|
 |
35fd7a |
From ce6eddc1a167dafaac17c7bad9fa6b013fada31b Mon Sep 17 00:00:00 2001
|
|
|
35fd7a |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
35fd7a |
Date: Fri, 25 Feb 2022 13:07:07 -0500
|
|
|
35fd7a |
Subject: [PATCH 5/6] lib: Prevent more integer overflows (CVE-2022-22822 to
|
|
|
35fd7a |
CVE-2022-22827)
|
|
|
35fd7a |
|
|
|
35fd7a |
Backport fixes from https://github.com/libexpat/libexpat/pull/539
|
|
|
35fd7a |
|
|
|
35fd7a |
Resolves: #2058567, #2058576, #2058282, #2058589, #2058595, #2058602
|
|
|
35fd7a |
---
|
|
|
35fd7a |
lib/expat/xmlparse/xmlparse.c | 40 +++++++++++++++++++++++++++++++++++
|
|
|
35fd7a |
1 file changed, 40 insertions(+)
|
|
|
35fd7a |
|
|
|
35fd7a |
diff --git a/lib/expat/xmlparse/xmlparse.c b/lib/expat/xmlparse/xmlparse.c
|
|
|
35fd7a |
index 48adfb3..16ab82a 100644
|
|
|
35fd7a |
--- a/lib/expat/xmlparse/xmlparse.c
|
|
|
35fd7a |
+++ b/lib/expat/xmlparse/xmlparse.c
|
|
|
35fd7a |
@@ -19,6 +19,7 @@ See the file copying.txt for copying permission.
|
|
|
35fd7a |
#include <assert.h>
|
|
|
35fd7a |
#include <limits.h> /* UINT_MAX */
|
|
|
35fd7a |
#include <time.h> /* time() */
|
|
|
35fd7a |
+#include <stdint.h>
|
|
|
35fd7a |
|
|
|
35fd7a |
#include "xmlrpc_config.h"
|
|
|
35fd7a |
#include "c_util.h"
|
|
|
35fd7a |
@@ -1076,6 +1077,9 @@ int addBinding(XML_Parser parser,
|
|
|
35fd7a |
;
|
|
|
35fd7a |
if (namespaceSeparator)
|
|
|
35fd7a |
len++;
|
|
|
35fd7a |
+ if (namespaceSeparator && (uri[len] == namespaceSeparator)) {
|
|
|
35fd7a |
+ return XML_ERROR_SYNTAX;
|
|
|
35fd7a |
+ }
|
|
|
35fd7a |
if (freeBindingList) {
|
|
|
35fd7a |
b = freeBindingList;
|
|
|
35fd7a |
if (len > b->uriAlloc) {
|
|
|
35fd7a |
@@ -2116,10 +2120,32 @@ storeAtts(XML_Parser const xmlParserP,
|
|
|
35fd7a |
}
|
|
|
35fd7a |
/* get the attributes from the tokenizer */
|
|
|
35fd7a |
n = XmlGetAttributes(enc, attStr, attsSize, atts);
|
|
|
35fd7a |
+
|
|
|
35fd7a |
+
|
|
|
35fd7a |
+ /* Detect and prevent integer overflow */
|
|
|
35fd7a |
+ if (n > INT_MAX - nDefaultAtts) {
|
|
|
35fd7a |
+ return XML_ERROR_NO_MEMORY;
|
|
|
35fd7a |
+ }
|
|
|
35fd7a |
+
|
|
|
35fd7a |
if (n + nDefaultAtts > attsSize) {
|
|
|
35fd7a |
int oldAttsSize = attsSize;
|
|
|
35fd7a |
ATTRIBUTE *temp;
|
|
|
35fd7a |
+ /* Detect and prevent integer overflow */
|
|
|
35fd7a |
+ if ((nDefaultAtts > INT_MAX - INIT_ATTS_SIZE)
|
|
|
35fd7a |
+ || (n > INT_MAX - (nDefaultAtts + INIT_ATTS_SIZE))) {
|
|
|
35fd7a |
+ return XML_ERROR_NO_MEMORY;
|
|
|
35fd7a |
+ }
|
|
|
35fd7a |
attsSize = n + nDefaultAtts + INIT_ATTS_SIZE;
|
|
|
35fd7a |
+ /* Detect and prevent integer overflow.
|
|
|
35fd7a |
+ * The preprocessor guard addresses the "always false" warning
|
|
|
35fd7a |
+ * from -Wtype-limits on platforms where
|
|
|
35fd7a |
+ * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
|
|
|
35fd7a |
+#if UINT_MAX >= SIZE_MAX
|
|
|
35fd7a |
+ if ((unsigned)parser->m_attsSize > (size_t)(-1) / sizeof(ATTRIBUTE)) {
|
|
|
35fd7a |
+ attsSize = oldAttsSize;
|
|
|
35fd7a |
+ return XML_ERROR_NO_MEMORY;
|
|
|
35fd7a |
+ }
|
|
|
35fd7a |
+#endif
|
|
|
35fd7a |
temp = realloc((void *)atts, attsSize * sizeof(ATTRIBUTE));
|
|
|
35fd7a |
if (!temp)
|
|
|
35fd7a |
return XML_ERROR_NO_MEMORY;
|
|
|
35fd7a |
@@ -2297,6 +2323,20 @@ storeAtts(XML_Parser const xmlParserP,
|
|
|
35fd7a |
n = i + binding->uriLen;
|
|
|
35fd7a |
if (n > binding->uriAlloc) {
|
|
|
35fd7a |
TAG *p;
|
|
|
35fd7a |
+
|
|
|
35fd7a |
+ /* Detect and prevent integer overflow */
|
|
|
35fd7a |
+ if (n > INT_MAX - EXPAND_SPARE) {
|
|
|
35fd7a |
+ return XML_ERROR_NO_MEMORY;
|
|
|
35fd7a |
+ }
|
|
|
35fd7a |
+ /* Detect and prevent integer overflow.
|
|
|
35fd7a |
+ * The preprocessor guard addresses the "always false" warning
|
|
|
35fd7a |
+ * from -Wtype-limits on platforms where
|
|
|
35fd7a |
+ * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
|
|
|
35fd7a |
+#if UINT_MAX >= SIZE_MAX
|
|
|
35fd7a |
+ if ((unsigned)(n + EXPAND_SPARE) > (size_t)(-1) / sizeof(XML_Char)) {
|
|
|
35fd7a |
+ return XML_ERROR_NO_MEMORY;
|
|
|
35fd7a |
+ }
|
|
|
35fd7a |
+#endif
|
|
|
35fd7a |
XML_Char *uri = malloc((n + EXPAND_SPARE) * sizeof(XML_Char));
|
|
|
35fd7a |
if (!uri)
|
|
|
35fd7a |
return XML_ERROR_NO_MEMORY;
|
|
|
35fd7a |
--
|
|
|
35fd7a |
2.31.1
|
|
|
35fd7a |
|