← Back to branch summary

~ubuntu-branches/ubuntu/wily/libxml2/wily

« back to all changes in this revision

Viewing changes to debian/patches/0010-CVE-2015-1819-Enforce-the-reader-to-run-in-constant-.patch

  • Committer: Package Import Robot
  • Author(s): Aron Xu
  • Date: 2015-09-22 16:31:48 UTC
  • mfrom: (43.2.12 sid)
  • Revision ID: package-import@ubuntu.com-20150922163148-di6xmyfvb20jmtq2
Tags: 2.9.2+zdfsg1-4
http://bugs.debian.org/754424
http://bugs.debian.org/781232
http://bugs.debian.org/798642
http://bugs.debian.org/768089
http://bugs.debian.org/766884
http://bugs.debian.org/782782
http://bugs.debian.org/783010
* Revert everything in N'ACKed NMU revert to 2.9.1.
  - Resolving regression, Closes: #754424
  - Drop the following NMU, not needed in 2.9.2, Closes: #781232
  - Drop not approved patch for GNOME #746048
* Revert icu dbg drop, but don't hardcode version,
  thanks Matthias Klose <doko>, Closes: #798642
* Cherry pick upstream post release patches:
  - Fix for regression triggered by CVE-2014-3660, Closes: #768089
  - Fix for the spurious ID already defined error, Closes: #766884
  - Fix for CVE-2015-1819, Closes: #782782
  - Fix for GNOME #744980, Closes: #783010
  - Several fixes for memory related issues.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/0010-CVE-2015-1819-Enforce-the-reader-to-run-in-constant-.patch
 
1
From: Daniel Veillard <veillard@redhat.com>
 
2
Date: Tue, 14 Apr 2015 17:41:48 +0800
 
3
Subject: CVE-2015-1819 Enforce the reader to run in constant memory
 
4
 
 
5
One of the operation on the reader could resolve entities
 
6
leading to the classic expansion issue. Make sure the
 
7
buffer used for xmlreader operation is bounded.
 
8
Introduce a new allocation type for the buffers for this effect.
 
9
---
 
10
 buf.c                 | 43 ++++++++++++++++++++++++++++++++++++++++++-
 
11
 include/libxml/tree.h |  3 ++-
 
12
 xmlreader.c           | 20 +++++++++++++++++++-
 
13
 3 files changed, 63 insertions(+), 3 deletions(-)
 
14
 
 
15
diff --git a/buf.c b/buf.c
 
16
index 6efc7b6..07922ff 100644
 
17
--- a/buf.c
 
18
+++ b/buf.c
 
19
@@ -27,6 +27,7 @@
 
20
 #include <libxml/tree.h>
 
21
 #include <libxml/globals.h>
 
22
 #include <libxml/tree.h>
 
23
+#include <libxml/parserInternals.h> /* for XML_MAX_TEXT_LENGTH */
 
24
 #include "buf.h"
 
25
 
 
26
 #define WITH_BUFFER_COMPAT
 
27
@@ -299,7 +300,8 @@ xmlBufSetAllocationScheme(xmlBufPtr buf,
 
28
     if ((scheme == XML_BUFFER_ALLOC_DOUBLEIT) ||
 
29
         (scheme == XML_BUFFER_ALLOC_EXACT) ||
 
30
         (scheme == XML_BUFFER_ALLOC_HYBRID) ||
 
31
-        (scheme == XML_BUFFER_ALLOC_IMMUTABLE)) {
 
32
+        (scheme == XML_BUFFER_ALLOC_IMMUTABLE) ||
 
33
+       (scheme == XML_BUFFER_ALLOC_BOUNDED)) {
 
34
        buf->alloc = scheme;
 
35
         if (buf->buffer)
 
36
             buf->buffer->alloc = scheme;
 
37
@@ -458,6 +460,18 @@ xmlBufGrowInternal(xmlBufPtr buf, size_t len) {
 
38
     size = buf->use + len + 100;
 
39
 #endif
 
40
 
 
41
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
 
42
+        /*
 
43
+        * Used to provide parsing limits
 
44
+        */
 
45
+        if ((buf->use + len >= XML_MAX_TEXT_LENGTH) ||
 
46
+           (buf->size >= XML_MAX_TEXT_LENGTH)) {
 
47
+           xmlBufMemoryError(buf, "buffer error: text too long\n");
 
48
+           return(0);
 
49
+       }
 
50
+       if (size >= XML_MAX_TEXT_LENGTH)
 
51
+           size = XML_MAX_TEXT_LENGTH;
 
52
+    }
 
53
     if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) {
 
54
         size_t start_buf = buf->content - buf->contentIO;
 
55
 
 
56
@@ -739,6 +753,15 @@ xmlBufResize(xmlBufPtr buf, size_t size)
 
57
     CHECK_COMPAT(buf)
 
58
 
 
59
     if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0);
 
60
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
 
61
+        /*
 
62
+        * Used to provide parsing limits
 
63
+        */
 
64
+        if (size >= XML_MAX_TEXT_LENGTH) {
 
65
+           xmlBufMemoryError(buf, "buffer error: text too long\n");
 
66
+           return(0);
 
67
+       }
 
68
+    }
 
69
 
 
70
     /* Don't resize if we don't have to */
 
71
     if (size < buf->size)
 
72
@@ -867,6 +890,15 @@ xmlBufAdd(xmlBufPtr buf, const xmlChar *str, int len) {
 
73
 
 
74
     needSize = buf->use + len + 2;
 
75
     if (needSize > buf->size){
 
76
+       if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
 
77
+           /*
 
78
+            * Used to provide parsing limits
 
79
+            */
 
80
+           if (needSize >= XML_MAX_TEXT_LENGTH) {
 
81
+               xmlBufMemoryError(buf, "buffer error: text too long\n");
 
82
+               return(-1);
 
83
+           }
 
84
+       }
 
85
         if (!xmlBufResize(buf, needSize)){
 
86
            xmlBufMemoryError(buf, "growing buffer");
 
87
             return XML_ERR_NO_MEMORY;
 
88
@@ -938,6 +970,15 @@ xmlBufAddHead(xmlBufPtr buf, const xmlChar *str, int len) {
 
89
     }
 
90
     needSize = buf->use + len + 2;
 
91
     if (needSize > buf->size){
 
92
+       if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
 
93
+           /*
 
94
+            * Used to provide parsing limits
 
95
+            */
 
96
+           if (needSize >= XML_MAX_TEXT_LENGTH) {
 
97
+               xmlBufMemoryError(buf, "buffer error: text too long\n");
 
98
+               return(-1);
 
99
+           }
 
100
+       }
 
101
         if (!xmlBufResize(buf, needSize)){
 
102
            xmlBufMemoryError(buf, "growing buffer");
 
103
             return XML_ERR_NO_MEMORY;
 
104
diff --git a/include/libxml/tree.h b/include/libxml/tree.h
 
105
index 2f90717..4a9b3bc 100644
 
106
--- a/include/libxml/tree.h
 
107
+++ b/include/libxml/tree.h
 
108
@@ -76,7 +76,8 @@ typedef enum {
 
109
     XML_BUFFER_ALLOC_EXACT,    /* grow only to the minimal size */
 
110
     XML_BUFFER_ALLOC_IMMUTABLE, /* immutable buffer */
 
111
     XML_BUFFER_ALLOC_IO,       /* special allocation scheme used for I/O */
 
112
-    XML_BUFFER_ALLOC_HYBRID    /* exact up to a threshold, and doubleit thereafter */
 
113
+    XML_BUFFER_ALLOC_HYBRID,   /* exact up to a threshold, and doubleit thereafter */
 
114
+    XML_BUFFER_ALLOC_BOUNDED   /* limit the upper size of the buffer */
 
115
 } xmlBufferAllocationScheme;
 
116
 
 
117
 /**
 
118
diff --git a/xmlreader.c b/xmlreader.c
 
119
index f19e123..471e7e2 100644
 
120
--- a/xmlreader.c
 
121
+++ b/xmlreader.c
 
122
@@ -2091,6 +2091,9 @@ xmlNewTextReader(xmlParserInputBufferPtr input, const char *URI) {
 
123
                "xmlNewTextReader : malloc failed\n");
 
124
        return(NULL);
 
125
     }
 
126
+    /* no operation on a reader should require a huge buffer */
 
127
+    xmlBufSetAllocationScheme(ret->buffer,
 
128
+                             XML_BUFFER_ALLOC_BOUNDED);
 
129
     ret->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));
 
130
     if (ret->sax == NULL) {
 
131
        xmlBufFree(ret->buffer);
 
132
@@ -3616,6 +3619,7 @@ xmlTextReaderConstValue(xmlTextReaderPtr reader) {
 
133
            return(((xmlNsPtr) node)->href);
 
134
         case XML_ATTRIBUTE_NODE:{
 
135
            xmlAttrPtr attr = (xmlAttrPtr) node;
 
136
+           const xmlChar *ret;
 
137
 
 
138
            if ((attr->children != NULL) &&
 
139
                (attr->children->type == XML_TEXT_NODE) &&
 
140
@@ -3629,10 +3633,21 @@ xmlTextReaderConstValue(xmlTextReaderPtr reader) {
 
141
                                         "xmlTextReaderSetup : malloc failed\n");
 
142
                         return (NULL);
 
143
                     }
 
144
+                   xmlBufSetAllocationScheme(reader->buffer,
 
145
+                                             XML_BUFFER_ALLOC_BOUNDED);
 
146
                 } else
 
147
                     xmlBufEmpty(reader->buffer);
 
148
                xmlBufGetNodeContent(reader->buffer, node);
 
149
-               return(xmlBufContent(reader->buffer));
 
150
+               ret = xmlBufContent(reader->buffer);
 
151
+               if (ret == NULL) {
 
152
+                   /* error on the buffer best to reallocate */
 
153
+                   xmlBufFree(reader->buffer);
 
154
+                   reader->buffer = xmlBufCreateSize(100);
 
155
+                   xmlBufSetAllocationScheme(reader->buffer,
 
156
+                                             XML_BUFFER_ALLOC_BOUNDED);
 
157
+                   ret = BAD_CAST "";
 
158
+               }
 
159
+               return(ret);
 
160
            }
 
161
            break;
 
162
        }
 
163
@@ -5131,6 +5146,9 @@ xmlTextReaderSetup(xmlTextReaderPtr reader,
 
164
                         "xmlTextReaderSetup : malloc failed\n");
 
165
         return (-1);
 
166
     }
 
167
+    /* no operation on a reader should require a huge buffer */
 
168
+    xmlBufSetAllocationScheme(reader->buffer,
 
169
+                             XML_BUFFER_ALLOC_BOUNDED);
 
170
     if (reader->sax == NULL)
 
171
        reader->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));
 
172
     if (reader->sax == NULL) {