mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

expat: patch CVE-2024-50602

Browse Source 
Pick commits from https://github.com/libexpat/libexpat/pull/915

Not picking test is suboptimal, but test structure was changed meanwhile
so we'd have to invent new code.
Skipping tests was already done in previous expat/kirkstone CVE patches.

(From OE-Core rev: 2cf8325876aa4d43151f5a327a21834db37bf0cb)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2024-11-12 18:43:14 +01:00
committed by Steve Sakoman
parent 8fd6ef6cd6
commit 05e809ccb0
3 changed files with 96 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
meta/recipes-core/expat/expat/CVE-2024-50602-01.patch Normal file
View File

@@ -0,0 +1,56 @@
From 51c7019069b862e88d94ed228659e70bddd5de09 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 21 Oct 2024 01:42:54 +0200
Subject: [PATCH 1/2] lib: Make XML_StopParser refuse to stop/suspend an
unstarted parser
CVE: CVE-2024-50602
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/51c7019069b862e88d94ed228659e70bddd5de09]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
expat/lib/expat.h | 4 +++-
expat/lib/xmlparse.c | 6 ++++++
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/lib/expat.h b/lib/expat.h
index d0d6015a..3ba61304 100644
--- a/lib/expat.h
+++ b/lib/expat.h
@@ -127,7 +127,9 @@ enum XML_Error {
/* Added in 2.3.0. */
XML_ERROR_NO_BUFFER,
/* Added in 2.4.0. */
- XML_ERROR_AMPLIFICATION_LIMIT_BREACH
+ XML_ERROR_AMPLIFICATION_LIMIT_BREACH,
+ /* Added in 2.6.4. */
+ XML_ERROR_NOT_STARTED,
};
enum XML_Content_Type {
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index d9285b21..fa02537f 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -2189,6 +2189,9 @@ XML_StopParser(XML_Parser parser, XML_Bool resumable) {
if (parser == NULL)
return XML_STATUS_ERROR;
switch (parser->m_parsingStatus.parsing) {
+ case XML_INITIALIZED:
+ parser->m_errorCode = XML_ERROR_NOT_STARTED;
+ return XML_STATUS_ERROR;
case XML_SUSPENDED:
if (resumable) {
parser->m_errorCode = XML_ERROR_SUSPENDED;
@@ -2474,6 +2477,9 @@ XML_ErrorString(enum XML_Error code) {
case XML_ERROR_AMPLIFICATION_LIMIT_BREACH:
return XML_L(
"limit on input amplification factor (from DTD and entities) breached");
+ /* Added in 2.6.4. */
+ case XML_ERROR_NOT_STARTED:
+ return XML_L("parser not started");
}
return NULL;
}
--
2.30.2

38
meta/recipes-core/expat/expat/CVE-2024-50602-02.patch Normal file
View File

@@ -0,0 +1,38 @@
From 5fb89e7b3afa1c314b34834fe729cd063f65a4d4 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 21 Oct 2024 01:46:11 +0200
Subject: [PATCH 2/2] lib: Be explicit about XML_PARSING in XML_StopParser
CVE: CVE-2024-50602
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/5fb89e7b3afa1c314b34834fe729cd063f65a4d4]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
expat/lib/xmlparse.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index fa02537f..983f6df0 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -2202,7 +2202,7 @@ XML_StopParser(XML_Parser parser, XML_Bool resumable) {
case XML_FINISHED:
parser->m_errorCode = XML_ERROR_FINISHED;
return XML_STATUS_ERROR;
- default:
+ case XML_PARSING:
if (resumable) {
#ifdef XML_DTD
if (parser->m_isParamEntity) {
@@ -2213,6 +2213,9 @@ XML_StopParser(XML_Parser parser, XML_Bool resumable) {
parser->m_parsingStatus.parsing = XML_SUSPENDED;
} else
parser->m_parsingStatus.parsing = XML_FINISHED;
+ break;
+ default:
+ assert(0);
}
return XML_STATUS_OK;
}
--
2.30.2

2
meta/recipes-core/expat/expat_2.5.0.bb
View File

@@ -28,6 +28,8 @@ SRC_URI = "https://github.com/libexpat/libexpat/releases/download/R_${VERSION_TA
file://CVE-2024-45490-0004.patch \
file://CVE-2024-45491.patch \
file://CVE-2024-45492.patch \
file://CVE-2024-50602-01.patch \
file://CVE-2024-50602-02.patch \
"
UPSTREAM_CHECK_URI = "https://github.com/libexpat/libexpat/releases/"