|
 |
6dedca |
From ebf48b59943833b5f57e909e5d00f0d6e75e874e Mon Sep 17 00:00:00 2001
|
|
|
6dedca |
From: Hugh Davenport <hugh@allthethings.co.nz>
|
|
|
6dedca |
Date: Fri, 20 Nov 2015 17:16:06 +0800
|
|
|
6dedca |
Subject: [PATCH] CVE-2015-8242 Buffer overead with HTML parser in push mode
|
|
|
6dedca |
To: libvir-list@redhat.com
|
|
|
6dedca |
|
|
|
6dedca |
For https://bugzilla.gnome.org/show_bug.cgi?id=756372
|
|
|
6dedca |
Error in the code pointing to the codepoint in the stack for the
|
|
|
6dedca |
current char value instead of the pointer in the input that the SAX
|
|
|
6dedca |
callback expects
|
|
|
6dedca |
Reported and fixed by Hugh Davenport
|
|
|
6dedca |
|
|
|
6dedca |
Signed-off-by: Daniel Veillard <veillard@redhat.com>
|
|
|
6dedca |
---
|
|
|
6dedca |
HTMLparser.c | 6 +++---
|
|
|
6dedca |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
6dedca |
|
|
|
6dedca |
diff --git a/HTMLparser.c b/HTMLparser.c
|
|
|
6dedca |
index cab499a..4331d53 100644
|
|
|
6dedca |
--- a/HTMLparser.c
|
|
|
6dedca |
+++ b/HTMLparser.c
|
|
|
6dedca |
@@ -5708,17 +5708,17 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
|
|
|
6dedca |
if (ctxt->keepBlanks) {
|
|
|
6dedca |
if (ctxt->sax->characters != NULL)
|
|
|
6dedca |
ctxt->sax->characters(
|
|
|
6dedca |
- ctxt->userData, &cur, 1);
|
|
|
6dedca |
+ ctxt->userData, &in->cur[0], 1);
|
|
|
6dedca |
} else {
|
|
|
6dedca |
if (ctxt->sax->ignorableWhitespace != NULL)
|
|
|
6dedca |
ctxt->sax->ignorableWhitespace(
|
|
|
6dedca |
- ctxt->userData, &cur, 1);
|
|
|
6dedca |
+ ctxt->userData, &in->cur[0], 1);
|
|
|
6dedca |
}
|
|
|
6dedca |
} else {
|
|
|
6dedca |
htmlCheckParagraph(ctxt);
|
|
|
6dedca |
if (ctxt->sax->characters != NULL)
|
|
|
6dedca |
ctxt->sax->characters(
|
|
|
6dedca |
- ctxt->userData, &cur, 1);
|
|
|
6dedca |
+ ctxt->userData, &in->cur[0], 1);
|
|
|
6dedca |
}
|
|
|
6dedca |
}
|
|
|
6dedca |
ctxt->token = 0;
|
|
|
6dedca |
--
|
|
|
6dedca |
2.5.0
|
|
|
6dedca |
|