Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=b82ec796b7e29035300bfb576958817c5a3e75ce
commit b82ec796b7e29035300bfb576958817c5a3e75ce Author: kikadf <[email protected]> Date: Fri May 16 07:58:31 2014 +0200 libxml2-2.8.0-2arcturus1-x86_64 * Fix CVE-2012-5134, CVE-2013-0339, CVE-2013-2877, CVE-2014-0191 diff --git a/source/base/libxml2/CVE-2012-5134.patch b/source/base/libxml2/CVE-2012-5134.patch new file mode 100644 index 0000000..3ac7f49 --- /dev/null +++ b/source/base/libxml2/CVE-2012-5134.patch @@ -0,0 +1,22 @@ +From 6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <[email protected]> +Date: Mon, 29 Oct 2012 02:39:55 +0000 +Subject: Fix potential out of bound access + +http://git.gnome.org/browse/libxml2/patch/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d +http://git.gnome.org/browse/libxml2/commit/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d + +--- +Index: libxml2-2.8.0+dfsg1/parser.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parser.c 2012-12-04 09:40:39.000000000 -0800 ++++ libxml2-2.8.0+dfsg1/parser.c 2012-12-04 10:59:28.000000000 -0800 +@@ -3932,7 +3932,7 @@ + c = CUR_CHAR(l); + } + if ((in_space) && (normalize)) { +- while (buf[len - 1] == 0x20) len--; ++ while ((len > 0) && (buf[len - 1] == 0x20)) len--; + } + buf[len] = 0; + if (RAW == '<') { diff --git a/source/base/libxml2/CVE-2013-0338.patch b/source/base/libxml2/CVE-2013-0338.patch new file mode 100644 index 0000000..fe2c07b --- /dev/null +++ b/source/base/libxml2/CVE-2013-0338.patch @@ -0,0 +1,148 @@ +From 23f05e0c33987d6605387b300c4be5da2120a7ab Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <[email protected]> +Date: Tue, 19 Feb 2013 02:21:49 +0000 +Subject: Detect excessive entities expansion upon replacement + +If entities expansion in the XML parser is asked for, +it is possble to craft relatively small input document leading +to excessive on-the-fly content generation. +This patch accounts for those replacement and stop parsing +after a given threshold. it can be bypassed as usual with the +HUGE parser option. +--- +Index: libxml2-2.8.0+dfsg1/include/libxml/parser.h +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/include/libxml/parser.h 2013-03-26 10:07:15.885090823 -0400 ++++ libxml2-2.8.0+dfsg1/include/libxml/parser.h 2013-03-26 10:07:15.873090823 -0400 +@@ -310,6 +310,7 @@ + xmlParserNodeInfo *nodeInfoTab; /* array of nodeInfos */ + + int input_id; /* we need to label inputs */ ++ unsigned long sizeentcopy; /* volume of entity copy */ + }; + + /** +Index: libxml2-2.8.0+dfsg1/parser.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parser.c 2013-03-26 10:07:15.885090823 -0400 ++++ libxml2-2.8.0+dfsg1/parser.c 2013-03-26 10:07:15.877090823 -0400 +@@ -119,7 +119,7 @@ + */ + static int + xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, +- xmlEntityPtr ent) ++ xmlEntityPtr ent, size_t replacement) + { + size_t consumed = 0; + +@@ -127,7 +127,24 @@ + return (0); + if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) + return (1); +- if (size != 0) { ++ if (replacement != 0) { ++ if (replacement < XML_MAX_TEXT_LENGTH) ++ return(0); ++ ++ /* ++ * If the volume of entity copy reaches 10 times the ++ * amount of parsed data and over the large text threshold ++ * then that's very likely to be an abuse. ++ */ ++ if (ctxt->input != NULL) { ++ consumed = ctxt->input->consumed + ++ (ctxt->input->cur - ctxt->input->base); ++ } ++ consumed += ctxt->sizeentities; ++ ++ if (replacement < XML_PARSER_NON_LINEAR * consumed) ++ return(0); ++ } else if (size != 0) { + /* + * Do the check based on the replacement size of the entity + */ +@@ -173,7 +190,6 @@ + */ + return (0); + } +- + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); + return (1); + } +@@ -2706,7 +2722,7 @@ + while (*current != 0) { /* non input consuming loop */ + buffer[nbchars++] = *current++; + if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) { +- if (xmlParserEntityCheck(ctxt, nbchars, ent)) ++ if (xmlParserEntityCheck(ctxt, nbchars, ent, 0)) + goto int_error; + growBuffer(buffer, XML_PARSER_BUFFER_SIZE); + } +@@ -2748,7 +2764,7 @@ + while (*current != 0) { /* non input consuming loop */ + buffer[nbchars++] = *current++; + if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) { +- if (xmlParserEntityCheck(ctxt, nbchars, ent)) ++ if (xmlParserEntityCheck(ctxt, nbchars, ent, 0)) + goto int_error; + growBuffer(buffer, XML_PARSER_BUFFER_SIZE); + } +@@ -6976,7 +6992,7 @@ + xmlFreeNodeList(list); + return; + } +- if (xmlParserEntityCheck(ctxt, 0, ent)) { ++ if (xmlParserEntityCheck(ctxt, 0, ent, 0)) { + xmlFreeNodeList(list); + return; + } +@@ -7136,6 +7152,13 @@ + xmlNodePtr nw = NULL, cur, firstChild = NULL; + + /* ++ * We are copying here, make sure there is no abuse ++ */ ++ ctxt->sizeentcopy += ent->length; ++ if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy)) ++ return; ++ ++ /* + * when operating on a reader, the entities definitions + * are always owning the entities subtree. + if (ctxt->parseMode == XML_PARSE_READER) +@@ -7175,6 +7198,14 @@ + } else if (list == NULL) { + xmlNodePtr nw = NULL, cur, next, last, + firstChild = NULL; ++ ++ /* ++ * We are copying here, make sure there is no abuse ++ */ ++ ctxt->sizeentcopy += ent->length; ++ if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy)) ++ return; ++ + /* + * Copy the entity child list and make it the new + * entity child list. The goal is to make sure any +@@ -14355,6 +14386,7 @@ + ctxt->catalogs = NULL; + ctxt->nbentities = 0; + ctxt->sizeentities = 0; ++ ctxt->sizeentcopy = 0; + xmlInitNodeInfoSeq(&ctxt->node_seq); + + if (ctxt->attsDefault != NULL) { +Index: libxml2-2.8.0+dfsg1/parserInternals.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parserInternals.c 2013-03-26 10:07:15.885090823 -0400 ++++ libxml2-2.8.0+dfsg1/parserInternals.c 2013-03-26 10:07:15.877090823 -0400 +@@ -1761,6 +1761,8 @@ + ctxt->charset = XML_CHAR_ENCODING_UTF8; + ctxt->catalogs = NULL; + ctxt->nbentities = 0; ++ ctxt->sizeentities = 0; ++ ctxt->sizeentcopy = 0; + ctxt->input_id = 1; + xmlInitNodeInfoSeq(&ctxt->node_seq); + return(0); diff --git a/source/base/libxml2/CVE-2013-0339.patch b/source/base/libxml2/CVE-2013-0339.patch new file mode 100644 index 0000000..e0d1378 --- /dev/null +++ b/source/base/libxml2/CVE-2013-0339.patch @@ -0,0 +1,53 @@ +From 4629ee02ac649c27f9c0cf98ba017c6b5526070f Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <[email protected]> +Date: Mon, 23 Jul 2012 06:15:40 +0000 +Subject: Do not fetch external parsed entities + +Unless explicietely asked for when validating or replacing entities +with their value. Problem pointed out by Tom Lane <[email protected]> + +* parser.c: do not load external parsed entities unless needed +* test/errors/extparsedent.xml result/errors/extparsedent.xml*: + add a regression test to avoid change of the behaviour in the future +--- +Index: libxml2-2.8.0+dfsg1/parser.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parser.c 2013-07-11 14:29:47.656521477 -0400 ++++ libxml2-2.8.0+dfsg1/parser.c 2013-07-11 14:29:47.652521477 -0400 +@@ -6943,8 +6943,15 @@ + * The first reference to the entity trigger a parsing phase + * where the ent->children is filled with the result from + * the parsing. ++ * Note: external parsed entities will not be loaded, it is not ++ * required for a non-validating parser, unless the parsing option ++ * of validating, or substituting entities were given. Doing so is ++ * far more secure as the parser will only process data coming from ++ * the document entity by default. + */ +- if (ent->checked == 0) { ++ if ((ent->checked == 0) && ++ ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) || ++ (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) { + unsigned long oldnbent = ctxt->nbentities; + + /* +Index: libxml2-2.8.0+dfsg1/result/errors/extparsedent.xml +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ libxml2-2.8.0+dfsg1/result/errors/extparsedent.xml 2013-07-11 14:29:47.652521477 -0400 +@@ -0,0 +1,5 @@ ++<?xml version="1.0"?> ++<!DOCTYPE foo [ ++<!ENTITY c PUBLIC "bar" "/etc/doesnotexist"> ++]> ++<root>&c;</root> +Index: libxml2-2.8.0+dfsg1/test/errors/extparsedent.xml +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ libxml2-2.8.0+dfsg1/test/errors/extparsedent.xml 2013-07-11 14:29:47.652521477 -0400 +@@ -0,0 +1,5 @@ ++<?xml version="1.0"?> ++<!DOCTYPE foo [ ++<!ENTITY c PUBLIC "bar" "/etc/doesnotexist"> ++]> ++<root>&c;</root> diff --git a/source/base/libxml2/CVE-2013-2877.patch b/source/base/libxml2/CVE-2013-2877.patch new file mode 100644 index 0000000..e5c57a9 --- /dev/null +++ b/source/base/libxml2/CVE-2013-2877.patch @@ -0,0 +1,754 @@ +Description: fix denial of service via incomplete document +Origin: backport, https://git.gnome.org/browse/libxml2/commit/?id=48b4cdde3483e054af8ea02e0cd7ee467b0e9a50 +Origin: backport, https://git.gnome.org/browse/libxml2/commit/?id=e50ba8164eee06461c73cd8abb9b46aa0be81869 +Origin: backport, https://git.gnome.org/browse/libxml2/commit/?id=9ca816b3a64e7b1bada7baa2cbc09e8937b38215 + +Index: libxml2-2.8.0+dfsg1/include/libxml/xmlerror.h +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/include/libxml/xmlerror.h 2009-07-30 11:24:34.000000000 -0400 ++++ libxml2-2.8.0+dfsg1/include/libxml/xmlerror.h 2013-07-16 13:37:43.000000000 -0400 +@@ -205,6 +205,7 @@ + XML_WAR_ENTITY_REDEFINED, /* 107 */ + XML_ERR_UNKNOWN_VERSION, /* 108 */ + XML_ERR_VERSION_MISMATCH, /* 109 */ ++ XML_ERR_USER_STOP, /* 111 */ + XML_NS_ERR_XML_NAMESPACE = 200, + XML_NS_ERR_UNDEFINED_NAMESPACE, /* 201 */ + XML_NS_ERR_QNAME, /* 202 */ +Index: libxml2-2.8.0+dfsg1/parser.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parser.c 2013-07-16 13:37:43.000000000 -0400 ++++ libxml2-2.8.0+dfsg1/parser.c 2013-07-16 13:53:38.892991209 -0400 +@@ -2161,6 +2161,8 @@ + "Pushing input %d : %.30s\n", ctxt->inputNr+1, input->cur); + } + ret = inputPush(ctxt, input); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); + GROW; + return(ret); + } +@@ -2197,6 +2199,8 @@ + if (count++ > 20) { + count = 0; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(0); + } + if ((RAW >= '0') && (RAW <= '9')) + val = val * 16 + (CUR - '0'); +@@ -2228,6 +2232,8 @@ + if (count++ > 20) { + count = 0; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(0); + } + if ((RAW >= '0') && (RAW <= '9')) + val = val * 10 + (CUR - '0'); +@@ -2514,6 +2520,8 @@ + NEXT; + if ((ctxt->sax != NULL) && (ctxt->sax->getParameterEntity != NULL)) + entity = ctxt->sax->getParameterEntity(ctxt->userData, name); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + if (entity == NULL) { + + /* +@@ -2576,6 +2584,8 @@ + * the amount of data in the buffer. + */ + GROW ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + if ((ctxt->input->end - ctxt->input->cur)>=4) { + start[0] = RAW; + start[1] = NXT(1); +@@ -3194,6 +3204,8 @@ + * Handler for more complex cases + */ + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + c = CUR_CHAR(l); + if ((ctxt->options & XML_PARSE_OLD10) == 0) { + /* +@@ -3245,6 +3257,8 @@ + if (count++ > 100) { + count = 0; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + } + len += l; + NEXTL(l); +@@ -3269,6 +3283,8 @@ + if (count++ > 100) { + count = 0; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + } + len += l; + NEXTL(l); +@@ -3362,6 +3378,8 @@ + if (count++ > 100) { + count = 0; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + } + len += l; + NEXTL(l); +@@ -3442,6 +3460,8 @@ + const xmlChar *ret; + + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + + in = ctxt->input->cur; + while (*in != 0 && *in == *cmp) { +@@ -3569,6 +3589,8 @@ + #endif + + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + c = CUR_CHAR(l); + + while (xmlIsNameChar(ctxt, c)) { +@@ -3597,6 +3619,10 @@ + if (count++ > 100) { + count = 0; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buffer); ++ return(NULL); ++ } + } + if (len + 10 > max) { + xmlChar *tmp; +@@ -3667,6 +3693,10 @@ + ctxt->instate = XML_PARSER_ENTITY_VALUE; + input = ctxt->input; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return(NULL); ++ } + NEXT; + c = CUR_CHAR(l); + /* +@@ -3678,8 +3708,8 @@ + * In practice it means we stop the loop only when back at parsing + * the initial entity and the quote is found + */ +- while ((IS_CHAR(c)) && ((c != stop) || /* checked */ +- (ctxt->input != input))) { ++ while (((IS_CHAR(c)) && ((c != stop) || /* checked */ ++ (ctxt->input != input))) && (ctxt->instate != XML_PARSER_EOF)) { + if (len + 5 >= size) { + xmlChar *tmp; + +@@ -3708,6 +3738,10 @@ + } + } + buf[len] = 0; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return(NULL); ++ } + + /* + * Raise problem w.r.t. '&' and '%' being used in non-entities +@@ -3755,12 +3789,12 @@ + */ + ret = xmlStringDecodeEntities(ctxt, buf, XML_SUBSTITUTE_PEREF, + 0, 0, 0); +- if (orig != NULL) ++ if (orig != NULL) + *orig = buf; + else + xmlFree(buf); + } +- ++ + return(ret); + } + +@@ -3811,8 +3845,9 @@ + * OK loop until we reach one of the ending char or a size limit. + */ + c = CUR_CHAR(l); +- while ((NXT(0) != limit) && /* checked */ +- (IS_CHAR(c)) && (c != '<')) { ++ while (((NXT(0) != limit) && /* checked */ ++ (IS_CHAR(c)) && (c != '<')) && ++ (ctxt->instate != XML_PARSER_EOF)) { + if (c == 0) break; + if (c == '&') { + in_space = 0; +@@ -3947,6 +3982,9 @@ + GROW; + c = CUR_CHAR(l); + } ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto error; ++ + if ((in_space) && (normalize)) { + while ((len > 0) && (buf[len - 1] == 0x20)) len--; + } +@@ -3979,6 +4017,7 @@ + + mem_error: + xmlErrMemory(ctxt, NULL); ++error: + if (buf != NULL) + xmlFree(buf); + if (rep != NULL) +@@ -4084,6 +4123,10 @@ + if (count > 50) { + GROW; + count = 0; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return(NULL); ++ } + } + COPY_BUF(l,buf,len,cur); + NEXTL(l); +@@ -4161,6 +4204,10 @@ + if (count > 50) { + GROW; + count = 0; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return(NULL); ++ } + } + NEXT; + cur = CUR; +@@ -4367,6 +4414,8 @@ + } + SHRINK; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + in = ctxt->input->cur; + } while (((*in >= 0x20) && (*in <= 0x7F)) || (*in == 0x09)); + nbchar = 0; +@@ -4435,6 +4484,8 @@ + if (count > 50) { + GROW; + count = 0; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + } + NEXTL(l); + cur = CUR_CHAR(l); +@@ -4635,6 +4686,10 @@ + if (count > 50) { + GROW; + count = 0; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return; ++ } + } + NEXTL(l); + cur = CUR_CHAR(l); +@@ -4785,6 +4840,10 @@ + } + SHRINK; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return; ++ } + in = ctxt->input->cur; + if (*in == '-') { + if (in[1] == '-') { +@@ -4803,7 +4862,8 @@ + } + if (buf != NULL) + xmlFree(buf); +- ctxt->instate = state; ++ if (ctxt->instate != XML_PARSER_EOF) ++ ctxt->instate = state; + return; + } + if (buf != NULL) { +@@ -5022,6 +5082,10 @@ + count++; + if (count > 50) { + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return; ++ } + count = 0; + } + COPY_BUF(l,buf,len,cur); +@@ -5371,6 +5435,8 @@ + } + } + } ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + SKIP_BLANKS; + if (RAW != '>') { + xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED, +@@ -5762,7 +5828,7 @@ + } + SKIP_BLANKS; + GROW; +- while (RAW != '>') { ++ while ((RAW != '>') && (ctxt->instate != XML_PARSER_EOF)) { + const xmlChar *check = CUR_PTR; + int type; + int def; +@@ -5911,7 +5977,7 @@ + ret = cur = xmlNewDocElementContent(ctxt->myDoc, NULL, XML_ELEMENT_CONTENT_PCDATA); + if (ret == NULL) return(NULL); + } +- while (RAW == '|') { ++ while ((RAW == '|') && (ctxt->instate != XML_PARSER_EOF)) { + NEXT; + if (elem == NULL) { + ret = xmlNewDocElementContent(ctxt->myDoc, NULL, XML_ELEMENT_CONTENT_OR); +@@ -6055,7 +6121,7 @@ + } + SKIP_BLANKS; + SHRINK; +- while (RAW != ')') { ++ while ((RAW != ')') && (ctxt->instate != XML_PARSER_EOF)) { + /* + * Each loop we parse one separator and one element. + */ +@@ -6334,6 +6400,8 @@ + } + NEXT; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); + SKIP_BLANKS; + if (CMP7(CUR_PTR, '#', 'P', 'C', 'D', 'A', 'T', 'A')) { + tree = xmlParseElementMixedContentDecl(ctxt, inputid); +@@ -6501,8 +6569,8 @@ + "Entering INCLUDE Conditional Section\n"); + } + +- while ((RAW != 0) && ((RAW != ']') || (NXT(1) != ']') || +- (NXT(2) != '>'))) { ++ while (((RAW != 0) && ((RAW != ']') || (NXT(1) != ']') || ++ (NXT(2) != '>'))) && (ctxt->instate != XML_PARSER_EOF)) { + const xmlChar *check = CUR_PTR; + unsigned int cons = ctxt->input->consumed; + +@@ -6570,7 +6638,8 @@ + if (ctxt->recovery == 0) ctxt->disableSAX = 1; + ctxt->instate = XML_PARSER_IGNORE; + +- while ((depth >= 0) && (RAW != 0)) { ++ while (((depth >= 0) && (RAW != 0)) && ++ (ctxt->instate != XML_PARSER_EOF)) { + if ((RAW == '<') && (NXT(1) == '!') && (NXT(2) == '[')) { + depth++; + SKIP(3); +@@ -6841,7 +6910,7 @@ + break; + } + } +- ++ + if (RAW != 0) { + xmlFatalErr(ctxt, XML_ERR_EXT_SUBSET_NOT_FINISHED, NULL); + } +@@ -7310,6 +7379,8 @@ + xmlEntityPtr ent = NULL; + + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + + if (RAW != '&') + return(NULL); +@@ -7355,6 +7426,8 @@ + ent = xmlSAX2GetEntity(ctxt, name); + } + } ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + /* + * [ WFC: Entity Declared ] + * In a document without any DTD, a document with only an +@@ -7545,6 +7618,10 @@ + ent = xmlSAX2GetEntity(ctxt, name); + } + } ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(name); ++ return(NULL); ++ } + + /* + * [ WFC: Entity Declared ] +@@ -7706,8 +7783,9 @@ + */ + if ((ctxt->sax != NULL) && + (ctxt->sax->getParameterEntity != NULL)) +- entity = ctxt->sax->getParameterEntity(ctxt->userData, +- name); ++ entity = ctxt->sax->getParameterEntity(ctxt->userData, name); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + if (entity == NULL) { + /* + * [ WFC: Entity Declared ] +@@ -7840,6 +7918,10 @@ + if (count++ > 100) { + count = 0; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlBufferFree(buf); ++ return(-1); ++ } + } + NEXTL(l); + c = CUR_CHAR(l); +@@ -7931,8 +8013,11 @@ + */ + if ((ctxt->sax != NULL) && + (ctxt->sax->getParameterEntity != NULL)) +- entity = ctxt->sax->getParameterEntity(ctxt->userData, +- name); ++ entity = ctxt->sax->getParameterEntity(ctxt->userData, name); ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(name); ++ return(NULL); ++ } + if (entity == NULL) { + /* + * [ WFC: Entity Declared ] +@@ -8034,6 +8119,8 @@ + if ((ctxt->sax != NULL) && (ctxt->sax->internalSubset != NULL) && + (!ctxt->disableSAX)) + ctxt->sax->internalSubset(ctxt->userData, name, ExternalID, URI); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + + /* + * Is there any internal subset declarations ? +@@ -8073,7 +8160,7 @@ + * PEReferences. + * Subsequence (markupdecl | PEReference | S)* + */ +- while (RAW != ']') { ++ while ((RAW != ']') && (ctxt->instate != XML_PARSER_EOF)) { + const xmlChar *check = CUR_PTR; + unsigned int cons = ctxt->input->consumed; + +@@ -8259,9 +8346,9 @@ + SKIP_BLANKS; + GROW; + +- while ((RAW != '>') && ++ while (((RAW != '>') && + ((RAW != '/') || (NXT(1) != '>')) && +- (IS_BYTE_CHAR(RAW))) { ++ (IS_BYTE_CHAR(RAW))) && (ctxt->instate != XML_PARSER_EOF)) { + const xmlChar *q = CUR_PTR; + unsigned int cons = ctxt->input->consumed; + +@@ -8685,6 +8772,8 @@ + if (in >= end) { + const xmlChar *oldbase = ctxt->input->base; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + if (oldbase != ctxt->input->base) { + long delta = ctxt->input->base - oldbase; + start = start + delta; +@@ -8699,6 +8788,8 @@ + if (in >= end) { + const xmlChar *oldbase = ctxt->input->base; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + if (oldbase != ctxt->input->base) { + long delta = ctxt->input->base - oldbase; + start = start + delta; +@@ -8719,6 +8810,8 @@ + if (in >= end) { + const xmlChar *oldbase = ctxt->input->base; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + if (oldbase != ctxt->input->base) { + long delta = ctxt->input->base - oldbase; + start = start + delta; +@@ -8736,6 +8829,8 @@ + if (in >= end) { + const xmlChar *oldbase = ctxt->input->base; + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(NULL); + if (oldbase != ctxt->input->base) { + long delta = ctxt->input->base - oldbase; + start = start + delta; +@@ -8967,9 +9062,9 @@ + GROW; + if (ctxt->input->base != base) goto base_changed; + +- while ((RAW != '>') && ++ while (((RAW != '>') && + ((RAW != '/') || (NXT(1) != '>')) && +- (IS_BYTE_CHAR(RAW))) { ++ (IS_BYTE_CHAR(RAW))) && (ctxt->instate != XML_PARSER_EOF)) { + const xmlChar *q = CUR_PTR; + unsigned int cons = ctxt->input->consumed; + int len = -1, alloc = 0; +@@ -9140,6 +9235,8 @@ + failed: + + GROW ++ if (ctxt->instate == XML_PARSER_EOF) ++ break; + if (ctxt->input->base != base) goto base_changed; + if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>')))) + break; +@@ -9377,6 +9474,8 @@ + * We should definitely be at the ending "S? '>'" part + */ + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + SKIP_BLANKS; + if ((!IS_BYTE_CHAR(RAW)) || (RAW != '>')) { + xmlFatalErr(ctxt, XML_ERR_GT_REQUIRED, NULL); +@@ -9485,6 +9584,10 @@ + count++; + if (count > 50) { + GROW; ++ if (ctxt->instate == XML_PARSER_EOF) { ++ xmlFree(buf); ++ return; ++ } + count = 0; + } + NEXTL(l); +@@ -9733,6 +9836,8 @@ + * Parse the content of the element: + */ + xmlParseContent(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + if (!IS_BYTE_CHAR(RAW)) { + xmlFatalErrMsgStrIntStr(ctxt, XML_ERR_TAG_NOT_FINISHED, + "Premature end of data in tag %s line %d\n", +@@ -10255,9 +10360,10 @@ + + void + xmlParseMisc(xmlParserCtxtPtr ctxt) { +- while (((RAW == '<') && (NXT(1) == '?')) || +- (CMP4(CUR_PTR, '<', '!', '-', '-')) || +- IS_BLANK_CH(CUR)) { ++ while ((ctxt->instate != XML_PARSER_EOF) && ++ (((RAW == '<') && (NXT(1) == '?')) || ++ (CMP4(CUR_PTR, '<', '!', '-', '-')) || ++ IS_BLANK_CH(CUR))) { + if ((RAW == '<') && (NXT(1) == '?')) { + xmlParsePI(ctxt); + } else if (IS_BLANK_CH(CUR)) { +@@ -10304,6 +10410,8 @@ + */ + if ((ctxt->sax) && (ctxt->sax->setDocumentLocator)) + ctxt->sax->setDocumentLocator(ctxt->userData, &xmlDefaultSAXLocator); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); + + if ((ctxt->encoding == NULL) && + ((ctxt->input->end - ctxt->input->cur) >= 4)) { +@@ -10355,6 +10463,8 @@ + } + if ((ctxt->sax) && (ctxt->sax->startDocument) && (!ctxt->disableSAX)) + ctxt->sax->startDocument(ctxt->userData); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); + + /* + * The Misc part of the Prolog +@@ -10374,6 +10484,8 @@ + if (RAW == '[') { + ctxt->instate = XML_PARSER_DTD; + xmlParseInternalSubset(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); + } + + /* +@@ -10384,6 +10496,8 @@ + (!ctxt->disableSAX)) + ctxt->sax->externalSubset(ctxt->userData, ctxt->intSubName, + ctxt->extSubSystem, ctxt->extSubURI); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); + ctxt->inSubset = 0; + + xmlCleanSpecialAttr(ctxt); +@@ -10524,6 +10638,8 @@ + } + if ((ctxt->sax) && (ctxt->sax->startDocument) && (!ctxt->disableSAX)) + ctxt->sax->startDocument(ctxt->userData); ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); + + /* + * Doing validity checking on chunk doesn't make sense +@@ -10535,6 +10651,9 @@ + + xmlParseContent(ctxt); + ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(-1); ++ + if ((RAW == '<') && (NXT(1) == '/')) { + xmlFatalErr(ctxt, XML_ERR_NOT_WELL_BALANCED, NULL); + } else if (RAW != 0) { +@@ -10841,7 +10960,7 @@ + } + xmlParseGetLasts(ctxt, &lastlt, &lastgt); + +- while (1) { ++ while (ctxt->instate != XML_PARSER_EOF) { + if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1)) + return(0); + +@@ -11081,6 +11200,8 @@ + ctxt->sax->endElement(ctxt->userData, name); + #endif /* LIBXML_SAX1_ENABLED */ + } ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + spacePop(ctxt); + if (ctxt->nameNr == 0) { + ctxt->instate = XML_PARSER_EPILOG; +@@ -11262,6 +11383,8 @@ + ctxt->sax->characters(ctxt->userData, + ctxt->input->cur, tmp); + } ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + SKIPL(tmp); + ctxt->checkIndex = 0; + } +@@ -11297,6 +11420,8 @@ + ctxt->sax->characters(ctxt->userData, + ctxt->input->cur, base); + } ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + SKIPL(base + 3); + ctxt->checkIndex = 0; + ctxt->instate = XML_PARSER_CONTENT; +@@ -11328,6 +11453,8 @@ + "PP: Parsing PI\n"); + #endif + xmlParsePI(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + ctxt->checkIndex = 0; + } else if ((cur == '<') && (next == '!') && + (ctxt->input->cur[2] == '-') && +@@ -11340,6 +11467,8 @@ + "PP: Parsing Comment\n"); + #endif + xmlParseComment(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + ctxt->instate = XML_PARSER_MISC; + ctxt->checkIndex = 0; + } else if ((cur == '<') && (next == '!') && +@@ -11359,6 +11488,8 @@ + #endif + ctxt->inSubset = 1; + xmlParseDocTypeDecl(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + if (RAW == '[') { + ctxt->instate = XML_PARSER_DTD; + #ifdef DEBUG_PUSH +@@ -11415,6 +11546,8 @@ + "PP: Parsing PI\n"); + #endif + xmlParsePI(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + } else if ((cur == '<') && (next == '!') && + (ctxt->input->cur[2] == '-') && (ctxt->input->cur[3] == '-')) { + if ((!terminate) && +@@ -11425,6 +11558,8 @@ + "PP: Parsing Comment\n"); + #endif + xmlParseComment(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + ctxt->instate = XML_PARSER_PROLOG; + } else if ((cur == '<') && (next == '!') && + (avail < 4)) { +@@ -11459,6 +11594,8 @@ + "PP: Parsing PI\n"); + #endif + xmlParsePI(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + ctxt->instate = XML_PARSER_EPILOG; + } else if ((cur == '<') && (next == '!') && + (ctxt->input->cur[2] == '-') && (ctxt->input->cur[3] == '-')) { +@@ -11470,6 +11607,8 @@ + "PP: Parsing Comment\n"); + #endif + xmlParseComment(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + ctxt->instate = XML_PARSER_EPILOG; + } else if ((cur == '<') && (next == '!') && + (avail < 4)) { +@@ -11598,6 +11737,8 @@ + + found_end_int_subset: + xmlParseInternalSubset(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + ctxt->inSubset = 2; + if ((ctxt->sax != NULL) && (!ctxt->disableSAX) && + (ctxt->sax->externalSubset != NULL)) +@@ -11605,6 +11746,8 @@ + ctxt->extSubSystem, ctxt->extSubURI); + ctxt->inSubset = 0; + xmlCleanSpecialAttr(ctxt); ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + ctxt->instate = XML_PARSER_PROLOG; + ctxt->checkIndex = 0; + #ifdef DEBUG_PUSH +@@ -11813,6 +11956,10 @@ + xmlParseTryOrFinish(ctxt, 0); + else + xmlParseTryOrFinish(ctxt, terminate); ++ ++ if (ctxt->instate == XML_PARSER_EOF) ++ return(ctxt->errNo); ++ + if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1)) + return(ctxt->errNo); + +@@ -12006,6 +12153,7 @@ + if (ctxt == NULL) + return; + ctxt->instate = XML_PARSER_EOF; ++ ctxt->errNo = XML_ERR_USER_STOP; + ctxt->disableSAX = 1; + if (ctxt->input != NULL) { + ctxt->input->cur = BAD_CAST""; diff --git a/source/base/libxml2/CVE-2014-0191.patch b/source/base/libxml2/CVE-2014-0191.patch new file mode 100644 index 0000000..7527fd7 --- /dev/null +++ b/source/base/libxml2/CVE-2014-0191.patch @@ -0,0 +1,33 @@ +From 9cd1c3cfbd32655d60572c0a413e017260c854df Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <[email protected]> +Date: Tue, 22 Apr 2014 15:30:56 +0800 +Subject: Do not fetch external parameter entities + +Unless explicitely asked for when validating or replacing entities +with their value. Problem pointed out by Daniel Berrange <[email protected]> + +Index: libxml2-2.8.0+dfsg1/parser.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parser.c 2014-05-08 14:29:31.687027612 -0400 ++++ libxml2-2.8.0+dfsg1/parser.c 2014-05-08 14:29:31.683027612 -0400 +@@ -2566,6 +2566,20 @@ + xmlCharEncoding enc; + + /* ++ * Note: external parsed entities will not be loaded, it is ++ * not required for a non-validating parser, unless the ++ * option of validating, or substituting entities were ++ * given. Doing so is far more secure as the parser will ++ * only process data coming from the document entity by ++ * default. ++ */ ++ if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) && ++ ((ctxt->options & XML_PARSE_NOENT) == 0) && ++ ((ctxt->options & XML_PARSE_DTDVALID) == 0) && ++ (ctxt->validate == 0)) ++ return; ++ ++ /* + * handle the extra spaces added before and after + * c.f. http://www.w3.org/TR/REC-xml#as-PE + * this is done independently. diff --git a/source/base/libxml2/FrugalBuild b/source/base/libxml2/FrugalBuild index 065259b..3999757 100644 --- a/source/base/libxml2/FrugalBuild +++ b/source/base/libxml2/FrugalBuild @@ -2,9 +2,11 @@ # Maintainer: crazy <[email protected]> # Contributor: Miklos Vajna <[email protected]> +options+=('asneeded') + pkgname=libxml2 pkgver=2.8.0 -pkgrel=1 +pkgrel=2arcturus1 pkgdesc="XML parsing library" url="http://www.xmlsoft.org/"; groups=('base' 'chroot-core') @@ -14,6 +16,8 @@ makedepends=('python>=2.7' 'readline>=6.2') #up2date="lynx -dump 'ftp://xmlsoft.org/libxml2/'|grep -m1 'LATEST_LIBXML2_IS_'|sed 's/.*xml2-\(.*\).t.*/\1/'" up2date="Flasttar ftp://xmlsoft.org/libxml2/"; source=(ftp://xmlsoft.org/$pkgname/$pkgname-$pkgver.tar.gz) +sha1sums=('a0c553bd51ba79ab6fff26dc700004c6a41f5250') + subpkgs=("$pkgname-docs") subdescs=("Documentation for $pkgname") @@ -21,8 +25,18 @@ subrodepends=("$pkgname=$pkgver") subgroups=('docs-extra') subarchs=('i686 x86_64') + +# FSA fix *** +source=(${source[@]} CVE-2012-5134.patch CVE-2013-0339.patch + CVE-2013-2877.patch CVE-2014-0191.patch) +sha1sums=(${sha1sums[@]} '5f2ca3ffa6f8ae87ca5f3be1bdd7c06f8ffdea35' \ + 'f449529958509f9e3b7c1e687bf1424e3e630c2b' \ + '8856fa620e57369a2c8b30f7e35afb78685ded69' \ + '13d518bbbe1f257d8c9580f9e22be3e28fec9426') +# *********** + build() { - Fcd + Fpatchall Fsed "tail -1" "tail -n 1" configure Fsed "head -1" "head -n 1" configure Fmake --with-threads --with-readline --with-zlib @@ -32,6 +46,4 @@ build() { Fsplit $pkgname-docs usr/share/doc } -sha1sums=('a0c553bd51ba79ab6fff26dc700004c6a41f5250') - # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
