cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix two integer overflows. CVE-2008-4225, CVE-2008-4226.

Browse Source 
ok ajacoutot@, simon@
This commit is contained in:
naddy 2008-11-23 18:49:42 +00:00
parent dd04d47f4c
commit ec4d137d7a
3 changed files with 68 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
textproc/libxml/Makefile
View File

@ -1,11 +1,11 @@
# $OpenBSD: Makefile,v 1.116 2008/07/25 20:25:59 sthen Exp $
# $OpenBSD: Makefile,v 1.117 2008/11/23 18:49:42 naddy Exp $
COMMENT-main= XML parsing library
COMMENT-python= Python bindings for libxml
VERSION= 2.6.32
DISTNAME= libxml2-${VERSION}
PKGNAME-main= libxml-${VERSION}p1
PKGNAME-main= libxml-${VERSION}p2
PKGNAME-python= py-libxml-${VERSION}
SHARED_LIBS= xml2 10.0
CATEGORIES= textproc

39
textproc/libxml/patches/patch-SAX2_c Normal file
View File

@ -0,0 +1,39 @@
$OpenBSD: patch-SAX2_c,v 1.1 2008/11/23 18:49:42 naddy Exp $
--- SAX2.c.orig Fri Jan 25 14:10:04 2008
+++ SAX2.c Sun Nov 23 18:24:46 2008
@@ -11,6 +11,7 @@
#include "libxml.h"
#include <stdlib.h>
#include <string.h>
+#include <limits.h>
#include <libxml/xmlmemory.h>
#include <libxml/tree.h>
#include <libxml/parser.h>
@@ -26,6 +27,11 @@
#include <libxml/HTMLtree.h>
#include <libxml/globals.h>
+/* Define SIZE_T_MAX unless defined through <limits.h>. */
+#ifndef SIZE_T_MAX
+# define SIZE_T_MAX ((size_t)-1)
+#endif /* !SIZE_T_MAX */
+
/* #define DEBUG_SAX2 */
/* #define DEBUG_SAX2_TREE */
@@ -2445,9 +2451,14 @@ xmlSAX2Characters(void *ctx, const xmlChar *ch, int le
(xmlDictOwns(ctxt->dict, lastChild->content))) {
lastChild->content = xmlStrdup(lastChild->content);
}
+ if ((size_t)ctxt->nodelen > SIZE_T_MAX - (size_t)len ||
+ (size_t)ctxt->nodemem + (size_t)len > SIZE_T_MAX / 2) {
+ xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
+ return;
+ }
if (ctxt->nodelen + len >= ctxt->nodemem) {
xmlChar *newbuf;
- int size;
+ size_t size;
size = ctxt->nodemem + len;
size *= 2;

27
textproc/libxml/patches/patch-tree_c Normal file
View File

@ -0,0 +1,27 @@
$OpenBSD: patch-tree_c,v 1.1 2008/11/23 18:49:42 naddy Exp $
--- tree.c.orig Tue Apr 8 15:54:48 2008
+++ tree.c Sun Nov 23 18:28:13 2008
@@ -14,7 +14,7 @@
#include "libxml.h"
#include <string.h> /* for memset() only ! */
-
+#include <limits.h>
#ifdef HAVE_CTYPE_H
#include <ctype.h>
#endif
@@ -6916,7 +6916,13 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
case XML_BUFFER_ALLOC_DOUBLEIT:
/*take care of empty case*/
newSize = (buf->size ? buf->size*2 : size + 10);
- while (size > newSize) newSize *= 2;
+ while (size > newSize) {
+ if (newSize > UINT_MAX / 2) {
+ xmlTreeErrMemory("growing buffer");
+ return 0;
+ }
+ newSize *= 2;
+ }
break;
case XML_BUFFER_ALLOC_EXACT:
newSize = size+10;