mirror of
https://git.yoctoproject.org/poky
synced 2026-02-26 19:39:40 +01:00
670a3345f5
Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39615 (From OE-Core rev: 9a2ad95caffae37014fa27d9b20d45f9779d0fbf) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
73 lines
2.4 KiB
Diff
73 lines
2.4 KiB
Diff
From 235b15a590eecf97b09e87bdb7e4f8333e9de129 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Mon May 8 17:58:02 2023 +0200
|
|
Subject: [PATCH 2/2] SAX: Always initialize SAX1 element handlers
|
|
|
|
Follow-up to commit d0c3f01e. A parser context will be initialized to
|
|
SAX version 2, but this can be overridden with XML_PARSE_SAX1 later,
|
|
so we must initialize the SAX1 element handlers as well.
|
|
|
|
Change the check in xmlDetectSAX2 to only look for XML_SAX2_MAGIC, so
|
|
we don't switch to SAX1 if the SAX2 element handlers are NULL.
|
|
|
|
CVE: CVE-2023-39615
|
|
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/235b15a590eecf97b09e87bdb7e4f8333e9de129]
|
|
|
|
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
|
|
---
|
|
SAX2.c | 11 +++++++----
|
|
parser.c | 5 +----
|
|
2 files changed, 8 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/SAX2.c b/SAX2.c
|
|
index 0319246..f7c77c2 100644
|
|
--- a/SAX2.c
|
|
+++ b/SAX2.c
|
|
@@ -2842,20 +2842,23 @@ xmlSAXVersion(xmlSAXHandler *hdlr, int version)
|
|
{
|
|
if (hdlr == NULL) return(-1);
|
|
if (version == 2) {
|
|
- hdlr->startElement = NULL;
|
|
- hdlr->endElement = NULL;
|
|
hdlr->startElementNs = xmlSAX2StartElementNs;
|
|
hdlr->endElementNs = xmlSAX2EndElementNs;
|
|
hdlr->serror = NULL;
|
|
hdlr->initialized = XML_SAX2_MAGIC;
|
|
#ifdef LIBXML_SAX1_ENABLED
|
|
} else if (version == 1) {
|
|
- hdlr->startElement = xmlSAX2StartElement;
|
|
- hdlr->endElement = xmlSAX2EndElement;
|
|
hdlr->initialized = 1;
|
|
#endif /* LIBXML_SAX1_ENABLED */
|
|
} else
|
|
return(-1);
|
|
+#ifdef LIBXML_SAX1_ENABLED
|
|
+ hdlr->startElement = xmlSAX2StartElement;
|
|
+ hdlr->endElement = xmlSAX2EndElement;
|
|
+#else
|
|
+ hdlr->startElement = NULL;
|
|
+ hdlr->endElement = NULL;
|
|
+#endif /* LIBXML_SAX1_ENABLED */
|
|
hdlr->internalSubset = xmlSAX2InternalSubset;
|
|
hdlr->externalSubset = xmlSAX2ExternalSubset;
|
|
hdlr->isStandalone = xmlSAX2IsStandalone;
|
|
diff --git a/parser.c b/parser.c
|
|
index b781c80..738dbee 100644
|
|
--- a/parser.c
|
|
+++ b/parser.c
|
|
@@ -1109,10 +1109,7 @@ xmlDetectSAX2(xmlParserCtxtPtr ctxt) {
|
|
if (ctxt == NULL) return;
|
|
sax = ctxt->sax;
|
|
#ifdef LIBXML_SAX1_ENABLED
|
|
- if ((sax) && (sax->initialized == XML_SAX2_MAGIC) &&
|
|
- ((sax->startElementNs != NULL) ||
|
|
- (sax->endElementNs != NULL) ||
|
|
- ((sax->startElement == NULL) && (sax->endElement == NULL))))
|
|
+ if ((sax) && (sax->initialized == XML_SAX2_MAGIC))
|
|
ctxt->sax2 = 1;
|
|
#else
|
|
ctxt->sax2 = 1;
|
|
--
|
|
2.40.0
|