
|
|
|
6ce3da |
- (cur->children->type != XML_XINCLUDE_START) &&
|
|
|
6ce3da |
- (cur->children->type != XML_XINCLUDE_END)) {
|
|
|
6ce3da |
+ ((cur->type == XML_DOCUMENT_NODE) ||
|
|
|
6ce3da |
+ (cur->type == XML_ELEMENT_NODE))) {
|
|
|
6ce3da |
cur = cur->children;
|
|
|
6ce3da |
continue;
|
|
|
6ce3da |
}
|
|
|
6ce3da |
--
|
|
|
6ce3da |
2.31.1
|
|
|
6ce3da |
|