mirror of
https://git.yoctoproject.org/poky
synced 2026-04-30 21:32:13 +02:00
55d097a106
includes: CVE-2015-7499-1 CVE-2015-7499-2 (From OE-Core rev: 51aedd5307b92b63d97b63bd9911eda67ee6fde8) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
44 lines
1.4 KiB
Diff
44 lines
1.4 KiB
Diff
From 35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da Mon Sep 17 00:00:00 2001
|
|
From: Daniel Veillard <veillard@redhat.com>
|
|
Date: Fri, 20 Nov 2015 15:04:09 +0800
|
|
Subject: [PATCH] Detect incoherency on GROW
|
|
|
|
the current pointer to the input has to be between the base and end
|
|
if not stop everything we have an internal state error.
|
|
|
|
Upstream-Status: Backport
|
|
|
|
CVE-2015-7499-2
|
|
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
---
|
|
parser.c | 9 ++++++++-
|
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/parser.c b/parser.c
|
|
index 1810f99..ab007aa 100644
|
|
--- a/parser.c
|
|
+++ b/parser.c
|
|
@@ -2075,9 +2075,16 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
|
|
((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
|
|
((ctxt->options & XML_PARSE_HUGE) == 0)) {
|
|
xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
|
|
- ctxt->instate = XML_PARSER_EOF;
|
|
+ xmlHaltParser(ctxt);
|
|
+ return;
|
|
}
|
|
xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
|
|
+ if ((ctxt->input->cur > ctxt->input->end) ||
|
|
+ (ctxt->input->cur < ctxt->input->base)) {
|
|
+ xmlHaltParser(ctxt);
|
|
+ xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
|
|
+ return;
|
|
+ }
|
|
if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
|
|
(xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
|
|
xmlPopInput(ctxt);
|
|
--
|
|
2.3.5
|
|
|