ee6bb0cc76
* gnu/packages/patches/libxml2-CVE-2015-1819.patch, gnu/packages/patches/libxml2-CVE-2015-7941-pt1.patch, gnu/packages/patches/libxml2-CVE-2015-7941-pt2.patch, gnu/packages/patches/libxml2-CVE-2015-7942-pt1.patch, gnu/packages/patches/libxml2-CVE-2015-7942-pt2.patch, gnu/packages/patches/libxml2-CVE-2015-8035.patch, gnu/packages/patches/libxml2-bug-737840.patch, gnu/packages/patches/libxml2-bug-738805.patch, gnu/packages/patches/libxml2-bug-746048.patch, gnu/packages/patches/libxml2-bug-747437.patch, gnu/packages/patches/libxml2-bug-751603.patch, gnu/packages/patches/libxml2-bug-751631.patch, gnu/packages/patches/libxml2-bug-754946.patch, gnu/packages/patches/libxml2-bug-754947.patch, gnu/packages/patches/libxml2-bug-755857.patch, gnu/packages/patches/libxml2-fix-catalog-corruption.patch, gnu/packages/patches/libxml2-id-attrs-in-xmlSetTreeDoc.patch, gnu/packages/patches/libxml2-node-sort-order-pt1.patch, gnu/packages/patches/libxml2-node-sort-order-pt2.patch: New files. * gnu-system.am (dist_patch_DATA): Add them. * gnu/packages/xml.scm (libxml2)[source]: Add patches.
66 lines
1.7 KiB
Diff
66 lines
1.7 KiB
Diff
From e724879d964d774df9b7969fc846605aa1bac54c Mon Sep 17 00:00:00 2001
|
|
From: Daniel Veillard <veillard@redhat.com>
|
|
Date: Fri, 30 Oct 2015 21:14:55 +0800
|
|
Subject: [PATCH] Fix parsing short unclosed comment uninitialized access
|
|
|
|
For https://bugzilla.gnome.org/show_bug.cgi?id=746048
|
|
The HTML parser was too optimistic when processing comments and
|
|
didn't check for the end of the stream on the first 2 characters
|
|
---
|
|
HTMLparser.c | 21 ++++++++++++++-------
|
|
1 file changed, 14 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/HTMLparser.c b/HTMLparser.c
|
|
index 19c10c3..bdf7807 100644
|
|
--- a/HTMLparser.c
|
|
+++ b/HTMLparser.c
|
|
@@ -3264,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
|
|
ctxt->instate = state;
|
|
return;
|
|
}
|
|
+ len = 0;
|
|
+ buf[len] = 0;
|
|
q = CUR_CHAR(ql);
|
|
+ if (!IS_CHAR(q))
|
|
+ goto unfinished;
|
|
NEXTL(ql);
|
|
r = CUR_CHAR(rl);
|
|
+ if (!IS_CHAR(r))
|
|
+ goto unfinished;
|
|
NEXTL(rl);
|
|
cur = CUR_CHAR(l);
|
|
- len = 0;
|
|
while (IS_CHAR(cur) &&
|
|
((cur != '>') ||
|
|
(r != '-') || (q != '-'))) {
|
|
@@ -3300,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
|
|
}
|
|
}
|
|
buf[len] = 0;
|
|
- if (!IS_CHAR(cur)) {
|
|
- htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
|
|
- "Comment not terminated \n<!--%.50s\n", buf, NULL);
|
|
- xmlFree(buf);
|
|
- } else {
|
|
+ if (IS_CHAR(cur)) {
|
|
NEXT;
|
|
if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
|
|
(!ctxt->disableSAX))
|
|
ctxt->sax->comment(ctxt->userData, buf);
|
|
xmlFree(buf);
|
|
+ ctxt->instate = state;
|
|
+ return;
|
|
}
|
|
- ctxt->instate = state;
|
|
+
|
|
+unfinished:
|
|
+ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
|
|
+ "Comment not terminated \n<!--%.50s\n", buf, NULL);
|
|
+ xmlFree(buf);
|
|
}
|
|
|
|
/**
|
|
--
|
|
2.6.3
|
|
|