cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFH: r417847

Browse Source 
textproc/expat2: Patch vulnerability

This patch resolves a vulnerability that may still exist due to
compiler optimizations. The previous patches for CVE-2015-1283 and
CVE-2015-2716 may not work as intended in some situations.

Security:	CVE-2016-4472

Approved by:	ports-secteam (with hat)
This commit is contained in:
Mark Felder 2016-06-30 22:36:53 +00:00
parent f5c962a210
commit 859c6d655b
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/branches/2016Q2/; revision=417848
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
textproc/expat2/Makefile
View File

@ -3,7 +3,7 @@
PORTNAME= expat
PORTVERSION= 2.1.1
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES= textproc
MASTER_SITES= SF

26
textproc/expat2/files/patch-CVE-2016-4472 Normal file
View File

@ -0,0 +1,26 @@
expat/CMakeLists.txt | 3 +++
expat/lib/xmlparse.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
2 files changed, 44 insertions(+), 7 deletions(-)
--- lib/xmlparse.c.orig 2016-06-30 22:23:11 UTC
+++ lib/xmlparse.c
@@ -1693,7 +1693,8 @@ XML_GetBuffer(XML_Parser parser, int len
}
if (len > bufferLim - bufferEnd) {
- int neededSize = len + (int)(bufferEnd - bufferPtr);
+ /* Do not invoke signed arithmetic overflow: */
+ int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
if (neededSize < 0) {
errorCode = XML_ERROR_NO_MEMORY;
return NULL;
@@ -1725,7 +1726,8 @@ XML_GetBuffer(XML_Parser parser, int len
if (bufferSize == 0)
bufferSize = INIT_BUFFER_SIZE;
do {
- bufferSize *= 2;
+ /* Do not invoke signed arithmetic overflow: */
+ bufferSize = (int) (2U * (unsigned) bufferSize);
} while (bufferSize < neededSize && bufferSize > 0);
if (bufferSize <= 0) {
errorCode = XML_ERROR_NO_MEMORY;