external/libxslt/UnpackedTarball_libxslt.mk | 1
external/libxslt/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch.1 | 120
++++++++++
sw/qa/extras/uiwriter/uiwriter2.cxx | 53 ++++
sw/source/core/doc/DocumentRedlineManager.cxx | 20 -
4 files changed, 182 insertions(+), 12 deletions(-)
New commits:
commit 34795a716a16e13d028ac3e255160f8cf98f1ea3
Author: Michael Stahl <michael.st...@cib.de>
AuthorDate: Wed Apr 17 14:50:10 2019 +0200
Commit: Thorsten Behrens <thorsten.behr...@cib.de>
CommitDate: Sat Apr 20 23:06:43 2019 +0200
libxslt: add patch for CVE-2019-11068
Change-Id: I3fe30de8140dce3d81cdfae7d41e0bd465b1d5f4
Reviewed-on: https://gerrit.libreoffice.org/70879
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@cib.de>
(cherry picked from commit 2d85b75b1220484aebd6e583d6d7aee71280e38e)
Reviewed-on: https://gerrit.libreoffice.org/70893
Reviewed-by: Thorsten Behrens <thorsten.behr...@cib.de>
diff --git a/external/libxslt/UnpackedTarball_libxslt.mk
b/external/libxslt/UnpackedTarball_libxslt.mk
index eae318ef74b9..beb591b8b2a8 100644
--- a/external/libxslt/UnpackedTarball_libxslt.mk
+++ b/external/libxslt/UnpackedTarball_libxslt.mk
@@ -19,6 +19,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxslt,\
external/libxslt/libxslt-msvc.patch.2 \
external/libxslt/libxslt-1.1.26-memdump.patch \
external/libxslt/rpath.patch.0 \
+ external/libxslt/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch.1 \
))
# vim: set noet sw=4 ts=4:
diff --git a/external/libxslt/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch.1
b/external/libxslt/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch.1
new file mode 100644
index 000000000000..260f35d1a35e
--- /dev/null
+++ b/external/libxslt/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch.1
@@ -0,0 +1,120 @@
+From e03553605b45c88f0b4b2980adfbbb8f6fca2fd6 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnho...@aevum.de>
+Date: Sun, 24 Mar 2019 09:51:39 +0100
+Subject: [PATCH] Fix security framework bypass
+
+xsltCheckRead and xsltCheckWrite return -1 in case of error but callers
+don't check for this condition and allow access. With a specially
+crafted URL, xsltCheckRead could be tricked into returning an error
+because of a supposedly invalid URL that would still be loaded
+succesfully later on.
+
+Fixes #12.
+
+Thanks to Felix Wilhelm for the report.
+---
+ libxslt/documents.c | 18 ++++++++++--------
+ libxslt/imports.c | 9 +++++----
+ libxslt/transform.c | 9 +++++----
+ libxslt/xslt.c | 9 +++++----
+ 4 files changed, 25 insertions(+), 20 deletions(-)
+
+diff --git a/libxslt/documents.c b/libxslt/documents.c
+index 3f3a7312..4aad11bb 100644
+--- a/libxslt/documents.c
++++ b/libxslt/documents.c
+@@ -296,10 +296,11 @@ xsltLoadDocument(xsltTransformContextPtr ctxt, const
xmlChar *URI) {
+ int res;
+
+ res = xsltCheckRead(ctxt->sec, ctxt, URI);
+- if (res == 0) {
+- xsltTransformError(ctxt, NULL, NULL,
+- "xsltLoadDocument: read rights for %s denied\n",
+- URI);
++ if (res <= 0) {
++ if (res == 0)
++ xsltTransformError(ctxt, NULL, NULL,
++ "xsltLoadDocument: read rights for %s denied\n",
++ URI);
+ return(NULL);
+ }
+ }
+@@ -372,10 +373,11 @@ xsltLoadStyleDocument(xsltStylesheetPtr style, const
xmlChar *URI) {
+ int res;
+
+ res = xsltCheckRead(sec, NULL, URI);
+- if (res == 0) {
+- xsltTransformError(NULL, NULL, NULL,
+- "xsltLoadStyleDocument: read rights for %s denied\n",
+- URI);
++ if (res <= 0) {
++ if (res == 0)
++ xsltTransformError(NULL, NULL, NULL,
++ "xsltLoadStyleDocument: read rights for %s denied\n",
++ URI);
+ return(NULL);
+ }
+ }
+diff --git a/libxslt/imports.c b/libxslt/imports.c
+index 874870cc..3783b247 100644
+--- a/libxslt/imports.c
++++ b/libxslt/imports.c
+@@ -130,10 +130,11 @@ xsltParseStylesheetImport(xsltStylesheetPtr style,
xmlNodePtr cur) {
+ int secres;
+
+ secres = xsltCheckRead(sec, NULL, URI);
+- if (secres == 0) {
+- xsltTransformError(NULL, NULL, NULL,
+- "xsl:import: read rights for %s denied\n",
+- URI);
++ if (secres <= 0) {
++ if (secres == 0)
++ xsltTransformError(NULL, NULL, NULL,
++ "xsl:import: read rights for %s denied\n",
++ URI);
+ goto error;
+ }
+ }
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 13793914..0636dbd0 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -3493,10 +3493,11 @@ xsltDocumentElem(xsltTransformContextPtr ctxt,
xmlNodePtr node,
+ */
+ if (ctxt->sec != NULL) {
+ ret = xsltCheckWrite(ctxt->sec, ctxt, filename);
+- if (ret == 0) {
+- xsltTransformError(ctxt, NULL, inst,
+- "xsltDocumentElem: write rights for %s denied\n",
+- filename);
++ if (ret <= 0) {
++ if (ret == 0)
++ xsltTransformError(ctxt, NULL, inst,
++ "xsltDocumentElem: write rights for %s denied\n",
++ filename);
+ xmlFree(URL);
+ xmlFree(filename);
+ return;
+diff --git a/libxslt/xslt.c b/libxslt/xslt.c
+index 780a5ad7..a234eb79 100644
+--- a/libxslt/xslt.c
++++ b/libxslt/xslt.c
+@@ -6763,10 +6763,11 @@ xsltParseStylesheetFile(const xmlChar* filename) {
+ int res;
+
+ res = xsltCheckRead(sec, NULL, filename);
+- if (res == 0) {
+- xsltTransformError(NULL, NULL, NULL,
+- "xsltParseStylesheetFile: read rights for %s denied\n",
+- filename);
++ if (res <= 0) {
++ if (res == 0)
++ xsltTransformError(NULL, NULL, NULL,
++ "xsltParseStylesheetFile: read rights for %s denied\n",
++ filename);
+ return(NULL);
+ }
+ }
+--
+2.18.1
+
commit 5a80701d307136ebb0240aaa9448b8afe5cda646
Author: Michael Stahl <michael.st...@cib.de>
AuthorDate: Tue Apr 16 19:00:50 2019 +0200
Commit: Thorsten Behrens <thorsten.behr...@cib.de>
CommitDate: Sat Apr 20 23:06:31 2019 +0200
tdf#109376 sw: fix redline SwUndoDelete with end pos on SwTableNode crash
... that happens when you accept a delete redline (or reject an insert
redline) with such end pos.
The problem is that first a DeleteRange() will move the anchor position
onto the table node (because check in SwUndoSaveContent::DelContentIndex()
is surprisingly asymmetric and so the fly not deleted by the previous
bugfix), then DelFullPara() creates a second SwUndoDelete then deleting
the fly crashes because its anchors was moved.
The code in lcl_AcceptRedline() / lcl_RejectRedline() doesn't make much
sense (but always was like this), if we just call DeleteFullPara() once
instead, the problem is avoided, and we don't even have to worry about
why DelContentIndex() is so asymmetric (is "selection direction"
really a meaningful concept?).
Reportedly this started to crash with commit
e07feb9457f2ffb373ae69b73dda290140e4005f, previously it was just wrong.
Change-Id: Ib3d4b31e0255a6f4e7b49b40f204dec168ea3006
Reviewed-on: https://gerrit.libreoffice.org/70836
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@cib.de>
(cherry picked from commit f83e22f535c1c9482c5d3f566d5d0283355dd98f)
Reviewed-on: https://gerrit.libreoffice.org/70865
Tested-by: Xisco Faulí <xiscofa...@libreoffice.org>
Reviewed-by: Thorsten Behrens <thorsten.behr...@cib.de>
diff --git a/sw/qa/extras/uiwriter/uiwriter2.cxx
b/sw/qa/extras/uiwriter/uiwriter2.cxx
index ba6caf3f8222..cafe416f23a6 100644
--- a/sw/qa/extras/uiwriter/uiwriter2.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter2.cxx
@@ -39,6 +39,7 @@ public:
void testRedlineInHiddenSection();
void testTdf101534();
void testTdf54819();
+ void testTdf109376_redline();
void testTdf109376();
void testTdf108687_tabstop();
void testTdf119571();
@@ -55,6 +56,7 @@ public:
CPPUNIT_TEST(testRedlineInHiddenSection);
CPPUNIT_TEST(testTdf101534);
CPPUNIT_TEST(testTdf54819);
+ CPPUNIT_TEST(testTdf109376_redline);
CPPUNIT_TEST(testTdf109376);
CPPUNIT_TEST(testTdf108687_tabstop);
CPPUNIT_TEST(testTdf119571);
@@ -255,6 +257,57 @@ void SwUiWriterTest2::testTdf54819()
getProperty<OUString>(getParagraph(1),
"ParaStyleName"));
}
+void SwUiWriterTest2::testTdf109376_redline()
+{
+ SwDoc* pDoc = createDoc();
+ SwWrtShell* pWrtShell = pDoc->GetDocShell()->GetWrtShell();
+ CPPUNIT_ASSERT(pWrtShell);
+ // need 2 paragraphs to get to the bMoveNds case
+ pWrtShell->Insert("foo");
+ pWrtShell->SplitNode();
+ pWrtShell->Insert("bar");
+ pWrtShell->SplitNode();
+ pWrtShell->StartOfSection(false);
+
+ // add AT_PARA fly at 1st to be deleted node
+ SwFormatAnchor anchor(RndStdIds::FLY_AT_PARA);
+ anchor.SetAnchor(pWrtShell->GetCursor()->GetPoint());
+ SfxItemSet flySet(pDoc->GetAttrPool(),
+ svl::Items<RES_FRM_SIZE, RES_FRM_SIZE, RES_ANCHOR,
RES_ANCHOR>{});
+ flySet.Put(anchor);
+ SwFormatFrameSize size(ATT_MIN_SIZE, 1000, 1000);
+ flySet.Put(size); // set a size, else we get 1 char per line...
+ SwFrameFormat const* pFly = pWrtShell->NewFlyFrame(flySet,
/*bAnchValid=*/true);
+ CPPUNIT_ASSERT(pFly != nullptr);
+
+ pWrtShell->SttEndDoc(false);
+ SwInsertTableOptions tableOpt(SwInsertTableFlags::DefaultBorder, 0);
+ const SwTable& rTable = pWrtShell->InsertTable(tableOpt, 1, 1);
+
+ pWrtShell->StartOfSection(false);
+ SwPaM pam(*pWrtShell->GetCursor()->GetPoint());
+ pam.SetMark();
+ pam.GetPoint()->nNode = *rTable.GetTableNode();
+ pam.GetPoint()->nContent.Assign(nullptr, 0);
+ pam.Exchange(); // same selection direction as in doc compare...
+
+ IDocumentRedlineAccess& rIDRA(pDoc->getIDocumentRedlineAccess());
+ rIDRA.SetRedlineFlags(RedlineFlags::On | RedlineFlags::ShowInsert |
RedlineFlags::ShowDelete);
+ rIDRA.AppendRedline(new SwRangeRedline(nsRedlineType_t::REDLINE_DELETE,
pam), true);
+ // this used to assert/crash with m_pAnchoredFlys mismatch because the
+ // fly was not deleted but its anchor was moved to the SwTableNode
+ rIDRA.AcceptAllRedline(true);
+
+ CPPUNIT_ASSERT_EQUAL(size_t(0), pWrtShell->GetFlyCount(FLYCNTTYPE_FRM));
+ sw::UndoManager& rUndoManager = pDoc->GetUndoManager();
+ rUndoManager.Undo();
+ CPPUNIT_ASSERT_EQUAL(size_t(1), pWrtShell->GetFlyCount(FLYCNTTYPE_FRM));
+ rUndoManager.Redo();
+ CPPUNIT_ASSERT_EQUAL(size_t(0), pWrtShell->GetFlyCount(FLYCNTTYPE_FRM));
+ rUndoManager.Undo();
+ CPPUNIT_ASSERT_EQUAL(size_t(1), pWrtShell->GetFlyCount(FLYCNTTYPE_FRM));
+}
+
void SwUiWriterTest2::testTdf109376()
{
SwDoc* pDoc = createDoc();
diff --git a/sw/source/core/doc/DocumentRedlineManager.cxx
b/sw/source/core/doc/DocumentRedlineManager.cxx
index 029d48e03614..66eda4d6a23c 100644
--- a/sw/source/core/doc/DocumentRedlineManager.cxx
+++ b/sw/source/core/doc/DocumentRedlineManager.cxx
@@ -422,17 +422,15 @@ namespace
if( pCSttNd && pCEndNd )
rDoc.getIDocumentContentOperations().DeleteAndJoin(
aPam );
- else
- {
- rDoc.getIDocumentContentOperations().DeleteRange( aPam
);
-
- if( pCSttNd && !pCEndNd )
+ else if (pCSttNd && !pCEndNd)
{
aPam.GetBound().nContent.Assign( nullptr, 0 );
aPam.GetBound( false ).nContent.Assign( nullptr, 0
);
- aPam.DeleteMark();
rDoc.getIDocumentContentOperations().DelFullPara(
aPam );
}
+ else
+ {
+ rDoc.getIDocumentContentOperations().DeleteRange(aPam);
}
rDoc.getIDocumentRedlineAccess().SetRedlineFlags_intern(
eOld );
}
@@ -536,17 +534,15 @@ namespace
if( pCSttNd && pCEndNd )
rDoc.getIDocumentContentOperations().DeleteAndJoin(
aPam );
- else
- {
- rDoc.getIDocumentContentOperations().DeleteRange( aPam
);
-
- if( pCSttNd && !pCEndNd )
+ else if (pCSttNd && !pCEndNd)
{
aPam.GetBound().nContent.Assign( nullptr, 0 );
aPam.GetBound( false ).nContent.Assign( nullptr, 0
);
- aPam.DeleteMark();
rDoc.getIDocumentContentOperations().DelFullPara(
aPam );
}
+ else
+ {
+ rDoc.getIDocumentContentOperations().DeleteRange(aPam);
}
rDoc.getIDocumentRedlineAccess().SetRedlineFlags_intern(
eOld );
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
