From ed72f6b0ba8d71a404bbb0bd350bca1bc903b9c5 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Nov 28 2016 17:50:54 +0000 Subject: import expat-2.1.0-10.el7_3 --- diff --git a/SOURCES/expat-2.1.0-CVE-2016-0718.patch b/SOURCES/expat-2.1.0-CVE-2016-0718.patch new file mode 100644 index 0000000..c71c1b9 --- /dev/null +++ b/SOURCES/expat-2.1.0-CVE-2016-0718.patch @@ -0,0 +1,762 @@ + +Patch as described below, plus a12e78cb1b290e26a2b669eff3664d76bb73a408. + +>From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 2 May 2016 00:02:44 +0200 +Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1) + +* Out of bounds memory access when doing text conversion on malformed input +* Integer overflow related to memory allocation + +Reported by Gustavo Grieco + +Patch credits go to +* Christian Heimes +* Karl Waclawek +* Gustavo Grieco +* Sebastian Pipping +* Pascal Cuoq +--- + expat/lib/xmlparse.c | 34 +++++++++----- + expat/lib/xmltok.c | 115 +++++++++++++++++++++++++++++++++++------------- + expat/lib/xmltok.h | 10 ++++- + expat/lib/xmltok_impl.c | 62 +++++++++++++------------- + 4 files changed, 146 insertions(+), 75 deletions(-) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index e308c79..13e080d 100644 +diff -uap expat-2.1.0/lib/xmlparse.c.cve0718 expat-2.1.0/lib/xmlparse.c +--- expat-2.1.0/lib/xmlparse.c.cve0718 ++++ expat-2.1.0/lib/xmlparse.c +@@ -2415,11 +2415,11 @@ + for (;;) { + int bufSize; + int convLen; +- XmlConvert(enc, ++ const enum XML_Convert_Result convert_res = XmlConvert(enc, + &fromPtr, rawNameEnd, + (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1); + convLen = (int)(toPtr - (XML_Char *)tag->buf); +- if (fromPtr == rawNameEnd) { ++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) { + tag->name.strLen = convLen; + break; + } +@@ -2640,11 +2640,11 @@ + if (MUST_CONVERT(enc, s)) { + for (;;) { + ICHAR *dataPtr = (ICHAR *)dataBuf; +- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); ++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); + *eventEndPP = s; + charDataHandler(handlerArg, dataBuf, + (int)(dataPtr - (ICHAR *)dataBuf)); +- if (s == next) ++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) + break; + *eventPP = s; + } +@@ -3248,11 +3248,11 @@ + if (MUST_CONVERT(enc, s)) { + for (;;) { + ICHAR *dataPtr = (ICHAR *)dataBuf; +- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); ++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); + *eventEndPP = next; + charDataHandler(handlerArg, dataBuf, + (int)(dataPtr - (ICHAR *)dataBuf)); +- if (s == next) ++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) + break; + *eventPP = s; + } +@@ -5329,6 +5329,7 @@ + const char *s, const char *end) + { + if (MUST_CONVERT(enc, s)) { ++ enum XML_Convert_Result convert_res; + const char **eventPP; + const char **eventEndPP; + if (enc == encoding) { +@@ -5341,11 +5342,11 @@ + } + do { + ICHAR *dataPtr = (ICHAR *)dataBuf; +- XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd); ++ convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd); + *eventEndPP = s; + defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf)); + *eventPP = s; +- } while (s != end); ++ } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE)); + } + else + defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s)); +@@ -6148,8 +6149,8 @@ + if (!pool->ptr && !poolGrow(pool)) + return NULL; + for (;;) { +- XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); +- if (ptr == end) ++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); ++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) + break; + if (!poolGrow(pool)) + return NULL; +@@ -6233,8 +6234,13 @@ + } + } + if (pool->blocks && pool->start == pool->blocks->s) { +- int blockSize = (int)(pool->end - pool->start)*2; +- BLOCK *temp = (BLOCK *) ++ BLOCK *temp; ++ int blockSize = (int)((unsigned)(pool->end - pool->start)*2U); ++ ++ if (blockSize < 0) ++ return XML_FALSE; ++ ++ temp = (BLOCK *) + pool->mem->realloc_fcn(pool->blocks, + (offsetof(BLOCK, s) + + blockSize * sizeof(XML_Char))); +@@ -6249,6 +6255,10 @@ + else { + BLOCK *tem; + int blockSize = (int)(pool->end - pool->start); ++ ++ if (blockSize < 0) ++ return XML_FALSE; ++ + if (blockSize < INIT_BLOCK_SIZE) + blockSize = INIT_BLOCK_SIZE; + else +diff -uap expat-2.1.0/lib/xmltok.c.cve0718 expat-2.1.0/lib/xmltok.c +--- expat-2.1.0/lib/xmltok.c.cve0718 ++++ expat-2.1.0/lib/xmltok.c +@@ -318,39 +318,55 @@ + UTF8_cval4 = 0xf0 + }; + +-static void PTRCALL ++static enum XML_Convert_Result PTRCALL + utf8_toUtf8(const ENCODING *enc, + const char **fromP, const char *fromLim, + char **toP, const char *toLim) + { ++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; + char *to; + const char *from; + if (fromLim - *fromP > toLim - *toP) { + /* Avoid copying partial characters. */ ++ res = XML_CONVERT_OUTPUT_EXHAUSTED; + for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--) + if (((unsigned char)fromLim[-1] & 0xc0) != 0x80) + break; + } +- for (to = *toP, from = *fromP; from != fromLim; from++, to++) ++ for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++) + *to = *from; + *fromP = from; + *toP = to; ++ ++ if ((to == toLim) && (from < fromLim)) ++ return XML_CONVERT_OUTPUT_EXHAUSTED; ++ else ++ return res; + } + +-static void PTRCALL ++static enum XML_Convert_Result PTRCALL + utf8_toUtf16(const ENCODING *enc, + const char **fromP, const char *fromLim, + unsigned short **toP, const unsigned short *toLim) + { ++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; + unsigned short *to = *toP; + const char *from = *fromP; +- while (from != fromLim && to != toLim) { ++ while (from < fromLim && to < toLim) { + switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) { + case BT_LEAD2: ++ if (fromLim - from < 2) { ++ res = XML_CONVERT_INPUT_INCOMPLETE; ++ break; ++ } + *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f)); + from += 2; + break; + case BT_LEAD3: ++ if (fromLim - from < 3) { ++ res = XML_CONVERT_INPUT_INCOMPLETE; ++ break; ++ } + *to++ = (unsigned short)(((from[0] & 0xf) << 12) + | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f)); + from += 3; +@@ -358,8 +374,14 @@ + case BT_LEAD4: + { + unsigned long n; +- if (to + 1 == toLim) ++ if (toLim - to < 2) { ++ res = XML_CONVERT_OUTPUT_EXHAUSTED; + goto after; ++ } ++ if (fromLim - from < 4) { ++ res = XML_CONVERT_INPUT_INCOMPLETE; ++ goto after; ++ } + n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12) + | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f); + n -= 0x10000; +@@ -377,6 +399,7 @@ + after: + *fromP = from; + *toP = to; ++ return res; + } + + #ifdef XML_NS +@@ -425,7 +448,7 @@ + STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_) + }; + +-static void PTRCALL ++static enum XML_Convert_Result PTRCALL + latin1_toUtf8(const ENCODING *enc, + const char **fromP, const char *fromLim, + char **toP, const char *toLim) +@@ -433,30 +456,35 @@ + for (;;) { + unsigned char c; + if (*fromP == fromLim) +- break; ++ return XML_CONVERT_COMPLETED; + c = (unsigned char)**fromP; + if (c & 0x80) { + if (toLim - *toP < 2) +- break; ++ return XML_CONVERT_OUTPUT_EXHAUSTED; + *(*toP)++ = (char)((c >> 6) | UTF8_cval2); + *(*toP)++ = (char)((c & 0x3f) | 0x80); + (*fromP)++; + } + else { + if (*toP == toLim) +- break; ++ return XML_CONVERT_OUTPUT_EXHAUSTED; + *(*toP)++ = *(*fromP)++; + } + } + } + +-static void PTRCALL ++static enum XML_Convert_Result PTRCALL + latin1_toUtf16(const ENCODING *enc, + const char **fromP, const char *fromLim, + unsigned short **toP, const unsigned short *toLim) + { +- while (*fromP != fromLim && *toP != toLim) ++ while (*fromP < fromLim && *toP < toLim) + *(*toP)++ = (unsigned char)*(*fromP)++; ++ ++ if ((*toP == toLim) && (*fromP < fromLim)) ++ return XML_CONVERT_OUTPUT_EXHAUSTED; ++ else ++ return XML_CONVERT_COMPLETED; + } + + #ifdef XML_NS +@@ -483,13 +511,18 @@ + STANDARD_VTABLE(sb_) + }; + +-static void PTRCALL ++static enum XML_Convert_Result PTRCALL + ascii_toUtf8(const ENCODING *enc, + const char **fromP, const char *fromLim, + char **toP, const char *toLim) + { +- while (*fromP != fromLim && *toP != toLim) ++ while (*fromP < fromLim && *toP < toLim) + *(*toP)++ = *(*fromP)++; ++ ++ if ((*toP == toLim) && (*fromP < fromLim)) ++ return XML_CONVERT_OUTPUT_EXHAUSTED; ++ else ++ return XML_CONVERT_COMPLETED; + } + + #ifdef XML_NS +@@ -536,13 +569,14 @@ + } + + #define DEFINE_UTF16_TO_UTF8(E) \ +-static void PTRCALL \ ++static enum XML_Convert_Result PTRCALL \ + E ## toUtf8(const ENCODING *enc, \ + const char **fromP, const char *fromLim, \ + char **toP, const char *toLim) \ + { \ +- const char *from; \ +- for (from = *fromP; from != fromLim; from += 2) { \ ++ const char *from = *fromP; \ ++ fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \ ++ for (; from < fromLim; from += 2) { \ + int plane; \ + unsigned char lo2; \ + unsigned char lo = GET_LO(from); \ +@@ -552,7 +586,7 @@ + if (lo < 0x80) { \ + if (*toP == toLim) { \ + *fromP = from; \ +- return; \ ++ return XML_CONVERT_OUTPUT_EXHAUSTED; \ + } \ + *(*toP)++ = lo; \ + break; \ +@@ -562,7 +596,7 @@ + case 0x4: case 0x5: case 0x6: case 0x7: \ + if (toLim - *toP < 2) { \ + *fromP = from; \ +- return; \ ++ return XML_CONVERT_OUTPUT_EXHAUSTED; \ + } \ + *(*toP)++ = ((lo >> 6) | (hi << 2) | UTF8_cval2); \ + *(*toP)++ = ((lo & 0x3f) | 0x80); \ +@@ -570,7 +604,7 @@ + default: \ + if (toLim - *toP < 3) { \ + *fromP = from; \ +- return; \ ++ return XML_CONVERT_OUTPUT_EXHAUSTED; \ + } \ + /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \ + *(*toP)++ = ((hi >> 4) | UTF8_cval3); \ +@@ -580,7 +614,11 @@ + case 0xD8: case 0xD9: case 0xDA: case 0xDB: \ + if (toLim - *toP < 4) { \ + *fromP = from; \ +- return; \ ++ return XML_CONVERT_OUTPUT_EXHAUSTED; \ ++ } \ ++ if (fromLim - from < 4) { \ ++ *fromP = from; \ ++ return XML_CONVERT_INPUT_INCOMPLETE; \ + } \ + plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \ + *(*toP)++ = ((plane >> 2) | UTF8_cval4); \ +@@ -596,20 +634,32 @@ + } \ + } \ + *fromP = from; \ ++ if (from < fromLim) \ ++ return XML_CONVERT_INPUT_INCOMPLETE; \ ++ else \ ++ return XML_CONVERT_COMPLETED; \ + } + + #define DEFINE_UTF16_TO_UTF16(E) \ +-static void PTRCALL \ ++static enum XML_Convert_Result PTRCALL \ + E ## toUtf16(const ENCODING *enc, \ + const char **fromP, const char *fromLim, \ + unsigned short **toP, const unsigned short *toLim) \ + { \ ++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \ ++ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \ + /* Avoid copying first half only of surrogate */ \ + if (fromLim - *fromP > ((toLim - *toP) << 1) \ +- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \ ++ && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \ + fromLim -= 2; \ +- for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \ ++ res = XML_CONVERT_INPUT_INCOMPLETE; \ ++ } \ ++ for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \ + *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \ ++ if ((*toP == toLim) && (*fromP < fromLim)) \ ++ return XML_CONVERT_OUTPUT_EXHAUSTED; \ ++ else \ ++ return res; \ + } + + #define SET2(ptr, ch) \ +@@ -1288,7 +1338,7 @@ + return (c & ~0xFFFF) || checkCharRefNumber(c) < 0; + } + +-static void PTRCALL ++static enum XML_Convert_Result PTRCALL + unknown_toUtf8(const ENCODING *enc, + const char **fromP, const char *fromLim, + char **toP, const char *toLim) +@@ -1299,21 +1349,21 @@ + const char *utf8; + int n; + if (*fromP == fromLim) +- break; ++ return XML_CONVERT_COMPLETED; + utf8 = uenc->utf8[(unsigned char)**fromP]; + n = *utf8++; + if (n == 0) { + int c = uenc->convert(uenc->userData, *fromP); + n = XmlUtf8Encode(c, buf); + if (n > toLim - *toP) +- break; ++ return XML_CONVERT_OUTPUT_EXHAUSTED; + utf8 = buf; + *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP] + - (BT_LEAD2 - 2)); + } + else { + if (n > toLim - *toP) +- break; ++ return XML_CONVERT_OUTPUT_EXHAUSTED; + (*fromP)++; + } + do { +@@ -1322,13 +1372,13 @@ + } + } + +-static void PTRCALL ++static enum XML_Convert_Result PTRCALL + unknown_toUtf16(const ENCODING *enc, + const char **fromP, const char *fromLim, + unsigned short **toP, const unsigned short *toLim) + { + const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc); +- while (*fromP != fromLim && *toP != toLim) { ++ while (*fromP < fromLim && *toP < toLim) { + unsigned short c = uenc->utf16[(unsigned char)**fromP]; + if (c == 0) { + c = (unsigned short) +@@ -1340,6 +1390,11 @@ + (*fromP)++; + *(*toP)++ = c; + } ++ ++ if ((*toP == toLim) && (*fromP < fromLim)) ++ return XML_CONVERT_OUTPUT_EXHAUSTED; ++ else ++ return XML_CONVERT_COMPLETED; + } + + ENCODING * +@@ -1503,7 +1558,7 @@ + { + const ENCODING **encPtr; + +- if (ptr == end) ++ if (ptr >= end) + return XML_TOK_NONE; + encPtr = enc->encPtr; + if (ptr + 1 == end) { +diff -uap expat-2.1.0/lib/xmltok.h.cve0718 expat-2.1.0/lib/xmltok.h +--- expat-2.1.0/lib/xmltok.h.cve0718 ++++ expat-2.1.0/lib/xmltok.h +@@ -130,6 +130,12 @@ + const char *, + const char **); + ++enum XML_Convert_Result { ++ XML_CONVERT_COMPLETED = 0, ++ XML_CONVERT_INPUT_INCOMPLETE = 1, ++ XML_CONVERT_OUTPUT_EXHAUSTED = 2 /* and therefore potentially input remaining as well */ ++}; ++ + struct encoding { + SCANNER scanners[XML_N_STATES]; + SCANNER literalScanners[XML_N_LITERAL_TYPES]; +@@ -158,12 +164,12 @@ + const char *ptr, + const char *end, + const char **badPtr); +- void (PTRCALL *utf8Convert)(const ENCODING *enc, ++ enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc, + const char **fromP, + const char *fromLim, + char **toP, + const char *toLim); +- void (PTRCALL *utf16Convert)(const ENCODING *enc, ++ enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc, + const char **fromP, + const char *fromLim, + unsigned short **toP, +diff -uap expat-2.1.0/lib/xmltok_impl.c.cve0718 expat-2.1.0/lib/xmltok_impl.c +--- expat-2.1.0/lib/xmltok_impl.c.cve0718 ++++ expat-2.1.0/lib/xmltok_impl.c +@@ -93,13 +93,13 @@ + PREFIX(scanComment)(const ENCODING *enc, const char *ptr, + const char *end, const char **nextTokPtr) + { +- if (ptr != end) { ++ if (ptr < end) { + if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) { + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } + ptr += MINBPC(enc); +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + INVALID_CASES(ptr, nextTokPtr) + case BT_MINUS: +@@ -147,7 +147,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + case BT_PERCNT: + if (ptr + MINBPC(enc) == end) +@@ -233,7 +233,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + case BT_S: case BT_CR: case BT_LF: +@@ -242,7 +242,7 @@ + return XML_TOK_INVALID; + } + ptr += MINBPC(enc); +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + INVALID_CASES(ptr, nextTokPtr) + case BT_QUEST: +@@ -305,7 +305,7 @@ + PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr, + const char *end, const char **nextTokPtr) + { +- if (ptr == end) ++ if (ptr >= end) + return XML_TOK_NONE; + if (MINBPC(enc) > 1) { + size_t n = end - ptr; +@@ -348,7 +348,7 @@ + ptr += MINBPC(enc); + break; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + #define LEAD_CASE(n) \ + case BT_LEAD ## n: \ +@@ -391,11 +391,11 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + case BT_S: case BT_CR: case BT_LF: +- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { ++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { + switch (BYTE_TYPE(enc, ptr)) { + case BT_S: case BT_CR: case BT_LF: + break; +@@ -432,7 +432,7 @@ + PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr, + const char *end, const char **nextTokPtr) + { +- if (ptr != end) { ++ if (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + case BT_DIGIT: + case BT_HEX: +@@ -441,7 +441,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { ++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { + switch (BYTE_TYPE(enc, ptr)) { + case BT_DIGIT: + case BT_HEX: +@@ -464,7 +464,7 @@ + PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr, + const char *end, const char **nextTokPtr) + { +- if (ptr != end) { ++ if (ptr < end) { + if (CHAR_MATCHES(enc, ptr, ASCII_x)) + return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr); + switch (BYTE_TYPE(enc, ptr)) { +@@ -474,7 +474,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { ++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { + switch (BYTE_TYPE(enc, ptr)) { + case BT_DIGIT: + break; +@@ -506,7 +506,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + case BT_SEMI: +@@ -529,7 +529,7 @@ + #ifdef XML_NS + int hadColon = 0; + #endif +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + #ifdef XML_NS +@@ -716,7 +716,7 @@ + hadColon = 0; + #endif + /* we have a start-tag */ +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + #ifdef XML_NS +@@ -740,7 +740,7 @@ + case BT_S: case BT_CR: case BT_LF: + { + ptr += MINBPC(enc); +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr) + case BT_GT: +@@ -785,7 +785,7 @@ + PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end, + const char **nextTokPtr) + { +- if (ptr == end) ++ if (ptr >= end) + return XML_TOK_NONE; + if (MINBPC(enc) > 1) { + size_t n = end - ptr; +@@ -832,7 +832,7 @@ + ptr += MINBPC(enc); + break; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + #define LEAD_CASE(n) \ + case BT_LEAD ## n: \ +@@ -895,7 +895,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + case BT_SEMI: +@@ -921,7 +921,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + case BT_CR: case BT_LF: case BT_S: +@@ -941,7 +941,7 @@ + const char *ptr, const char *end, + const char **nextTokPtr) + { +- while (ptr != end) { ++ while (ptr < end) { + int t = BYTE_TYPE(enc, ptr); + switch (t) { + INVALID_CASES(ptr, nextTokPtr) +@@ -973,7 +973,7 @@ + const char **nextTokPtr) + { + int tok; +- if (ptr == end) ++ if (ptr >= end) + return XML_TOK_NONE; + if (MINBPC(enc) > 1) { + size_t n = end - ptr; +@@ -1141,7 +1141,7 @@ + *nextTokPtr = ptr; + return XML_TOK_INVALID; + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) + case BT_GT: case BT_RPAR: case BT_COMMA: +@@ -1204,10 +1204,10 @@ + const char *end, const char **nextTokPtr) + { + const char *start; +- if (ptr == end) ++ if (ptr >= end) + return XML_TOK_NONE; + start = ptr; +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + #define LEAD_CASE(n) \ + case BT_LEAD ## n: ptr += n; break; +@@ -1262,10 +1262,10 @@ + const char *end, const char **nextTokPtr) + { + const char *start; +- if (ptr == end) ++ if (ptr >= end) + return XML_TOK_NONE; + start = ptr; +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + #define LEAD_CASE(n) \ + case BT_LEAD ## n: ptr += n; break; +@@ -1326,7 +1326,7 @@ + end = ptr + n; + } + } +- while (ptr != end) { ++ while (ptr < end) { + switch (BYTE_TYPE(enc, ptr)) { + INVALID_CASES(ptr, nextTokPtr) + case BT_LT: +@@ -1373,7 +1373,7 @@ + { + ptr += MINBPC(enc); + end -= MINBPC(enc); +- for (; ptr != end; ptr += MINBPC(enc)) { ++ for (; ptr < end; ptr += MINBPC(enc)) { + switch (BYTE_TYPE(enc, ptr)) { + case BT_DIGIT: + case BT_HEX: +@@ -1744,7 +1744,7 @@ + const char *end, + POSITION *pos) + { +- while (ptr < end) { ++ while (end - ptr >= MINBPC(enc)) { + switch (BYTE_TYPE(enc, ptr)) { + #define LEAD_CASE(n) \ + case BT_LEAD ## n: \ +@@ -1760,7 +1760,7 @@ + case BT_CR: + pos->lineNumber++; + ptr += MINBPC(enc); +- if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF) ++ if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF) + ptr += MINBPC(enc); + pos->columnNumber = (XML_Size)-1; + break; diff --git a/SPECS/expat.spec b/SPECS/expat.spec index f662412..3c4740d 100644 --- a/SPECS/expat.spec +++ b/SPECS/expat.spec @@ -1,10 +1,11 @@ Summary: An XML parser library Name: expat Version: 2.1.0 -Release: 8%{?dist} +Release: 10%{?dist} Group: System Environment/Libraries Source: http://downloads.sourceforge.net/expat/expat-%{version}.tar.gz Patch0: expat-2.1.0-xmlwfargs.patch +Patch1: expat-2.1.0-CVE-2016-0718.patch URL: http://www.libexpat.org/ License: MIT BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -39,6 +40,7 @@ Install it if you need to link statically with expat. %prep %setup -q %patch0 -p1 -b .xmlwfargs +%patch1 -p1 -b .cve0718 %build rm -rf autom4te*.cache @@ -85,6 +87,12 @@ rm -rf ${RPM_BUILD_ROOT} %{_libdir}/lib*.a %changelog +* Thu Nov 24 2016 Joe Orton - 2.1.0-10 +- updated security fix for CVE-2016-0718 + +* Thu Nov 24 2016 Joe Orton - 2.1.0-9 +- add security fix for CVE-2016-0718 + * Fri Jan 24 2014 Daniel Mach - 2.1.0-8 - Mass rebuild 2014-01-24