f1ca092d73
https://secunia.com/advisories/53061/ https://bugzilla.gnome.org/show_bug.cgi?id=690202 ok ajacoutot@
57 lines
1.8 KiB
Plaintext
57 lines
1.8 KiB
Plaintext
$OpenBSD: patch-parser_c,v 1.7 2013/04/17 13:55:42 sthen Exp $
|
|
|
|
From de0cc20c29cb3f056062925395e0f68d2250a46f Mon Sep 17 00:00:00 2001
|
|
From: Daniel Veillard <veillard@redhat.com>
|
|
Date: Tue, 12 Feb 2013 08:55:34 +0000
|
|
Subject: Fix some buffer conversion issues
|
|
|
|
https://bugzilla.gnome.org/show_bug.cgi?id=690202
|
|
|
|
Buffer overflow errors originating from xmlBufGetInputBase in 2.9.0
|
|
The pointers from the context input were not properly reset after
|
|
that call which can do reallocations.
|
|
|
|
--- parser.c.orig Tue Sep 11 05:24:08 2012
|
|
+++ parser.c Wed Apr 17 14:33:44 2013
|
|
@@ -12125,7 +12125,7 @@ xmldecl_done:
|
|
remain = 0;
|
|
}
|
|
}
|
|
- res =xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
|
|
+ res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
|
|
if (res < 0) {
|
|
ctxt->errNo = XML_PARSER_EOF;
|
|
ctxt->disableSAX = 1;
|
|
@@ -12142,6 +12142,8 @@ xmldecl_done:
|
|
if ((in->encoder != NULL) && (in->buffer != NULL) &&
|
|
(in->raw != NULL)) {
|
|
int nbchars;
|
|
+ size_t base = xmlBufGetInputBase(in->buffer, ctxt->input);
|
|
+ size_t current = ctxt->input->cur - ctxt->input->base;
|
|
|
|
nbchars = xmlCharEncInput(in);
|
|
if (nbchars < 0) {
|
|
@@ -12150,6 +12152,7 @@ xmldecl_done:
|
|
"xmlParseChunk: encoder error\n");
|
|
return(XML_ERR_INVALID_ENCODING);
|
|
}
|
|
+ xmlBufSetInputBaseCur(in->buffer, ctxt->input, base, current);
|
|
}
|
|
}
|
|
}
|
|
@@ -12189,7 +12192,14 @@ xmldecl_done:
|
|
}
|
|
if ((end_in_lf == 1) && (ctxt->input != NULL) &&
|
|
(ctxt->input->buf != NULL)) {
|
|
+ size_t base = xmlBufGetInputBase(ctxt->input->buf->buffer,
|
|
+ ctxt->input);
|
|
+ size_t current = ctxt->input->cur - ctxt->input->base;
|
|
+
|
|
xmlParserInputBufferPush(ctxt->input->buf, 1, "\r");
|
|
+
|
|
+ xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input,
|
|
+ base, current);
|
|
}
|
|
if (terminate) {
|
|
/*
|