[arch-commits] Commit in libxml2/trunk (4 files)

Jan de Groot jgc at archlinux.org
Wed Nov 11 14:39:06 UTC 2020


    Date: Wednesday, November 11, 2020 @ 14:39:06
  Author: jgc
Revision: 400371

Use correct patch for CVE-2020-24977

Added:
  libxml2/trunk/libxml2-2.9.10-CVE-2020-24977.patch
  libxml2/trunk/libxml2-2.9.10-fix-integer-overflow.patch
    (from rev 400370, libxml2/trunk/libxml2-2.9.10-CVE-2020-24977.patch)
Modified:
  libxml2/trunk/PKGBUILD
Deleted:
  libxml2/trunk/libxml2-2.9.10-CVE-2020-24977.patch

-------------------------------------------+
 PKGBUILD                                  |    5 +
 libxml2-2.9.10-CVE-2020-24977.patch       |   77 +++++++++++++---------------
 libxml2-2.9.10-fix-integer-overflow.patch |   41 ++++++++++++++
 3 files changed, 81 insertions(+), 42 deletions(-)

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2020-11-11 14:08:10 UTC (rev 400370)
+++ PKGBUILD	2020-11-11 14:39:06 UTC (rev 400371)
@@ -5,7 +5,7 @@
 
 pkgname=libxml2
 pkgver=2.9.10
-pkgrel=5
+pkgrel=6
 pkgdesc='XML parsing library, version 2'
 url='http://www.xmlsoft.org/'
 arch=(x86_64)
@@ -20,6 +20,7 @@
         libxml2-2.9.10-CVE-2020-7595.patch
         libxml2-2.9.10-parenthesize-type-checks.patch
         libxml2-2.9.10-CVE-2020-24977.patch
+        libxml2-2.9.10-fix-integer-overflow.patch
         https://www.w3.org/XML/Test/xmlts20130923.tar.gz)
 sha256sums=('SKIP'
             '37eb81a8ec6929eed1514e891bff2dd05b450bcf0c712153880c485b7366c17c'
@@ -27,6 +28,7 @@
             'cfe1b3e0f026df6f979dbd77c1dcd1268e60acf3d7a8ff3f480b4e67bfcc19d6'
             'c6105ff40d7b1b140fcd821b5d64ab8c7b596708071c26964727e7352b07ac7e'
             'b63c161e4c8a6f0a65ba091c3d3ed09d3110d21f997ee61077c782b311fd4b33'
+            '62eafffc2b4949489c261c63883d27c2e83d688f1d4c899000b283e4c2a682be'
             'fd227780ad5699bebca7ef412d2d50fb1d21a54f6e3fdcad0bda5bdc8f8b2525'
             '9b61db9f5dbffa545f4b8d78422167083a8568c59bd1129f94138f936cf6fc1f')
 
@@ -46,6 +48,7 @@
   patch -Np1 -i ../libxml2-2.9.10-CVE-2020-7595.patch
   patch -Np1 -i ../libxml2-2.9.10-parenthesize-type-checks.patch
   patch -Np1 -i ../libxml2-2.9.10-CVE-2020-24977.patch
+  patch -Np1 -i ../libxml2-2.9.10-fix-integer-overflow.patch
 
   NOCONFIGURE=1 ./autogen.sh
 }

Deleted: libxml2-2.9.10-CVE-2020-24977.patch
===================================================================
--- libxml2-2.9.10-CVE-2020-24977.patch	2020-11-11 14:08:10 UTC (rev 400370)
+++ libxml2-2.9.10-CVE-2020-24977.patch	2020-11-11 14:39:06 UTC (rev 400371)
@@ -1,41 +0,0 @@
-From 8e7c20a1af8776677d7890f30b7a180567701a49 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer at aevum.de>
-Date: Mon, 3 Aug 2020 17:30:41 +0200
-Subject: [PATCH] Fix integer overflow when comparing schema dates
-
-Found by OSS-Fuzz.
----
- xmlschemastypes.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/xmlschemastypes.c b/xmlschemastypes.c
-index 4249d700..d6b9f924 100644
---- a/xmlschemastypes.c
-+++ b/xmlschemastypes.c
-@@ -3691,6 +3691,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
- 	minday = 0;
- 	maxday = 0;
-     } else {
-+        if (myear > LONG_MAX / 366)
-+            return -2;
-         /* FIXME: This doesn't take leap year exceptions every 100/400 years
-            into account. */
- 	maxday = 365 * myear + (myear + 3) / 4;
-@@ -4079,6 +4081,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
-     if ((x == NULL) || (y == NULL))
-         return -2;
- 
-+    if ((x->value.date.year > LONG_MAX / 366) ||
-+        (x->value.date.year < LONG_MIN / 366) ||
-+        (y->value.date.year > LONG_MAX / 366) ||
-+        (y->value.date.year < LONG_MIN / 366)) {
-+        /* Possible overflow when converting to days. */
-+        return -2;
-+    }
-+
-     if (x->value.date.tz_flag) {
- 
-         if (!y->value.date.tz_flag) {
--- 
-2.28.0.rc2
-

Added: libxml2-2.9.10-CVE-2020-24977.patch
===================================================================
--- libxml2-2.9.10-CVE-2020-24977.patch	                        (rev 0)
+++ libxml2-2.9.10-CVE-2020-24977.patch	2020-11-11 14:39:06 UTC (rev 400371)
@@ -0,0 +1,36 @@
+From 50f06b3efb638efb0abd95dc62dca05ae67882c2 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer at aevum.de>
+Date: Fri, 7 Aug 2020 21:54:27 +0200
+Subject: [PATCH] Fix out-of-bounds read with 'xmllint --htmlout'
+
+Make sure that truncated UTF-8 sequences don't cause an out-of-bounds
+array access.
+
+Thanks to @SuhwanSong and the Agency for Defense Development (ADD) for
+the report.
+
+Fixes #178.
+---
+ xmllint.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/xmllint.c b/xmllint.c
+index f6a8e463..c647486f 100644
+--- a/xmllint.c
++++ b/xmllint.c
+@@ -528,6 +528,12 @@ static void
+ xmlHTMLEncodeSend(void) {
+     char *result;
+ 
++    /*
++     * xmlEncodeEntitiesReentrant assumes valid UTF-8, but the buffer might
++     * end with a truncated UTF-8 sequence. This is a hack to at least avoid
++     * an out-of-bounds read.
++     */
++    memset(&buffer[sizeof(buffer)-4], 0, 4);
+     result = (char *) xmlEncodeEntitiesReentrant(NULL, BAD_CAST buffer);
+     if (result) {
+ 	xmlGenericError(xmlGenericErrorContext, "%s", result);
+-- 
+2.28.0.rc2
+

Copied: libxml2/trunk/libxml2-2.9.10-fix-integer-overflow.patch (from rev 400370, libxml2/trunk/libxml2-2.9.10-CVE-2020-24977.patch)
===================================================================
--- libxml2-2.9.10-fix-integer-overflow.patch	                        (rev 0)
+++ libxml2-2.9.10-fix-integer-overflow.patch	2020-11-11 14:39:06 UTC (rev 400371)
@@ -0,0 +1,41 @@
+From 8e7c20a1af8776677d7890f30b7a180567701a49 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer at aevum.de>
+Date: Mon, 3 Aug 2020 17:30:41 +0200
+Subject: [PATCH] Fix integer overflow when comparing schema dates
+
+Found by OSS-Fuzz.
+---
+ xmlschemastypes.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/xmlschemastypes.c b/xmlschemastypes.c
+index 4249d700..d6b9f924 100644
+--- a/xmlschemastypes.c
++++ b/xmlschemastypes.c
+@@ -3691,6 +3691,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
+ 	minday = 0;
+ 	maxday = 0;
+     } else {
++        if (myear > LONG_MAX / 366)
++            return -2;
+         /* FIXME: This doesn't take leap year exceptions every 100/400 years
+            into account. */
+ 	maxday = 365 * myear + (myear + 3) / 4;
+@@ -4079,6 +4081,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
+     if ((x == NULL) || (y == NULL))
+         return -2;
+ 
++    if ((x->value.date.year > LONG_MAX / 366) ||
++        (x->value.date.year < LONG_MIN / 366) ||
++        (y->value.date.year > LONG_MAX / 366) ||
++        (y->value.date.year < LONG_MIN / 366)) {
++        /* Possible overflow when converting to days. */
++        return -2;
++    }
++
+     if (x->value.date.tz_flag) {
+ 
+         if (!y->value.date.tz_flag) {
+-- 
+2.28.0.rc2
+


More information about the arch-commits mailing list