|
 |
267d54 |
From d9825f106532a898bb6df46effa0bf099ec16a47 Mon Sep 17 00:00:00 2001
|
|
|
267d54 |
From: Daniel Veillard <veillard@redhat.com>
|
|
|
267d54 |
Date: Fri, 20 Nov 2015 16:06:59 +0800
|
|
|
267d54 |
Subject: [PATCH] CVE-2015-7500 Fix memory access error due to incorrect
|
|
|
267d54 |
entities boundaries
|
|
|
267d54 |
To: libvir-list@redhat.com
|
|
|
267d54 |
|
|
|
267d54 |
For https://bugzilla.gnome.org/show_bug.cgi?id=756525
|
|
|
267d54 |
handle properly the case where we popped out of the current entity
|
|
|
267d54 |
while processing a start tag
|
|
|
267d54 |
Reported by Kostya Serebryany @ Google
|
|
|
267d54 |
|
|
|
267d54 |
Signed-off-by: Daniel Veillard <veillard@redhat.com>
|
|
|
267d54 |
---
|
|
|
267d54 |
parser.c | 28 ++++++++++++++++++++++------
|
|
|
267d54 |
1 file changed, 22 insertions(+), 6 deletions(-)
|
|
|
267d54 |
|
|
|
267d54 |
diff --git a/parser.c b/parser.c
|
|
|
267d54 |
index cc45e17..f4fc310 100644
|
|
|
267d54 |
--- a/parser.c
|
|
|
267d54 |
+++ b/parser.c
|
|
|
267d54 |
@@ -9309,7 +9309,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
|
|
|
267d54 |
const xmlChar **atts = ctxt->atts;
|
|
|
267d54 |
int maxatts = ctxt->maxatts;
|
|
|
267d54 |
int nratts, nbatts, nbdef;
|
|
|
267d54 |
- int i, j, nbNs, attval, oldline, oldcol;
|
|
|
267d54 |
+ int i, j, nbNs, attval, oldline, oldcol, inputNr;
|
|
|
267d54 |
const xmlChar *base;
|
|
|
267d54 |
unsigned long cur;
|
|
|
267d54 |
int nsNr = ctxt->nsNr;
|
|
|
267d54 |
@@ -9328,6 +9328,7 @@ reparse:
|
|
|
267d54 |
SHRINK;
|
|
|
267d54 |
base = ctxt->input->base;
|
|
|
267d54 |
cur = ctxt->input->cur - ctxt->input->base;
|
|
|
267d54 |
+ inputNr = ctxt->inputNr;
|
|
|
267d54 |
oldline = ctxt->input->line;
|
|
|
267d54 |
oldcol = ctxt->input->col;
|
|
|
267d54 |
nbatts = 0;
|
|
|
267d54 |
@@ -9353,7 +9354,8 @@ reparse:
|
|
|
267d54 |
*/
|
|
|
267d54 |
SKIP_BLANKS;
|
|
|
267d54 |
GROW;
|
|
|
267d54 |
- if (ctxt->input->base != base) goto base_changed;
|
|
|
267d54 |
+ if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
|
|
|
267d54 |
+ goto base_changed;
|
|
|
267d54 |
|
|
|
267d54 |
while (((RAW != '>') &&
|
|
|
267d54 |
((RAW != '/') || (NXT(1) != '>')) &&
|
|
|
267d54 |
@@ -9364,7 +9366,7 @@ reparse:
|
|
|
267d54 |
|
|
|
267d54 |
attname = xmlParseAttribute2(ctxt, prefix, localname,
|
|
|
267d54 |
&aprefix, &attvalue, &len, &alloc);
|
|
|
267d54 |
- if (ctxt->input->base != base) {
|
|
|
267d54 |
+ if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
|
|
|
267d54 |
if ((attvalue != NULL) && (alloc != 0))
|
|
|
267d54 |
xmlFree(attvalue);
|
|
|
267d54 |
attvalue = NULL;
|
|
|
267d54 |
@@ -9493,7 +9495,8 @@ skip_default_ns:
|
|
|
267d54 |
skip_ns:
|
|
|
267d54 |
if (alloc != 0) xmlFree(attvalue);
|
|
|
267d54 |
SKIP_BLANKS;
|
|
|
267d54 |
- if (ctxt->input->base != base) goto base_changed;
|
|
|
267d54 |
+ if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
|
|
|
267d54 |
+ goto base_changed;
|
|
|
267d54 |
continue;
|
|
|
267d54 |
}
|
|
|
267d54 |
|
|
|
267d54 |
@@ -9530,7 +9533,8 @@ failed:
|
|
|
267d54 |
GROW
|
|
|
267d54 |
if (ctxt->instate == XML_PARSER_EOF)
|
|
|
267d54 |
break;
|
|
|
267d54 |
- if (ctxt->input->base != base) goto base_changed;
|
|
|
267d54 |
+ if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
|
|
|
267d54 |
+ goto base_changed;
|
|
|
267d54 |
if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
|
|
|
267d54 |
break;
|
|
|
267d54 |
if (!IS_BLANK_CH(RAW)) {
|
|
|
267d54 |
@@ -9546,7 +9550,8 @@ failed:
|
|
|
267d54 |
break;
|
|
|
267d54 |
}
|
|
|
267d54 |
GROW;
|
|
|
267d54 |
- if (ctxt->input->base != base) goto base_changed;
|
|
|
267d54 |
+ if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
|
|
|
267d54 |
+ goto base_changed;
|
|
|
267d54 |
}
|
|
|
267d54 |
|
|
|
267d54 |
/*
|
|
|
267d54 |
@@ -9713,6 +9718,17 @@ base_changed:
|
|
|
267d54 |
if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
|
|
|
267d54 |
xmlFree((xmlChar *) atts[i]);
|
|
|
267d54 |
}
|
|
|
267d54 |
+
|
|
|
267d54 |
+ /*
|
|
|
267d54 |
+ * We can't switch from one entity to another in the middle
|
|
|
267d54 |
+ * of a start tag
|
|
|
267d54 |
+ */
|
|
|
267d54 |
+ if (inputNr != ctxt->inputNr) {
|
|
|
267d54 |
+ xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
|
|
|
267d54 |
+ "Start tag doesn't start and stop in the same entity\n");
|
|
|
267d54 |
+ return(NULL);
|
|
|
267d54 |
+ }
|
|
|
267d54 |
+
|
|
|
267d54 |
ctxt->input->cur = ctxt->input->base + cur;
|
|
|
267d54 |
ctxt->input->line = oldline;
|
|
|
267d54 |
ctxt->input->col = oldcol;
|
|
|
267d54 |
--
|
|
|
267d54 |
2.5.0
|
|
|
267d54 |
|