mirror of
https://git.yoctoproject.org/poky
synced 2026-02-27 03:49:41 +01:00
670a3345f5
Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39615 (From OE-Core rev: 9a2ad95caffae37014fa27d9b20d45f9779d0fbf) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
38 lines
1.3 KiB
Diff
38 lines
1.3 KiB
Diff
From d0c3f01e110d54415611c5fa0040cdf4a56053f9 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Sat May 6 17:47:37 2023 +0200
|
|
Subject: [PATCH 1/2] parser: Fix old SAX1 parser with custom callbacks
|
|
|
|
For some reason, xmlCtxtUseOptionsInternal set the start and end element
|
|
SAX handlers to the internal DOM builder functions when XML_PARSE_SAX1
|
|
was specified. This means that custom SAX handlers could never work with
|
|
that flag because these functions would receive the wrong user data
|
|
argument and crash immediately.
|
|
|
|
Fixes #535.
|
|
|
|
CVE: CVE-2023-39615
|
|
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/d0c3f01e110d54415611c5fa0040cdf4a56053f9]
|
|
|
|
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
|
|
---
|
|
parser.c | 2 --
|
|
1 file changed, 2 deletions(-)
|
|
|
|
diff --git a/parser.c b/parser.c
|
|
index 0f76577..b781c80 100644
|
|
--- a/parser.c
|
|
+++ b/parser.c
|
|
@@ -15069,8 +15069,6 @@ xmlCtxtUseOptionsInternal(xmlParserCtxtPtr ctxt, int options, const char *encodi
|
|
}
|
|
#ifdef LIBXML_SAX1_ENABLED
|
|
if (options & XML_PARSE_SAX1) {
|
|
- ctxt->sax->startElement = xmlSAX2StartElement;
|
|
- ctxt->sax->endElement = xmlSAX2EndElement;
|
|
ctxt->sax->startElementNs = NULL;
|
|
ctxt->sax->endElementNs = NULL;
|
|
ctxt->sax->initialized = 1;
|
|
--
|
|
2.40.0
|