|
 |
a5fbdf |
diff -up firefox-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236 firefox-91.7.0/parser/expat/lib/xmlparse.c
|
|
|
a5fbdf |
--- firefox-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236 2022-03-02 18:08:40.085642028 +0100
|
|
|
a5fbdf |
+++ firefox-91.7.0/parser/expat/lib/xmlparse.c 2022-03-02 18:13:31.838667958 +0100
|
|
|
a5fbdf |
@@ -700,8 +700,7 @@ XML_ParserCreate(const XML_Char *encodin
|
|
|
a5fbdf |
XML_Parser XMLCALL
|
|
|
a5fbdf |
XML_ParserCreateNS(const XML_Char *encodingName, XML_Char nsSep)
|
|
|
a5fbdf |
{
|
|
|
a5fbdf |
- XML_Char tmp[2];
|
|
|
a5fbdf |
- *tmp = nsSep;
|
|
|
a5fbdf |
+ XML_Char tmp[2] = {nsSep, 0};
|
|
|
a5fbdf |
return XML_ParserCreate_MM(encodingName, NULL, tmp);
|
|
|
a5fbdf |
}
|
|
|
a5fbdf |
#endif
|
|
|
a5fbdf |
@@ -1276,8 +1275,7 @@ XML_ExternalEntityParserCreate(XML_Parse
|
|
|
a5fbdf |
would be otherwise.
|
|
|
a5fbdf |
*/
|
|
|
a5fbdf |
if (ns) {
|
|
|
a5fbdf |
- XML_Char tmp[2];
|
|
|
a5fbdf |
- *tmp = namespaceSeparator;
|
|
|
a5fbdf |
+ XML_Char tmp[2] = {parser->m_namespaceSeparator, 0};
|
|
|
a5fbdf |
parser = parserCreate(encodingName, &parser->m_mem, tmp, newDtd);
|
|
|
a5fbdf |
}
|
|
|
a5fbdf |
else {
|
|
|
a5fbdf |
@@ -3667,6 +3665,16 @@ addBinding(XML_Parser parser, PREFIX *pr
|
|
|
a5fbdf |
if (!mustBeXML && isXMLNS
|
|
|
a5fbdf |
&& (len > xmlnsLen || uri[len] != xmlnsNamespace[len]))
|
|
|
a5fbdf |
isXMLNS = XML_FALSE;
|
|
|
a5fbdf |
+ // NOTE: While Expat does not validate namespace URIs against RFC 3986,
|
|
|
a5fbdf |
+ // we have to at least make sure that the XML processor on top of
|
|
|
a5fbdf |
+ // Expat (that is splitting tag names by namespace separator into
|
|
|
a5fbdf |
+ // 2- or 3-tuples (uri-local or uri-local-prefix)) cannot be confused
|
|
|
a5fbdf |
+ // by an attacker putting additional namespace separator characters
|
|
|
a5fbdf |
+ // into namespace declarations. That would be ambiguous and not to
|
|
|
a5fbdf |
+ // be expected.
|
|
|
a5fbdf |
+ if (parser->m_ns && (uri[len] == parser->m_namespaceSeparator)) {
|
|
|
a5fbdf |
+ return XML_ERROR_SYNTAX;
|
|
|
a5fbdf |
+ }
|
|
|
a5fbdf |
}
|
|
|
a5fbdf |
isXML = isXML && len == xmlLen;
|
|
|
a5fbdf |
isXMLNS = isXMLNS && len == xmlnsLen;
|