[arch-commits] Commit in lib32-expat/repos/multilib-x86_64 (8 files)
Felix Yan
felixonmars at archlinux.org
Wed Jul 26 07:19:00 UTC 2017
Date: Wednesday, July 26, 2017 @ 07:18:59
Author: felixonmars
Revision: 246397
archrelease: copy trunk to multilib-x86_64
Added:
lib32-expat/repos/multilib-x86_64/CVE-2015-1283-refix.patch
(from rev 246396, lib32-expat/trunk/CVE-2015-1283-refix.patch)
lib32-expat/repos/multilib-x86_64/CVE-2016-0718-v2-2-1.patch
(from rev 246396, lib32-expat/trunk/CVE-2016-0718-v2-2-1.patch)
lib32-expat/repos/multilib-x86_64/PKGBUILD
(from rev 246396, lib32-expat/trunk/PKGBUILD)
lib32-expat/repos/multilib-x86_64/cve-2012-6702-plus-cve-2016-5300-v1.patch
(from rev 246396, lib32-expat/trunk/cve-2012-6702-plus-cve-2016-5300-v1.patch)
Deleted:
lib32-expat/repos/multilib-x86_64/CVE-2015-1283-refix.patch
lib32-expat/repos/multilib-x86_64/CVE-2016-0718-v2-2-1.patch
lib32-expat/repos/multilib-x86_64/PKGBUILD
lib32-expat/repos/multilib-x86_64/cve-2012-6702-plus-cve-2016-5300-v1.patch
-------------------------------------------+
CVE-2015-1283-refix.patch | 76 -
CVE-2016-0718-v2-2-1.patch | 1512 ++++++++++++++--------------
PKGBUILD | 64 -
cve-2012-6702-plus-cve-2016-5300-v1.patch | 268 ++--
4 files changed, 960 insertions(+), 960 deletions(-)
Deleted: CVE-2015-1283-refix.patch
===================================================================
--- CVE-2015-1283-refix.patch 2017-07-26 07:18:09 UTC (rev 246396)
+++ CVE-2015-1283-refix.patch 2017-07-26 07:18:59 UTC (rev 246397)
@@ -1,38 +0,0 @@
-From 29a11774d8ebbafe8418b4a5ffb4cc1160b194a1 Mon Sep 17 00:00:00 2001
-From: Pascal Cuoq <cuoq at trust-in-soft.com>
-Date: Sun, 15 May 2016 09:05:46 +0200
-Subject: [PATCH] Avoid relying on undefined behavior in CVE-2015-1283 fix. It
- does not really work: https://godbolt.org/g/Zl8gdF
-
----
- expat/lib/xmlparse.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index 13e080d..cdb12ef 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -1693,7 +1693,8 @@ XML_GetBuffer(XML_Parser parser, int len)
- }
-
- if (len > bufferLim - bufferEnd) {
-- int neededSize = len + (int)(bufferEnd - bufferPtr);
-+ /* Do not invoke signed arithmetic overflow: */
-+ int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
- if (neededSize < 0) {
- errorCode = XML_ERROR_NO_MEMORY;
- return NULL;
-@@ -1725,7 +1726,8 @@ XML_GetBuffer(XML_Parser parser, int len)
- if (bufferSize == 0)
- bufferSize = INIT_BUFFER_SIZE;
- do {
-- bufferSize *= 2;
-+ /* Do not invoke signed arithmetic overflow: */
-+ bufferSize = (int) (2U * (unsigned) bufferSize);
- } while (bufferSize < neededSize && bufferSize > 0);
- if (bufferSize <= 0) {
- errorCode = XML_ERROR_NO_MEMORY;
---
-2.8.2
-
-
Copied: lib32-expat/repos/multilib-x86_64/CVE-2015-1283-refix.patch (from rev 246396, lib32-expat/trunk/CVE-2015-1283-refix.patch)
===================================================================
--- CVE-2015-1283-refix.patch (rev 0)
+++ CVE-2015-1283-refix.patch 2017-07-26 07:18:59 UTC (rev 246397)
@@ -0,0 +1,38 @@
+From 29a11774d8ebbafe8418b4a5ffb4cc1160b194a1 Mon Sep 17 00:00:00 2001
+From: Pascal Cuoq <cuoq at trust-in-soft.com>
+Date: Sun, 15 May 2016 09:05:46 +0200
+Subject: [PATCH] Avoid relying on undefined behavior in CVE-2015-1283 fix. It
+ does not really work: https://godbolt.org/g/Zl8gdF
+
+---
+ expat/lib/xmlparse.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 13e080d..cdb12ef 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -1693,7 +1693,8 @@ XML_GetBuffer(XML_Parser parser, int len)
+ }
+
+ if (len > bufferLim - bufferEnd) {
+- int neededSize = len + (int)(bufferEnd - bufferPtr);
++ /* Do not invoke signed arithmetic overflow: */
++ int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
+ if (neededSize < 0) {
+ errorCode = XML_ERROR_NO_MEMORY;
+ return NULL;
+@@ -1725,7 +1726,8 @@ XML_GetBuffer(XML_Parser parser, int len)
+ if (bufferSize == 0)
+ bufferSize = INIT_BUFFER_SIZE;
+ do {
+- bufferSize *= 2;
++ /* Do not invoke signed arithmetic overflow: */
++ bufferSize = (int) (2U * (unsigned) bufferSize);
+ } while (bufferSize < neededSize && bufferSize > 0);
+ if (bufferSize <= 0) {
+ errorCode = XML_ERROR_NO_MEMORY;
+--
+2.8.2
+
+
Deleted: CVE-2016-0718-v2-2-1.patch
===================================================================
--- CVE-2016-0718-v2-2-1.patch 2017-07-26 07:18:09 UTC (rev 246396)
+++ CVE-2016-0718-v2-2-1.patch 2017-07-26 07:18:59 UTC (rev 246397)
@@ -1,756 +0,0 @@
-From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001
-From: Sebastian Pipping <sebastian at pipping.org>
-Date: Mon, 2 May 2016 00:02:44 +0200
-Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1)
-
-* Out of bounds memory access when doing text conversion on malformed input
-* Integer overflow related to memory allocation
-
-Reported by Gustavo Grieco
-
-Patch credits go to
-* Christian Heimes
-* Karl Waclawek
-* Gustavo Grieco
-* Sebastian Pipping
-* Pascal Cuoq
----
- expat/lib/xmlparse.c | 34 +++++++++-----
- expat/lib/xmltok.c | 115 +++++++++++++++++++++++++++++++++++-------------
- expat/lib/xmltok.h | 10 ++++-
- expat/lib/xmltok_impl.c | 62 +++++++++++++-------------
- 4 files changed, 146 insertions(+), 75 deletions(-)
-
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index e308c79..13e080d 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -2426,11 +2426,11 @@ doContent(XML_Parser parser,
- for (;;) {
- int bufSize;
- int convLen;
-- XmlConvert(enc,
-+ const enum XML_Convert_Result convert_res = XmlConvert(enc,
- &fromPtr, rawNameEnd,
- (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1);
- convLen = (int)(toPtr - (XML_Char *)tag->buf);
-- if (fromPtr == rawNameEnd) {
-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) {
- tag->name.strLen = convLen;
- break;
- }
-@@ -2651,11 +2651,11 @@ doContent(XML_Parser parser,
- if (MUST_CONVERT(enc, s)) {
- for (;;) {
- ICHAR *dataPtr = (ICHAR *)dataBuf;
-- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
-+ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
- *eventEndPP = s;
- charDataHandler(handlerArg, dataBuf,
- (int)(dataPtr - (ICHAR *)dataBuf));
-- if (s == next)
-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
- break;
- *eventPP = s;
- }
-@@ -3261,11 +3261,11 @@ doCdataSection(XML_Parser parser,
- if (MUST_CONVERT(enc, s)) {
- for (;;) {
- ICHAR *dataPtr = (ICHAR *)dataBuf;
-- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
-+ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
- *eventEndPP = next;
- charDataHandler(handlerArg, dataBuf,
- (int)(dataPtr - (ICHAR *)dataBuf));
-- if (s == next)
-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
- break;
- *eventPP = s;
- }
-@@ -5342,6 +5342,7 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
- const char *s, const char *end)
- {
- if (MUST_CONVERT(enc, s)) {
-+ enum XML_Convert_Result convert_res;
- const char **eventPP;
- const char **eventEndPP;
- if (enc == encoding) {
-@@ -5354,11 +5355,11 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
- }
- do {
- ICHAR *dataPtr = (ICHAR *)dataBuf;
-- XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
-+ convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
- *eventEndPP = s;
- defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf));
- *eventPP = s;
-- } while (s != end);
-+ } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
- }
- else
- defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s));
-@@ -6163,8 +6164,8 @@ poolAppend(STRING_POOL *pool, const ENCODING *enc,
- if (!pool->ptr && !poolGrow(pool))
- return NULL;
- for (;;) {
-- XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
-- if (ptr == end)
-+ const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
- break;
- if (!poolGrow(pool))
- return NULL;
-@@ -6248,8 +6249,13 @@ poolGrow(STRING_POOL *pool)
- }
- }
- if (pool->blocks && pool->start == pool->blocks->s) {
-- int blockSize = (int)(pool->end - pool->start)*2;
-- BLOCK *temp = (BLOCK *)
-+ BLOCK *temp;
-+ int blockSize = (int)((unsigned)(pool->end - pool->start)*2U);
-+
-+ if (blockSize < 0)
-+ return XML_FALSE;
-+
-+ temp = (BLOCK *)
- pool->mem->realloc_fcn(pool->blocks,
- (offsetof(BLOCK, s)
- + blockSize * sizeof(XML_Char)));
-@@ -6264,6 +6270,10 @@ poolGrow(STRING_POOL *pool)
- else {
- BLOCK *tem;
- int blockSize = (int)(pool->end - pool->start);
-+
-+ if (blockSize < 0)
-+ return XML_FALSE;
-+
- if (blockSize < INIT_BLOCK_SIZE)
- blockSize = INIT_BLOCK_SIZE;
- else
-diff --git a/expat/lib/xmltok.c b/expat/lib/xmltok.c
-index bf09dfc..cb98ce1 100644
---- a/expat/lib/xmltok.c
-+++ b/expat/lib/xmltok.c
-@@ -318,39 +318,55 @@ enum { /* UTF8_cvalN is value of masked first byte of N byte sequence */
- UTF8_cval4 = 0xf0
- };
-
--static void PTRCALL
-+static enum XML_Convert_Result PTRCALL
- utf8_toUtf8(const ENCODING *enc,
- const char **fromP, const char *fromLim,
- char **toP, const char *toLim)
- {
-+ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
- char *to;
- const char *from;
- if (fromLim - *fromP > toLim - *toP) {
- /* Avoid copying partial characters. */
-+ res = XML_CONVERT_OUTPUT_EXHAUSTED;
- for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--)
- if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
- break;
- }
-- for (to = *toP, from = *fromP; from != fromLim; from++, to++)
-+ for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++)
- *to = *from;
- *fromP = from;
- *toP = to;
-+
-+ if ((to == toLim) && (from < fromLim))
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
-+ else
-+ return res;
- }
-
--static void PTRCALL
-+static enum XML_Convert_Result PTRCALL
- utf8_toUtf16(const ENCODING *enc,
- const char **fromP, const char *fromLim,
- unsigned short **toP, const unsigned short *toLim)
- {
-+ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
- unsigned short *to = *toP;
- const char *from = *fromP;
-- while (from != fromLim && to != toLim) {
-+ while (from < fromLim && to < toLim) {
- switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
- case BT_LEAD2:
-+ if (fromLim - from < 2) {
-+ res = XML_CONVERT_INPUT_INCOMPLETE;
-+ break;
-+ }
- *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
- from += 2;
- break;
- case BT_LEAD3:
-+ if (fromLim - from < 3) {
-+ res = XML_CONVERT_INPUT_INCOMPLETE;
-+ break;
-+ }
- *to++ = (unsigned short)(((from[0] & 0xf) << 12)
- | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f));
- from += 3;
-@@ -358,8 +374,14 @@ utf8_toUtf16(const ENCODING *enc,
- case BT_LEAD4:
- {
- unsigned long n;
-- if (to + 1 == toLim)
-+ if (toLim - to < 2) {
-+ res = XML_CONVERT_OUTPUT_EXHAUSTED;
- goto after;
-+ }
-+ if (fromLim - from < 4) {
-+ res = XML_CONVERT_INPUT_INCOMPLETE;
-+ goto after;
-+ }
- n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12)
- | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f);
- n -= 0x10000;
-@@ -377,6 +399,7 @@ utf8_toUtf16(const ENCODING *enc,
- after:
- *fromP = from;
- *toP = to;
-+ return res;
- }
-
- #ifdef XML_NS
-@@ -425,7 +448,7 @@ static const struct normal_encoding internal_utf8_encoding = {
- STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_)
- };
-
--static void PTRCALL
-+static enum XML_Convert_Result PTRCALL
- latin1_toUtf8(const ENCODING *enc,
- const char **fromP, const char *fromLim,
- char **toP, const char *toLim)
-@@ -433,30 +456,35 @@ latin1_toUtf8(const ENCODING *enc,
- for (;;) {
- unsigned char c;
- if (*fromP == fromLim)
-- break;
-+ return XML_CONVERT_COMPLETED;
- c = (unsigned char)**fromP;
- if (c & 0x80) {
- if (toLim - *toP < 2)
-- break;
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
- *(*toP)++ = (char)((c >> 6) | UTF8_cval2);
- *(*toP)++ = (char)((c & 0x3f) | 0x80);
- (*fromP)++;
- }
- else {
- if (*toP == toLim)
-- break;
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
- *(*toP)++ = *(*fromP)++;
- }
- }
- }
-
--static void PTRCALL
-+static enum XML_Convert_Result PTRCALL
- latin1_toUtf16(const ENCODING *enc,
- const char **fromP, const char *fromLim,
- unsigned short **toP, const unsigned short *toLim)
- {
-- while (*fromP != fromLim && *toP != toLim)
-+ while (*fromP < fromLim && *toP < toLim)
- *(*toP)++ = (unsigned char)*(*fromP)++;
-+
-+ if ((*toP == toLim) && (*fromP < fromLim))
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
-+ else
-+ return XML_CONVERT_COMPLETED;
- }
-
- #ifdef XML_NS
-@@ -483,13 +511,18 @@ static const struct normal_encoding latin1_encoding = {
- STANDARD_VTABLE(sb_)
- };
-
--static void PTRCALL
-+static enum XML_Convert_Result PTRCALL
- ascii_toUtf8(const ENCODING *enc,
- const char **fromP, const char *fromLim,
- char **toP, const char *toLim)
- {
-- while (*fromP != fromLim && *toP != toLim)
-+ while (*fromP < fromLim && *toP < toLim)
- *(*toP)++ = *(*fromP)++;
-+
-+ if ((*toP == toLim) && (*fromP < fromLim))
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
-+ else
-+ return XML_CONVERT_COMPLETED;
- }
-
- #ifdef XML_NS
-@@ -536,13 +569,14 @@ unicode_byte_type(char hi, char lo)
- }
-
- #define DEFINE_UTF16_TO_UTF8(E) \
--static void PTRCALL \
-+static enum XML_Convert_Result PTRCALL \
- E ## toUtf8(const ENCODING *enc, \
- const char **fromP, const char *fromLim, \
- char **toP, const char *toLim) \
- { \
-- const char *from; \
-- for (from = *fromP; from != fromLim; from += 2) { \
-+ const char *from = *fromP; \
-+ fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \
-+ for (; from < fromLim; from += 2) { \
- int plane; \
- unsigned char lo2; \
- unsigned char lo = GET_LO(from); \
-@@ -552,7 +586,7 @@ E ## toUtf8(const ENCODING *enc, \
- if (lo < 0x80) { \
- if (*toP == toLim) { \
- *fromP = from; \
-- return; \
-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \
- } \
- *(*toP)++ = lo; \
- break; \
-@@ -562,7 +596,7 @@ E ## toUtf8(const ENCODING *enc, \
- case 0x4: case 0x5: case 0x6: case 0x7: \
- if (toLim - *toP < 2) { \
- *fromP = from; \
-- return; \
-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \
- } \
- *(*toP)++ = ((lo >> 6) | (hi << 2) | UTF8_cval2); \
- *(*toP)++ = ((lo & 0x3f) | 0x80); \
-@@ -570,7 +604,7 @@ E ## toUtf8(const ENCODING *enc, \
- default: \
- if (toLim - *toP < 3) { \
- *fromP = from; \
-- return; \
-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \
- } \
- /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \
- *(*toP)++ = ((hi >> 4) | UTF8_cval3); \
-@@ -580,7 +614,11 @@ E ## toUtf8(const ENCODING *enc, \
- case 0xD8: case 0xD9: case 0xDA: case 0xDB: \
- if (toLim - *toP < 4) { \
- *fromP = from; \
-- return; \
-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \
-+ } \
-+ if (fromLim - from < 4) { \
-+ *fromP = from; \
-+ return XML_CONVERT_INPUT_INCOMPLETE; \
- } \
- plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \
- *(*toP)++ = ((plane >> 2) | UTF8_cval4); \
-@@ -596,20 +634,32 @@ E ## toUtf8(const ENCODING *enc, \
- } \
- } \
- *fromP = from; \
-+ if (from < fromLim) \
-+ return XML_CONVERT_INPUT_INCOMPLETE; \
-+ else \
-+ return XML_CONVERT_COMPLETED; \
- }
-
- #define DEFINE_UTF16_TO_UTF16(E) \
--static void PTRCALL \
-+static enum XML_Convert_Result PTRCALL \
- E ## toUtf16(const ENCODING *enc, \
- const char **fromP, const char *fromLim, \
- unsigned short **toP, const unsigned short *toLim) \
- { \
-+ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \
-+ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \
- /* Avoid copying first half only of surrogate */ \
- if (fromLim - *fromP > ((toLim - *toP) << 1) \
-- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
-+ && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \
- fromLim -= 2; \
-- for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \
-+ res = XML_CONVERT_INPUT_INCOMPLETE; \
-+ } \
-+ for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \
- *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
-+ if ((*toP == toLim) && (*fromP < fromLim)) \
-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \
-+ else \
-+ return res; \
- }
-
- #define SET2(ptr, ch) \
-@@ -1288,7 +1338,7 @@ unknown_isInvalid(const ENCODING *enc, const char *p)
- return (c & ~0xFFFF) || checkCharRefNumber(c) < 0;
- }
-
--static void PTRCALL
-+static enum XML_Convert_Result PTRCALL
- unknown_toUtf8(const ENCODING *enc,
- const char **fromP, const char *fromLim,
- char **toP, const char *toLim)
-@@ -1299,21 +1349,21 @@ unknown_toUtf8(const ENCODING *enc,
- const char *utf8;
- int n;
- if (*fromP == fromLim)
-- break;
-+ return XML_CONVERT_COMPLETED;
- utf8 = uenc->utf8[(unsigned char)**fromP];
- n = *utf8++;
- if (n == 0) {
- int c = uenc->convert(uenc->userData, *fromP);
- n = XmlUtf8Encode(c, buf);
- if (n > toLim - *toP)
-- break;
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
- utf8 = buf;
- *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP]
- - (BT_LEAD2 - 2));
- }
- else {
- if (n > toLim - *toP)
-- break;
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
- (*fromP)++;
- }
- do {
-@@ -1322,13 +1372,13 @@ unknown_toUtf8(const ENCODING *enc,
- }
- }
-
--static void PTRCALL
-+static enum XML_Convert_Result PTRCALL
- unknown_toUtf16(const ENCODING *enc,
- const char **fromP, const char *fromLim,
- unsigned short **toP, const unsigned short *toLim)
- {
- const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
-- while (*fromP != fromLim && *toP != toLim) {
-+ while (*fromP < fromLim && *toP < toLim) {
- unsigned short c = uenc->utf16[(unsigned char)**fromP];
- if (c == 0) {
- c = (unsigned short)
-@@ -1340,6 +1390,11 @@ unknown_toUtf16(const ENCODING *enc,
- (*fromP)++;
- *(*toP)++ = c;
- }
-+
-+ if ((*toP == toLim) && (*fromP < fromLim))
-+ return XML_CONVERT_OUTPUT_EXHAUSTED;
-+ else
-+ return XML_CONVERT_COMPLETED;
- }
-
- ENCODING *
-@@ -1503,7 +1558,7 @@ initScan(const ENCODING * const *encodingTable,
- {
- const ENCODING **encPtr;
-
-- if (ptr == end)
-+ if (ptr >= end)
- return XML_TOK_NONE;
- encPtr = enc->encPtr;
- if (ptr + 1 == end) {
-diff --git a/expat/lib/xmltok.h b/expat/lib/xmltok.h
-index ca867aa..752007e 100644
---- a/expat/lib/xmltok.h
-+++ b/expat/lib/xmltok.h
-@@ -130,6 +130,12 @@ typedef int (PTRCALL *SCANNER)(const ENCODING *,
- const char *,
- const char **);
-
-+enum XML_Convert_Result {
-+ XML_CONVERT_COMPLETED = 0,
-+ XML_CONVERT_INPUT_INCOMPLETE = 1,
-+ XML_CONVERT_OUTPUT_EXHAUSTED = 2 /* and therefore potentially input remaining as well */
-+};
-+
- struct encoding {
- SCANNER scanners[XML_N_STATES];
- SCANNER literalScanners[XML_N_LITERAL_TYPES];
-@@ -158,12 +164,12 @@ struct encoding {
- const char *ptr,
- const char *end,
- const char **badPtr);
-- void (PTRCALL *utf8Convert)(const ENCODING *enc,
-+ enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc,
- const char **fromP,
- const char *fromLim,
- char **toP,
- const char *toLim);
-- void (PTRCALL *utf16Convert)(const ENCODING *enc,
-+ enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc,
- const char **fromP,
- const char *fromLim,
- unsigned short **toP,
-diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c
-index 9c2895b..6c5a3ba 100644
---- a/expat/lib/xmltok_impl.c
-+++ b/expat/lib/xmltok_impl.c
-@@ -93,13 +93,13 @@ static int PTRCALL
- PREFIX(scanComment)(const ENCODING *enc, const char *ptr,
- const char *end, const char **nextTokPtr)
- {
-- if (ptr != end) {
-+ if (ptr < end) {
- if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
- ptr += MINBPC(enc);
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- INVALID_CASES(ptr, nextTokPtr)
- case BT_MINUS:
-@@ -147,7 +147,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- case BT_PERCNT:
- if (ptr + MINBPC(enc) == end)
-@@ -233,7 +233,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- case BT_S: case BT_CR: case BT_LF:
-@@ -242,7 +242,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
- return XML_TOK_INVALID;
- }
- ptr += MINBPC(enc);
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- INVALID_CASES(ptr, nextTokPtr)
- case BT_QUEST:
-@@ -305,7 +305,7 @@ static int PTRCALL
- PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
- const char *end, const char **nextTokPtr)
- {
-- if (ptr == end)
-+ if (ptr >= end)
- return XML_TOK_NONE;
- if (MINBPC(enc) > 1) {
- size_t n = end - ptr;
-@@ -348,7 +348,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
- ptr += MINBPC(enc);
- break;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- #define LEAD_CASE(n) \
- case BT_LEAD ## n: \
-@@ -391,11 +391,11 @@ PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- case BT_S: case BT_CR: case BT_LF:
-- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
-+ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
- switch (BYTE_TYPE(enc, ptr)) {
- case BT_S: case BT_CR: case BT_LF:
- break;
-@@ -432,7 +432,7 @@ static int PTRCALL
- PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
- const char *end, const char **nextTokPtr)
- {
-- if (ptr != end) {
-+ if (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- case BT_DIGIT:
- case BT_HEX:
-@@ -441,7 +441,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
-+ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
- switch (BYTE_TYPE(enc, ptr)) {
- case BT_DIGIT:
- case BT_HEX:
-@@ -464,7 +464,7 @@ static int PTRCALL
- PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
- const char *end, const char **nextTokPtr)
- {
-- if (ptr != end) {
-+ if (ptr < end) {
- if (CHAR_MATCHES(enc, ptr, ASCII_x))
- return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
- switch (BYTE_TYPE(enc, ptr)) {
-@@ -474,7 +474,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
-+ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
- switch (BYTE_TYPE(enc, ptr)) {
- case BT_DIGIT:
- break;
-@@ -506,7 +506,7 @@ PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- case BT_SEMI:
-@@ -529,7 +529,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
- #ifdef XML_NS
- int hadColon = 0;
- #endif
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- #ifdef XML_NS
-@@ -716,7 +716,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
- hadColon = 0;
- #endif
- /* we have a start-tag */
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- #ifdef XML_NS
-@@ -740,7 +740,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
- case BT_S: case BT_CR: case BT_LF:
- {
- ptr += MINBPC(enc);
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
- case BT_GT:
-@@ -785,7 +785,7 @@ static int PTRCALL
- PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
- const char **nextTokPtr)
- {
-- if (ptr == end)
-+ if (ptr >= end)
- return XML_TOK_NONE;
- if (MINBPC(enc) > 1) {
- size_t n = end - ptr;
-@@ -832,7 +832,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
- ptr += MINBPC(enc);
- break;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- #define LEAD_CASE(n) \
- case BT_LEAD ## n: \
-@@ -895,7 +895,7 @@ PREFIX(scanPercent)(const ENCODING *enc, const char *ptr, const char *end,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- case BT_SEMI:
-@@ -921,7 +921,7 @@ PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- case BT_CR: case BT_LF: case BT_S:
-@@ -941,7 +941,7 @@ PREFIX(scanLit)(int open, const ENCODING *enc,
- const char *ptr, const char *end,
- const char **nextTokPtr)
- {
-- while (ptr != end) {
-+ while (ptr < end) {
- int t = BYTE_TYPE(enc, ptr);
- switch (t) {
- INVALID_CASES(ptr, nextTokPtr)
-@@ -973,7 +973,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
- const char **nextTokPtr)
- {
- int tok;
-- if (ptr == end)
-+ if (ptr >= end)
- return XML_TOK_NONE;
- if (MINBPC(enc) > 1) {
- size_t n = end - ptr;
-@@ -1141,7 +1141,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
- *nextTokPtr = ptr;
- return XML_TOK_INVALID;
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
- case BT_GT: case BT_RPAR: case BT_COMMA:
-@@ -1204,10 +1204,10 @@ PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr,
- const char *end, const char **nextTokPtr)
- {
- const char *start;
-- if (ptr == end)
-+ if (ptr >= end)
- return XML_TOK_NONE;
- start = ptr;
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- #define LEAD_CASE(n) \
- case BT_LEAD ## n: ptr += n; break;
-@@ -1262,10 +1262,10 @@ PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr,
- const char *end, const char **nextTokPtr)
- {
- const char *start;
-- if (ptr == end)
-+ if (ptr >= end)
- return XML_TOK_NONE;
- start = ptr;
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- #define LEAD_CASE(n) \
- case BT_LEAD ## n: ptr += n; break;
-@@ -1326,7 +1326,7 @@ PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr,
- end = ptr + n;
- }
- }
-- while (ptr != end) {
-+ while (ptr < end) {
- switch (BYTE_TYPE(enc, ptr)) {
- INVALID_CASES(ptr, nextTokPtr)
- case BT_LT:
-@@ -1373,7 +1373,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
- {
- ptr += MINBPC(enc);
- end -= MINBPC(enc);
-- for (; ptr != end; ptr += MINBPC(enc)) {
-+ for (; ptr < end; ptr += MINBPC(enc)) {
- switch (BYTE_TYPE(enc, ptr)) {
- case BT_DIGIT:
- case BT_HEX:
-@@ -1760,7 +1760,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
- case BT_CR:
- pos->lineNumber++;
- ptr += MINBPC(enc);
-- if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF)
-+ if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF)
- ptr += MINBPC(enc);
- pos->columnNumber = (XML_Size)-1;
- break;
---
-2.8.2
-
-
Copied: lib32-expat/repos/multilib-x86_64/CVE-2016-0718-v2-2-1.patch (from rev 246396, lib32-expat/trunk/CVE-2016-0718-v2-2-1.patch)
===================================================================
--- CVE-2016-0718-v2-2-1.patch (rev 0)
+++ CVE-2016-0718-v2-2-1.patch 2017-07-26 07:18:59 UTC (rev 246397)
@@ -0,0 +1,756 @@
+From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian at pipping.org>
+Date: Mon, 2 May 2016 00:02:44 +0200
+Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1)
+
+* Out of bounds memory access when doing text conversion on malformed input
+* Integer overflow related to memory allocation
+
+Reported by Gustavo Grieco
+
+Patch credits go to
+* Christian Heimes
+* Karl Waclawek
+* Gustavo Grieco
+* Sebastian Pipping
+* Pascal Cuoq
+---
+ expat/lib/xmlparse.c | 34 +++++++++-----
+ expat/lib/xmltok.c | 115 +++++++++++++++++++++++++++++++++++-------------
+ expat/lib/xmltok.h | 10 ++++-
+ expat/lib/xmltok_impl.c | 62 +++++++++++++-------------
+ 4 files changed, 146 insertions(+), 75 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index e308c79..13e080d 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -2426,11 +2426,11 @@ doContent(XML_Parser parser,
+ for (;;) {
+ int bufSize;
+ int convLen;
+- XmlConvert(enc,
++ const enum XML_Convert_Result convert_res = XmlConvert(enc,
+ &fromPtr, rawNameEnd,
+ (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1);
+ convLen = (int)(toPtr - (XML_Char *)tag->buf);
+- if (fromPtr == rawNameEnd) {
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) {
+ tag->name.strLen = convLen;
+ break;
+ }
+@@ -2651,11 +2651,11 @@ doContent(XML_Parser parser,
+ if (MUST_CONVERT(enc, s)) {
+ for (;;) {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = s;
+ charDataHandler(handlerArg, dataBuf,
+ (int)(dataPtr - (ICHAR *)dataBuf));
+- if (s == next)
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+@@ -3261,11 +3261,11 @@ doCdataSection(XML_Parser parser,
+ if (MUST_CONVERT(enc, s)) {
+ for (;;) {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = next;
+ charDataHandler(handlerArg, dataBuf,
+ (int)(dataPtr - (ICHAR *)dataBuf));
+- if (s == next)
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+@@ -5342,6 +5342,7 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+ const char *s, const char *end)
+ {
+ if (MUST_CONVERT(enc, s)) {
++ enum XML_Convert_Result convert_res;
+ const char **eventPP;
+ const char **eventEndPP;
+ if (enc == encoding) {
+@@ -5354,11 +5355,11 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+ }
+ do {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
++ convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = s;
+ defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf));
+ *eventPP = s;
+- } while (s != end);
++ } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
+ }
+ else
+ defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s));
+@@ -6163,8 +6164,8 @@ poolAppend(STRING_POOL *pool, const ENCODING *enc,
+ if (!pool->ptr && !poolGrow(pool))
+ return NULL;
+ for (;;) {
+- XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
+- if (ptr == end)
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ if (!poolGrow(pool))
+ return NULL;
+@@ -6248,8 +6249,13 @@ poolGrow(STRING_POOL *pool)
+ }
+ }
+ if (pool->blocks && pool->start == pool->blocks->s) {
+- int blockSize = (int)(pool->end - pool->start)*2;
+- BLOCK *temp = (BLOCK *)
++ BLOCK *temp;
++ int blockSize = (int)((unsigned)(pool->end - pool->start)*2U);
++
++ if (blockSize < 0)
++ return XML_FALSE;
++
++ temp = (BLOCK *)
+ pool->mem->realloc_fcn(pool->blocks,
+ (offsetof(BLOCK, s)
+ + blockSize * sizeof(XML_Char)));
+@@ -6264,6 +6270,10 @@ poolGrow(STRING_POOL *pool)
+ else {
+ BLOCK *tem;
+ int blockSize = (int)(pool->end - pool->start);
++
++ if (blockSize < 0)
++ return XML_FALSE;
++
+ if (blockSize < INIT_BLOCK_SIZE)
+ blockSize = INIT_BLOCK_SIZE;
+ else
+diff --git a/expat/lib/xmltok.c b/expat/lib/xmltok.c
+index bf09dfc..cb98ce1 100644
+--- a/expat/lib/xmltok.c
++++ b/expat/lib/xmltok.c
+@@ -318,39 +318,55 @@ enum { /* UTF8_cvalN is value of masked first byte of N byte sequence */
+ UTF8_cval4 = 0xf0
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+ {
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+ char *to;
+ const char *from;
+ if (fromLim - *fromP > toLim - *toP) {
+ /* Avoid copying partial characters. */
++ res = XML_CONVERT_OUTPUT_EXHAUSTED;
+ for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--)
+ if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
+ break;
+ }
+- for (to = *toP, from = *fromP; from != fromLim; from++, to++)
++ for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++)
+ *to = *from;
+ *fromP = from;
+ *toP = to;
++
++ if ((to == toLim) && (from < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return res;
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+ unsigned short *to = *toP;
+ const char *from = *fromP;
+- while (from != fromLim && to != toLim) {
++ while (from < fromLim && to < toLim) {
+ switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
+ case BT_LEAD2:
++ if (fromLim - from < 2) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ break;
++ }
+ *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
+ from += 2;
+ break;
+ case BT_LEAD3:
++ if (fromLim - from < 3) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ break;
++ }
+ *to++ = (unsigned short)(((from[0] & 0xf) << 12)
+ | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f));
+ from += 3;
+@@ -358,8 +374,14 @@ utf8_toUtf16(const ENCODING *enc,
+ case BT_LEAD4:
+ {
+ unsigned long n;
+- if (to + 1 == toLim)
++ if (toLim - to < 2) {
++ res = XML_CONVERT_OUTPUT_EXHAUSTED;
+ goto after;
++ }
++ if (fromLim - from < 4) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ goto after;
++ }
+ n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12)
+ | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f);
+ n -= 0x10000;
+@@ -377,6 +399,7 @@ utf8_toUtf16(const ENCODING *enc,
+ after:
+ *fromP = from;
+ *toP = to;
++ return res;
+ }
+
+ #ifdef XML_NS
+@@ -425,7 +448,7 @@ static const struct normal_encoding internal_utf8_encoding = {
+ STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_)
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+@@ -433,30 +456,35 @@ latin1_toUtf8(const ENCODING *enc,
+ for (;;) {
+ unsigned char c;
+ if (*fromP == fromLim)
+- break;
++ return XML_CONVERT_COMPLETED;
+ c = (unsigned char)**fromP;
+ if (c & 0x80) {
+ if (toLim - *toP < 2)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ *(*toP)++ = (char)((c >> 6) | UTF8_cval2);
+ *(*toP)++ = (char)((c & 0x3f) | 0x80);
+ (*fromP)++;
+ }
+ else {
+ if (*toP == toLim)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ *(*toP)++ = *(*fromP)++;
+ }
+ }
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
+- while (*fromP != fromLim && *toP != toLim)
++ while (*fromP < fromLim && *toP < toLim)
+ *(*toP)++ = (unsigned char)*(*fromP)++;
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ #ifdef XML_NS
+@@ -483,13 +511,18 @@ static const struct normal_encoding latin1_encoding = {
+ STANDARD_VTABLE(sb_)
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ ascii_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+ {
+- while (*fromP != fromLim && *toP != toLim)
++ while (*fromP < fromLim && *toP < toLim)
+ *(*toP)++ = *(*fromP)++;
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ #ifdef XML_NS
+@@ -536,13 +569,14 @@ unicode_byte_type(char hi, char lo)
+ }
+
+ #define DEFINE_UTF16_TO_UTF8(E) \
+-static void PTRCALL \
++static enum XML_Convert_Result PTRCALL \
+ E ## toUtf8(const ENCODING *enc, \
+ const char **fromP, const char *fromLim, \
+ char **toP, const char *toLim) \
+ { \
+- const char *from; \
+- for (from = *fromP; from != fromLim; from += 2) { \
++ const char *from = *fromP; \
++ fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \
++ for (; from < fromLim; from += 2) { \
+ int plane; \
+ unsigned char lo2; \
+ unsigned char lo = GET_LO(from); \
+@@ -552,7 +586,7 @@ E ## toUtf8(const ENCODING *enc, \
+ if (lo < 0x80) { \
+ if (*toP == toLim) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ *(*toP)++ = lo; \
+ break; \
+@@ -562,7 +596,7 @@ E ## toUtf8(const ENCODING *enc, \
+ case 0x4: case 0x5: case 0x6: case 0x7: \
+ if (toLim - *toP < 2) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ *(*toP)++ = ((lo >> 6) | (hi << 2) | UTF8_cval2); \
+ *(*toP)++ = ((lo & 0x3f) | 0x80); \
+@@ -570,7 +604,7 @@ E ## toUtf8(const ENCODING *enc, \
+ default: \
+ if (toLim - *toP < 3) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \
+ *(*toP)++ = ((hi >> 4) | UTF8_cval3); \
+@@ -580,7 +614,11 @@ E ## toUtf8(const ENCODING *enc, \
+ case 0xD8: case 0xD9: case 0xDA: case 0xDB: \
+ if (toLim - *toP < 4) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
++ } \
++ if (fromLim - from < 4) { \
++ *fromP = from; \
++ return XML_CONVERT_INPUT_INCOMPLETE; \
+ } \
+ plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \
+ *(*toP)++ = ((plane >> 2) | UTF8_cval4); \
+@@ -596,20 +634,32 @@ E ## toUtf8(const ENCODING *enc, \
+ } \
+ } \
+ *fromP = from; \
++ if (from < fromLim) \
++ return XML_CONVERT_INPUT_INCOMPLETE; \
++ else \
++ return XML_CONVERT_COMPLETED; \
+ }
+
+ #define DEFINE_UTF16_TO_UTF16(E) \
+-static void PTRCALL \
++static enum XML_Convert_Result PTRCALL \
+ E ## toUtf16(const ENCODING *enc, \
+ const char **fromP, const char *fromLim, \
+ unsigned short **toP, const unsigned short *toLim) \
+ { \
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \
++ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \
+ /* Avoid copying first half only of surrogate */ \
+ if (fromLim - *fromP > ((toLim - *toP) << 1) \
+- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
++ && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \
+ fromLim -= 2; \
+- for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \
++ res = XML_CONVERT_INPUT_INCOMPLETE; \
++ } \
++ for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \
+ *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
++ if ((*toP == toLim) && (*fromP < fromLim)) \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
++ else \
++ return res; \
+ }
+
+ #define SET2(ptr, ch) \
+@@ -1288,7 +1338,7 @@ unknown_isInvalid(const ENCODING *enc, const char *p)
+ return (c & ~0xFFFF) || checkCharRefNumber(c) < 0;
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+@@ -1299,21 +1349,21 @@ unknown_toUtf8(const ENCODING *enc,
+ const char *utf8;
+ int n;
+ if (*fromP == fromLim)
+- break;
++ return XML_CONVERT_COMPLETED;
+ utf8 = uenc->utf8[(unsigned char)**fromP];
+ n = *utf8++;
+ if (n == 0) {
+ int c = uenc->convert(uenc->userData, *fromP);
+ n = XmlUtf8Encode(c, buf);
+ if (n > toLim - *toP)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ utf8 = buf;
+ *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP]
+ - (BT_LEAD2 - 2));
+ }
+ else {
+ if (n > toLim - *toP)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ (*fromP)++;
+ }
+ do {
+@@ -1322,13 +1372,13 @@ unknown_toUtf8(const ENCODING *enc,
+ }
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
+ const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
+- while (*fromP != fromLim && *toP != toLim) {
++ while (*fromP < fromLim && *toP < toLim) {
+ unsigned short c = uenc->utf16[(unsigned char)**fromP];
+ if (c == 0) {
+ c = (unsigned short)
+@@ -1340,6 +1390,11 @@ unknown_toUtf16(const ENCODING *enc,
+ (*fromP)++;
+ *(*toP)++ = c;
+ }
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ ENCODING *
+@@ -1503,7 +1558,7 @@ initScan(const ENCODING * const *encodingTable,
+ {
+ const ENCODING **encPtr;
+
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ encPtr = enc->encPtr;
+ if (ptr + 1 == end) {
+diff --git a/expat/lib/xmltok.h b/expat/lib/xmltok.h
+index ca867aa..752007e 100644
+--- a/expat/lib/xmltok.h
++++ b/expat/lib/xmltok.h
+@@ -130,6 +130,12 @@ typedef int (PTRCALL *SCANNER)(const ENCODING *,
+ const char *,
+ const char **);
+
++enum XML_Convert_Result {
++ XML_CONVERT_COMPLETED = 0,
++ XML_CONVERT_INPUT_INCOMPLETE = 1,
++ XML_CONVERT_OUTPUT_EXHAUSTED = 2 /* and therefore potentially input remaining as well */
++};
++
+ struct encoding {
+ SCANNER scanners[XML_N_STATES];
+ SCANNER literalScanners[XML_N_LITERAL_TYPES];
+@@ -158,12 +164,12 @@ struct encoding {
+ const char *ptr,
+ const char *end,
+ const char **badPtr);
+- void (PTRCALL *utf8Convert)(const ENCODING *enc,
++ enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc,
+ const char **fromP,
+ const char *fromLim,
+ char **toP,
+ const char *toLim);
+- void (PTRCALL *utf16Convert)(const ENCODING *enc,
++ enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc,
+ const char **fromP,
+ const char *fromLim,
+ unsigned short **toP,
+diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c
+index 9c2895b..6c5a3ba 100644
+--- a/expat/lib/xmltok_impl.c
++++ b/expat/lib/xmltok_impl.c
+@@ -93,13 +93,13 @@ static int PTRCALL
+ PREFIX(scanComment)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_MINUS:
+@@ -147,7 +147,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_PERCNT:
+ if (ptr + MINBPC(enc) == end)
+@@ -233,7 +233,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_S: case BT_CR: case BT_LF:
+@@ -242,7 +242,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+ return XML_TOK_INVALID;
+ }
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_QUEST:
+@@ -305,7 +305,7 @@ static int PTRCALL
+ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -348,7 +348,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+ ptr += MINBPC(enc);
+ break;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: \
+@@ -391,11 +391,11 @@ PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_S: case BT_CR: case BT_LF:
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_S: case BT_CR: case BT_LF:
+ break;
+@@ -432,7 +432,7 @@ static int PTRCALL
+ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -441,7 +441,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -464,7 +464,7 @@ static int PTRCALL
+ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ if (CHAR_MATCHES(enc, ptr, ASCII_x))
+ return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
+ switch (BYTE_TYPE(enc, ptr)) {
+@@ -474,7 +474,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ break;
+@@ -506,7 +506,7 @@ PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_SEMI:
+@@ -529,7 +529,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
+ #ifdef XML_NS
+ int hadColon = 0;
+ #endif
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -716,7 +716,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+ hadColon = 0;
+ #endif
+ /* we have a start-tag */
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -740,7 +740,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+ case BT_S: case BT_CR: case BT_LF:
+ {
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
+ case BT_GT:
+@@ -785,7 +785,7 @@ static int PTRCALL
+ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -832,7 +832,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+ ptr += MINBPC(enc);
+ break;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: \
+@@ -895,7 +895,7 @@ PREFIX(scanPercent)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_SEMI:
+@@ -921,7 +921,7 @@ PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_CR: case BT_LF: case BT_S:
+@@ -941,7 +941,7 @@ PREFIX(scanLit)(int open, const ENCODING *enc,
+ const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+- while (ptr != end) {
++ while (ptr < end) {
+ int t = BYTE_TYPE(enc, ptr);
+ switch (t) {
+ INVALID_CASES(ptr, nextTokPtr)
+@@ -973,7 +973,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+ int tok;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -1141,7 +1141,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_GT: case BT_RPAR: case BT_COMMA:
+@@ -1204,10 +1204,10 @@ PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+ const char *start;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ start = ptr;
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: ptr += n; break;
+@@ -1262,10 +1262,10 @@ PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+ const char *start;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ start = ptr;
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: ptr += n; break;
+@@ -1326,7 +1326,7 @@ PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr,
+ end = ptr + n;
+ }
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_LT:
+@@ -1373,7 +1373,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
+ {
+ ptr += MINBPC(enc);
+ end -= MINBPC(enc);
+- for (; ptr != end; ptr += MINBPC(enc)) {
++ for (; ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -1760,7 +1760,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
+ case BT_CR:
+ pos->lineNumber++;
+ ptr += MINBPC(enc);
+- if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF)
++ if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF)
+ ptr += MINBPC(enc);
+ pos->columnNumber = (XML_Size)-1;
+ break;
+--
+2.8.2
+
+
Deleted: PKGBUILD
===================================================================
--- PKGBUILD 2017-07-26 07:18:09 UTC (rev 246396)
+++ PKGBUILD 2017-07-26 07:18:59 UTC (rev 246397)
@@ -1,32 +0,0 @@
-# $Id$
-# Maintainer: Felix Yan <felixonmars at archlinux.org>
-
-_pkgbasename=expat
-pkgname=lib32-${_pkgbasename}
-pkgver=2.2.0
-pkgrel=1
-pkgdesc="An XML Parser library written in C (32 bit)"
-arch=('x86_64')
-url="http://expat.sourceforge.net/"
-license=('custom')
-depends=('lib32-glibc' "${_pkgbasename}")
-source=(http://downloads.sourceforge.net/sourceforge/expat/${_pkgbasename}-${pkgver}.tar.bz2)
-md5sums=('2f47841c829facb346eb6e3fab5212e2')
-
-build() {
- cd "${srcdir}/${_pkgbasename}-${pkgver}"
- export CC='gcc -m32'
- export PKG_CONFIG_PATH=/usr/lib32/pkgconfig
- ./configure --prefix=/usr --libdir=/usr/lib32 --mandir=/usr/share/man
- make
-}
-
-package() {
- cd "${srcdir}/${_pkgbasename}-${pkgver}"
- make DESTDIR="${pkgdir}" install
- install -d -m755 "${pkgdir}/usr/share/licenses/"
- ln -s ${_pkgbasename} "${pkgdir}/usr/share/licenses/${pkgname}"
-
- # Clean up lib32 package
- rm -rf "${pkgdir}"/usr/{bin,include,share/man}
-}
Copied: lib32-expat/repos/multilib-x86_64/PKGBUILD (from rev 246396, lib32-expat/trunk/PKGBUILD)
===================================================================
--- PKGBUILD (rev 0)
+++ PKGBUILD 2017-07-26 07:18:59 UTC (rev 246397)
@@ -0,0 +1,32 @@
+# $Id$
+# Maintainer: Felix Yan <felixonmars at archlinux.org>
+
+_pkgbasename=expat
+pkgname=lib32-${_pkgbasename}
+pkgver=2.2.2
+pkgrel=1
+pkgdesc="An XML Parser library written in C (32 bit)"
+arch=('x86_64')
+url="http://expat.sourceforge.net/"
+license=('custom')
+depends=('lib32-glibc' "${_pkgbasename}")
+source=(http://downloads.sourceforge.net/sourceforge/expat/${_pkgbasename}-${pkgver}.tar.bz2)
+sha512sums=('05383244f345b1c6a7290f3bb58bfab4da9546bfe880de644e784bcc48bd4317f2beb3fdb6120a5f396e06bb269f7e80713db211346d2d17bc7de3353d556575')
+
+build() {
+ cd "${srcdir}/${_pkgbasename}-${pkgver}"
+ export CC='gcc -m32'
+ export PKG_CONFIG_PATH=/usr/lib32/pkgconfig
+ ./configure --prefix=/usr --libdir=/usr/lib32 --mandir=/usr/share/man
+ make
+}
+
+package() {
+ cd "${srcdir}/${_pkgbasename}-${pkgver}"
+ make DESTDIR="${pkgdir}" install
+ install -d -m755 "${pkgdir}/usr/share/licenses/"
+ ln -s ${_pkgbasename} "${pkgdir}/usr/share/licenses/${pkgname}"
+
+ # Clean up lib32 package
+ rm -rf "${pkgdir}"/usr/{bin,include,share/man}
+}
Deleted: cve-2012-6702-plus-cve-2016-5300-v1.patch
===================================================================
--- cve-2012-6702-plus-cve-2016-5300-v1.patch 2017-07-26 07:18:09 UTC (rev 246396)
+++ cve-2012-6702-plus-cve-2016-5300-v1.patch 2017-07-26 07:18:59 UTC (rev 246397)
@@ -1,134 +0,0 @@
-From cb31522769d11a375078a073cba94e7176cb48a4 Mon Sep 17 00:00:00 2001
-From: Sebastian Pipping <sebastian at pipping.org>
-Date: Wed, 16 Mar 2016 15:30:12 +0100
-Subject: [PATCH] Resolve call to srand, use more entropy (patch version 1.0)
-
-Squashed backport against vanilla Expat 2.1.1, addressing:
-* CVE-2012-6702 -- unanticipated internal calls to srand
-* CVE-2016-5300 -- use of too little entropy
-
-Since commit e3e81a6d9f0885ea02d3979151c358f314bf3d6d
-(released with Expat 2.1.0) Expat called srand by itself
-from inside generate_hash_secret_salt for an instance
-of XML_Parser if XML_SetHashSalt was either (a) not called
-for that instance or if (b) salt 0 was passed to XML_SetHashSalt
-prior to parsing. That call to srand passed (rather litle)
-entropy extracted from the current time as a seed for srand.
-
-That call to srand (1) broke repeatability for code calling
-srand with a non-random seed prior to parsing with Expat,
-and (2) resulted in a rather small set of hashing salts in
-Expat in total.
-
-For a short- to mid-term fix, the new approach avoids calling
-srand altogether, extracts more entropy out of the clock and
-other sources, too.
-
-For a long term fix, we may want to read sizeof(long) bytes
-from a source like getrandom(..) on Linux, and from similar
-sources on other supported architectures.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1197087
----
- expat/CMakeLists.txt | 3 +++
- expat/lib/xmlparse.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
- 2 files changed, 44 insertions(+), 7 deletions(-)
-
-diff --git a/expat/CMakeLists.txt b/expat/CMakeLists.txt
-index 353627e..524d514 100755
---- a/expat/CMakeLists.txt
-+++ b/expat/CMakeLists.txt
-@@ -41,6 +41,9 @@ include_directories(${CMAKE_BINARY_DIR} ${CMAKE_SOURCE_DIR}/lib)
- if(MSVC)
- add_definitions(-D_CRT_SECURE_NO_WARNINGS -wd4996)
- endif(MSVC)
-+if(WIN32)
-+ add_definitions(-DCOMPILED_FROM_DSP)
-+endif(WIN32)
-
- set(expat_SRCS
- lib/xmlparse.c
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index e308c79..c5f942f 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -6,7 +6,14 @@
- #include <string.h> /* memset(), memcpy() */
- #include <assert.h>
- #include <limits.h> /* UINT_MAX */
--#include <time.h> /* time() */
-+
-+#ifdef COMPILED_FROM_DSP
-+#define getpid GetCurrentProcessId
-+#else
-+#include <sys/time.h> /* gettimeofday() */
-+#include <sys/types.h> /* getpid() */
-+#include <unistd.h> /* getpid() */
-+#endif
-
- #define XML_BUILDING_EXPAT 1
-
-@@ -432,7 +439,7 @@ static ELEMENT_TYPE *
- getElementType(XML_Parser parser, const ENCODING *enc,
- const char *ptr, const char *end);
-
--static unsigned long generate_hash_secret_salt(void);
-+static unsigned long generate_hash_secret_salt(XML_Parser parser);
- static XML_Bool startParsing(XML_Parser parser);
-
- static XML_Parser
-@@ -691,11 +698,38 @@ static const XML_Char implicitContext[] = {
- };
-
- static unsigned long
--generate_hash_secret_salt(void)
-+gather_time_entropy(void)
- {
-- unsigned int seed = time(NULL) % UINT_MAX;
-- srand(seed);
-- return rand();
-+#ifdef COMPILED_FROM_DSP
-+ FILETIME ft;
-+ GetSystemTimeAsFileTime(&ft); /* never fails */
-+ return ft.dwHighDateTime ^ ft.dwLowDateTime;
-+#else
-+ struct timeval tv;
-+ int gettimeofday_res;
-+
-+ gettimeofday_res = gettimeofday(&tv, NULL);
-+ assert (gettimeofday_res == 0);
-+
-+ /* Microseconds time is <20 bits entropy */
-+ return tv.tv_usec;
-+#endif
-+}
-+
-+static unsigned long
-+generate_hash_secret_salt(XML_Parser parser)
-+{
-+ /* Process ID is 0 bits entropy if attacker has local access
-+ * XML_Parser address is few bits of entropy if attacker has local access */
-+ const unsigned long entropy =
-+ gather_time_entropy() ^ getpid() ^ (unsigned long)parser;
-+
-+ /* Factors are 2^31-1 and 2^61-1 (Mersenne primes M31 and M61) */
-+ if (sizeof(unsigned long) == 4) {
-+ return entropy * 2147483647;
-+ } else {
-+ return entropy * 2305843009213693951;
-+ }
- }
-
- static XML_Bool /* only valid for root parser */
-@@ -703,7 +737,7 @@ startParsing(XML_Parser parser)
- {
- /* hash functions must be initialized before setContext() is called */
- if (hash_secret_salt == 0)
-- hash_secret_salt = generate_hash_secret_salt();
-+ hash_secret_salt = generate_hash_secret_salt(parser);
- if (ns) {
- /* implicit context only set for root parser, since child
- parsers (i.e. external entity parsers) will inherit it
---
-2.8.2
-
Copied: lib32-expat/repos/multilib-x86_64/cve-2012-6702-plus-cve-2016-5300-v1.patch (from rev 246396, lib32-expat/trunk/cve-2012-6702-plus-cve-2016-5300-v1.patch)
===================================================================
--- cve-2012-6702-plus-cve-2016-5300-v1.patch (rev 0)
+++ cve-2012-6702-plus-cve-2016-5300-v1.patch 2017-07-26 07:18:59 UTC (rev 246397)
@@ -0,0 +1,134 @@
+From cb31522769d11a375078a073cba94e7176cb48a4 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian at pipping.org>
+Date: Wed, 16 Mar 2016 15:30:12 +0100
+Subject: [PATCH] Resolve call to srand, use more entropy (patch version 1.0)
+
+Squashed backport against vanilla Expat 2.1.1, addressing:
+* CVE-2012-6702 -- unanticipated internal calls to srand
+* CVE-2016-5300 -- use of too little entropy
+
+Since commit e3e81a6d9f0885ea02d3979151c358f314bf3d6d
+(released with Expat 2.1.0) Expat called srand by itself
+from inside generate_hash_secret_salt for an instance
+of XML_Parser if XML_SetHashSalt was either (a) not called
+for that instance or if (b) salt 0 was passed to XML_SetHashSalt
+prior to parsing. That call to srand passed (rather litle)
+entropy extracted from the current time as a seed for srand.
+
+That call to srand (1) broke repeatability for code calling
+srand with a non-random seed prior to parsing with Expat,
+and (2) resulted in a rather small set of hashing salts in
+Expat in total.
+
+For a short- to mid-term fix, the new approach avoids calling
+srand altogether, extracts more entropy out of the clock and
+other sources, too.
+
+For a long term fix, we may want to read sizeof(long) bytes
+from a source like getrandom(..) on Linux, and from similar
+sources on other supported architectures.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1197087
+---
+ expat/CMakeLists.txt | 3 +++
+ expat/lib/xmlparse.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
+ 2 files changed, 44 insertions(+), 7 deletions(-)
+
+diff --git a/expat/CMakeLists.txt b/expat/CMakeLists.txt
+index 353627e..524d514 100755
+--- a/expat/CMakeLists.txt
++++ b/expat/CMakeLists.txt
+@@ -41,6 +41,9 @@ include_directories(${CMAKE_BINARY_DIR} ${CMAKE_SOURCE_DIR}/lib)
+ if(MSVC)
+ add_definitions(-D_CRT_SECURE_NO_WARNINGS -wd4996)
+ endif(MSVC)
++if(WIN32)
++ add_definitions(-DCOMPILED_FROM_DSP)
++endif(WIN32)
+
+ set(expat_SRCS
+ lib/xmlparse.c
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index e308c79..c5f942f 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -6,7 +6,14 @@
+ #include <string.h> /* memset(), memcpy() */
+ #include <assert.h>
+ #include <limits.h> /* UINT_MAX */
+-#include <time.h> /* time() */
++
++#ifdef COMPILED_FROM_DSP
++#define getpid GetCurrentProcessId
++#else
++#include <sys/time.h> /* gettimeofday() */
++#include <sys/types.h> /* getpid() */
++#include <unistd.h> /* getpid() */
++#endif
+
+ #define XML_BUILDING_EXPAT 1
+
+@@ -432,7 +439,7 @@ static ELEMENT_TYPE *
+ getElementType(XML_Parser parser, const ENCODING *enc,
+ const char *ptr, const char *end);
+
+-static unsigned long generate_hash_secret_salt(void);
++static unsigned long generate_hash_secret_salt(XML_Parser parser);
+ static XML_Bool startParsing(XML_Parser parser);
+
+ static XML_Parser
+@@ -691,11 +698,38 @@ static const XML_Char implicitContext[] = {
+ };
+
+ static unsigned long
+-generate_hash_secret_salt(void)
++gather_time_entropy(void)
+ {
+- unsigned int seed = time(NULL) % UINT_MAX;
+- srand(seed);
+- return rand();
++#ifdef COMPILED_FROM_DSP
++ FILETIME ft;
++ GetSystemTimeAsFileTime(&ft); /* never fails */
++ return ft.dwHighDateTime ^ ft.dwLowDateTime;
++#else
++ struct timeval tv;
++ int gettimeofday_res;
++
++ gettimeofday_res = gettimeofday(&tv, NULL);
++ assert (gettimeofday_res == 0);
++
++ /* Microseconds time is <20 bits entropy */
++ return tv.tv_usec;
++#endif
++}
++
++static unsigned long
++generate_hash_secret_salt(XML_Parser parser)
++{
++ /* Process ID is 0 bits entropy if attacker has local access
++ * XML_Parser address is few bits of entropy if attacker has local access */
++ const unsigned long entropy =
++ gather_time_entropy() ^ getpid() ^ (unsigned long)parser;
++
++ /* Factors are 2^31-1 and 2^61-1 (Mersenne primes M31 and M61) */
++ if (sizeof(unsigned long) == 4) {
++ return entropy * 2147483647;
++ } else {
++ return entropy * 2305843009213693951;
++ }
+ }
+
+ static XML_Bool /* only valid for root parser */
+@@ -703,7 +737,7 @@ startParsing(XML_Parser parser)
+ {
+ /* hash functions must be initialized before setContext() is called */
+ if (hash_secret_salt == 0)
+- hash_secret_salt = generate_hash_secret_salt();
++ hash_secret_salt = generate_hash_secret_salt(parser);
+ if (ns) {
+ /* implicit context only set for root parser, since child
+ parsers (i.e. external entity parsers) will inherit it
+--
+2.8.2
+
More information about the arch-commits
mailing list