mirror of
https://git.yoctoproject.org/poky
synced 2026-04-30 21:32:13 +02:00
58aa4f3e1b
A flaw was found in libxml2's xmlBuildQName function, where integer
overflows in buffer size calculations can lead to a stack-based buffer
overflow. This issue can result in memory corruption or a denial
of service when processing crafted input.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-6021
Upstream-patch:
17d950ae33
(From OE-Core rev: 99a239d9146c5ecf158cd9db7823ec1aff45fd48)
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
60 lines
1.7 KiB
Diff
60 lines
1.7 KiB
Diff
From 17d950ae33c23f87692aa179bacedb6743f3188a Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Tue, 27 May 2025 12:53:17 +0200
|
|
Subject: [PATCH] [CVE-2025-6021] tree: Fix integer overflow in xmlBuildQName
|
|
|
|
Fixes #926.
|
|
|
|
CVE: CVE-2025-6021
|
|
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae33c23f87692aa179bacedb6743f3188a]
|
|
|
|
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
|
---
|
|
tree.c | 12 +++++++++---
|
|
1 file changed, 9 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/tree.c b/tree.c
|
|
index f097cf8..5bc95b8 100644
|
|
--- a/tree.c
|
|
+++ b/tree.c
|
|
@@ -47,6 +47,10 @@
|
|
#include "private/error.h"
|
|
#include "private/tree.h"
|
|
|
|
+#ifndef SIZE_MAX
|
|
+ #define SIZE_MAX ((size_t)-1)
|
|
+#endif
|
|
+
|
|
int __xmlRegisterCallbacks = 0;
|
|
|
|
/************************************************************************
|
|
@@ -167,10 +171,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
|
|
xmlChar *
|
|
xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
|
|
xmlChar *memory, int len) {
|
|
- int lenn, lenp;
|
|
+ size_t lenn, lenp;
|
|
xmlChar *ret;
|
|
|
|
- if (ncname == NULL) return(NULL);
|
|
+ if ((ncname == NULL) || (len < 0)) return(NULL);
|
|
if (prefix == NULL) return((xmlChar *) ncname);
|
|
|
|
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
|
|
@@ -181,8 +185,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
|
|
|
|
lenn = strlen((char *) ncname);
|
|
lenp = strlen((char *) prefix);
|
|
+ if (lenn >= SIZE_MAX - lenp - 1)
|
|
+ return(NULL);
|
|
|
|
- if ((memory == NULL) || (len < lenn + lenp + 2)) {
|
|
+ if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
|
|
ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
|
|
if (ret == NULL)
|
|
return(NULL);
|
|
--
|
|
2.40.0
|
|
|