https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-15903

https://github.com/libexpat/libexpat/commit/6da1f19625592bfb928253620cac568d9a9b9c65

--- expat-2.1.0/lib/xmlparse.c.cve15903

+++ expat-2.1.0/lib/xmlparse.c

@@ -331,7 +331,7 @@

 static enum XML_Error

 doProlog(XML_Parser parser, const ENCODING *enc, const char *s,

          const char *end, int tok, const char *next, const char **nextPtr,

-         XML_Bool haveMore);

+         XML_Bool haveMore, XML_Bool allowClosingDoctype);

 static enum XML_Error

 processInternalEntity(XML_Parser parser, ENTITY *entity,

                       XML_Bool betweenDecl);

@@ -3699,7 +3699,7 @@

   processor = prologProcessor;

   return doProlog(parser, encoding, s, end, tok, next,

-                  nextPtr, (XML_Bool)!ps_finalBuffer);

+                  nextPtr, (XML_Bool)!ps_finalBuffer, XML_TRUE);

 }

 static enum XML_Error PTRCALL

@@ -3749,7 +3749,7 @@

   const char *next = s;

   int tok = XmlPrologTok(encoding, s, end, &next;;

   return doProlog(parser, encoding, s, end, tok, next,

-                  nextPtr, (XML_Bool)!ps_finalBuffer);

+                  nextPtr, (XML_Bool)!ps_finalBuffer, XML_TRUE);

 }

 static enum XML_Error

@@ -3760,7 +3760,8 @@

          int tok,

          const char *next,

          const char **nextPtr,

-         XML_Bool haveMore)

+         XML_Bool haveMore,

+         XML_Bool allowClosingDoctype)

 {

 #ifdef XML_DTD

   static const XML_Char externalSubsetName[] = { ASCII_HASH , '\0' };

@@ -3936,6 +3937,11 @@

       }

       break;

     case XML_ROLE_DOCTYPE_CLOSE:

+      if (allowClosingDoctype != XML_TRUE) {

+        /* Must not close doctype from within expanded parameter entities */

+        return XML_ERROR_INVALID_TOKEN;

+      }

+

       if (doctypeName) {

         startDoctypeDeclHandler(handlerArg, doctypeName,

                                 doctypeSysid, doctypePubid, 0);

@@ -4837,7 +4843,7 @@

   if (entity->is_param) {

     int tok = XmlPrologTok(internalEncoding, textStart, textEnd, &next;;

     result = doProlog(parser, internalEncoding, textStart, textEnd, tok,

-                      next, &next, XML_FALSE);

+                      next, &next, XML_FALSE, XML_FALSE);

   }

   else

 #endif /* XML_DTD */

@@ -4882,7 +4888,7 @@

   if (entity->is_param) {

     int tok = XmlPrologTok(internalEncoding, textStart, textEnd, &next;;

     result = doProlog(parser, internalEncoding, textStart, textEnd, tok,

-                      next, &next, XML_FALSE);

+                      next, &next, XML_FALSE, XML_TRUE);

   }

   else

 #endif /* XML_DTD */

@@ -4909,7 +4915,7 @@

     processor = prologProcessor;

     tok = XmlPrologTok(encoding, s, end, &next;;

     return doProlog(parser, encoding, s, end, tok, next, nextPtr,

-                    (XML_Bool)!ps_finalBuffer);

+                    (XML_Bool)!ps_finalBuffer, XML_TRUE);

   }

   else

 #endif /* XML_DTD */

--- expat-2.1.0/tests/runtests.c.cve15903

+++ expat-2.1.0/tests/runtests.c

@@ -1157,6 +1157,69 @@

     CharData_AppendString(storage, "\n");

 }

+#ifdef XML_DTD

+START_TEST(test_misc_deny_internal_entity_closing_doctype_issue_317) {

+  const char *const inputOne = "

+                               "<d/>'>\n"

+                               "\n"

+                               "%e;";

+  const char *const inputTwo = "

+                               "<d/>'>\n"

+                               "\n"

+                               "%e2;";

+  const char *const inputThree = "

+                                 "<d'>\n"

+                                 "\n"

+                                 "%e;";

+  const char *const inputIssue317 = "

+                                    "\n"

+                                    "<doc>Hell<oc (#PCDATA)*>'>\n"

+                                    "%foo;\n"

+                                    "]>\n"

+                                    "<doc>Hello, world</dVc>";

+

+  const char *const inputs[] = {inputOne, inputTwo, inputThree, inputIssue317};

+  size_t inputIndex = 0;

+

+  for (; inputIndex < sizeof(inputs) / sizeof(inputs[0]); inputIndex++) {

+    XML_Parser parser;

+    enum XML_Status parseResult;

+    int setParamEntityResult;

+    XML_Size lineNumber;

+    XML_Size columnNumber;

+    const char *const input = inputs[inputIndex];

+

+    parser = XML_ParserCreate(NULL);

+    setParamEntityResult

+        = XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS);

+    if (setParamEntityResult != 1)

+      fail("Failed to set XML_PARAM_ENTITY_PARSING_ALWAYS.");

+

+    parseResult = XML_Parse(parser, input, (int)strlen(input), 0);

+    if (parseResult != XML_STATUS_ERROR) {

+      parseResult = XML_Parse(parser, "", 0, 1);

+      if (parseResult != XML_STATUS_ERROR) {

+        fail("Parsing was expected to fail but succeeded.");

+      }

+    }

+

+    if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_TOKEN)

+      fail("Error code does not match XML_ERROR_INVALID_TOKEN");

+

+    lineNumber = XML_GetCurrentLineNumber(parser);

+    if (lineNumber != 4)

+      fail("XML_GetCurrentLineNumber does not work as expected.");

+

+    columnNumber = XML_GetCurrentColumnNumber(parser);

+    if (columnNumber != 0)

+      fail("XML_GetCurrentColumnNumber does not work as expected.");

+

+    XML_ParserFree(parser);

+  }

+}

+END_TEST

+#endif

+

 static void

 run_ns_tagname_overwrite_test(char *text, char *result)

 {

@@ -1479,6 +1542,11 @@

     tcase_add_test(tc_namespace, test_ns_unbound_prefix_on_attribute);

     tcase_add_test(tc_namespace, test_ns_unbound_prefix_on_element);

+#ifdef XML_DTD

+    tcase_add_test(tc_basic,

+                   test_misc_deny_internal_entity_closing_doctype_issue_317);

+#endif

+

     return s;

 }