Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package libcroco for openSUSE:Factory
checked in at 2021-08-24 10:53:57
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libcroco (Old)
and /work/SRC/openSUSE:Factory/.libcroco.new.1899 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libcroco"
Tue Aug 24 10:53:57 2021 rev:39 rq:913179 version:0.6.13
Changes:
--------
--- /work/SRC/openSUSE:Factory/libcroco/libcroco.changes 2019-05-09
10:02:42.347876300 +0200
+++ /work/SRC/openSUSE:Factory/.libcroco.new.1899/libcroco.changes
2021-08-24 10:54:18.496365813 +0200
@@ -1,0 +2,6 @@
+Mon Aug 16 20:14:14 UTC 2021 - Michael Gorse <mgo...@suse.com>
+
+- Add libcroco-CVE-2020-12825.patch: limit recursion in block and
+ any productions (boo#1171685 CVE-2020-12825).
+
+-------------------------------------------------------------------
New:
----
libcroco-CVE-2020-12825.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ libcroco.spec ++++++
--- /var/tmp/diff_new_pack.F8AYgy/_old 2021-08-24 10:54:18.984365167 +0200
+++ /var/tmp/diff_new_pack.F8AYgy/_new 2021-08-24 10:54:18.988365162 +0200
@@ -1,7 +1,7 @@
#
# spec file for package libcroco
#
-# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2021 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -28,6 +28,8 @@
# PATCH-FIX-UPSTREAM libcroco-CVE-2017-8834.patch boo#1043898 boo#1043899
mgo...@suse.com -- fix infinite loop on invalid UTF-8.
Patch0: libcroco-CVE-2017-8834.patch
+# PATCH-FIX-UPSTREAM libcroco-CVE-2020-12825.patch boo#1171685 mgo...@suse.com
-- limit recursion in block and any productions.
+Patch1: libcroco-CVE-2020-12825.patch
BuildRequires: pkgconfig
BuildRequires: pkgconfig(glib-2.0) >= 2.0
BuildRequires: pkgconfig(libxml-2.0) >= 2.4.23
++++++ libcroco-CVE-2020-12825.patch ++++++
>From 6eb257e5c731c691eb137fca94e916ca73941a5a Mon Sep 17 00:00:00 2001
From: Michael Catanzaro <mcatanz...@gnome.org>
Date: Fri, 31 Jul 2020 15:21:53 -0500
Subject: [PATCH] parser: limit recursion in block and any productions
If we don't have any limits, we can recurse forever and overflow the
stack.
Fixes #8
---
src/cr-parser.c | 44 +++++++++++++++++++++++++++++---------------
1 file changed, 29 insertions(+), 15 deletions(-)
diff --git a/src/cr-parser.c b/src/cr-parser.c
index 18c9a01..f4a62e3 100644
--- a/src/cr-parser.c
+++ b/src/cr-parser.c
@@ -136,6 +136,8 @@ struct _CRParserPriv {
#define CHARS_TAB_SIZE 12
+#define RECURSIVE_CALLERS_LIMIT 100
+
/**
* IS_NUM:
*@a_char: the char to test.
@@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core
(CRParser * a_this);
static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this);
-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this);
+static enum CRStatus cr_parser_parse_any_core (CRParser * a_this,
+ guint n_calls);
-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this);
+static enum CRStatus cr_parser_parse_block_core (CRParser * a_this,
+ guint n_calls);
static enum CRStatus cr_parser_parse_value_core (CRParser * a_this);
@@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
cr_parser_try_to_skip_spaces_and_comments (a_this);
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
} while (status == CR_OK);
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr,
@@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
token);
token = NULL;
- status = cr_parser_parse_block_core (a_this);
+ status = cr_parser_parse_block_core (a_this, 0);
CHECK_PARSING_STATUS (status,
FALSE);
goto done;
@@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this)
RECORD_INITIAL_POS (a_this, &init_pos);
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
CHECK_PARSING_STATUS (status, FALSE);
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
} while (status == CR_OK);
@@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this)
*in chapter 4.1 of the css2 spec.
*block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*;
*@param a_this the current instance of #CRParser.
+ *@param n_calls used to limit recursion depth
*FIXME: code this function.
*/
static enum CRStatus
-cr_parser_parse_block_core (CRParser * a_this)
+cr_parser_parse_block_core (CRParser * a_this,
+ guint n_calls)
{
CRToken *token = NULL;
CRInputPos init_pos;
@@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this)
g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR);
+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
+ return CR_ERROR;
+
RECORD_INITIAL_POS (a_this, &init_pos);
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token);
@@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this)
} else if (token->type == CBO_TK) {
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
token = NULL;
- status = cr_parser_parse_block_core (a_this);
+ status = cr_parser_parse_block_core (a_this, n_calls + 1);
CHECK_PARSING_STATUS (status, FALSE);
goto parse_block_content;
} else {
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
token = NULL;
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
CHECK_PARSING_STATUS (status, FALSE);
goto parse_block_content;
}
@@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this)
status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
token);
token = NULL;
- status = cr_parser_parse_block_core (a_this);
+ status = cr_parser_parse_block_core (a_this, 0);
CHECK_PARSING_STATUS (status, FALSE);
ref++;
goto continue_parsing;
@@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this)
status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
token);
token = NULL;
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, 0);
if (status == CR_OK) {
ref++;
goto continue_parsing;
@@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this)
* | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*;
*
*@param a_this the current instance of #CRParser.
+ *@param n_calls used to limit recursion depth
*@return CR_OK upon successfull completion, an error code otherwise.
*/
static enum CRStatus
-cr_parser_parse_any_core (CRParser * a_this)
+cr_parser_parse_any_core (CRParser * a_this,
+ guint n_calls)
{
CRToken *token1 = NULL,
*token2 = NULL;
@@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this)
g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR);
+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
+ return CR_ERROR;
+
RECORD_INITIAL_POS (a_this, &init_pos);
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1);
@@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this)
*We consider parameter as being an "any*" production.
*/
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls +
1);
} while (status == CR_OK);
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
@@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this)
}
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls +
1);
} while (status == CR_OK);
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
@@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this)
}
do {
- status = cr_parser_parse_any_core (a_this);
+ status = cr_parser_parse_any_core (a_this, n_calls +
1);
} while (status == CR_OK);
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
--
GitLab
