lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-24 13:33:01 +03:00
Code Activity

CVE-2015-7500 Fix memory access error due to incorrect entities boundaries

Browse Source 
For https://bugzilla.gnome.org/show_bug.cgi?id=756525
handle properly the case where we popped out of the current entity
while processing a start tag
Reported by Kostya Serebryany @ Google

This slightly modifies the output of 754946 in regression tests
This commit is contained in:
Daniel Veillard
2015-11-20 16:06:59 +08:00
parent fdfeecc1b7
commit f1063fdbe7
2 changed files with 27 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
parser.c
View File

@@ -9348,7 +9348,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
const xmlChar **atts = ctxt->atts; const xmlChar **atts = ctxt->atts;
int maxatts = ctxt->maxatts; int maxatts = ctxt->maxatts;
int nratts, nbatts, nbdef; int nratts, nbatts, nbdef;
int i, j, nbNs, attval, oldline, oldcol; int i, j, nbNs, attval, oldline, oldcol, inputNr;
const xmlChar *base; const xmlChar *base;
unsigned long cur; unsigned long cur;
int nsNr = ctxt->nsNr; int nsNr = ctxt->nsNr;
@@ -9367,6 +9367,7 @@ reparse:
SHRINK; SHRINK;
base = ctxt->input->base; base = ctxt->input->base;
cur = ctxt->input->cur - ctxt->input->base; cur = ctxt->input->cur - ctxt->input->base;
inputNr = ctxt->inputNr;
oldline = ctxt->input->line; oldline = ctxt->input->line;
oldcol = ctxt->input->col; oldcol = ctxt->input->col;
nbatts = 0; nbatts = 0;
@@ -9392,7 +9393,8 @@ reparse:
*/ */
SKIP_BLANKS; SKIP_BLANKS;
GROW; GROW;
if (ctxt->input->base != base) goto base_changed; if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
goto base_changed;
while (((RAW != '>') && while (((RAW != '>') &&
((RAW != '/') || (NXT(1) != '>')) && ((RAW != '/') || (NXT(1) != '>')) &&
@@ -9403,7 +9405,7 @@ reparse:
attname = xmlParseAttribute2(ctxt, prefix, localname, attname = xmlParseAttribute2(ctxt, prefix, localname,
&aprefix, &attvalue, &len, &alloc); &aprefix, &attvalue, &len, &alloc);
if (ctxt->input->base != base) { if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
if ((attvalue != NULL) && (alloc != 0)) if ((attvalue != NULL) && (alloc != 0))
xmlFree(attvalue); xmlFree(attvalue);
attvalue = NULL; attvalue = NULL;
@@ -9552,7 +9554,8 @@ skip_ns:
break; break;
} }
SKIP_BLANKS; SKIP_BLANKS;
if (ctxt->input->base != base) goto base_changed; if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
goto base_changed;
continue; continue;
} }
@@ -9589,7 +9592,8 @@ failed:
GROW GROW
if (ctxt->instate == XML_PARSER_EOF) if (ctxt->instate == XML_PARSER_EOF)
break; break;
if (ctxt->input->base != base) goto base_changed; if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
goto base_changed;
if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>')))) if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
break; break;
if (!IS_BLANK_CH(RAW)) { if (!IS_BLANK_CH(RAW)) {
@@ -9605,7 +9609,8 @@ failed:
break; break;
} }
GROW; GROW;
if (ctxt->input->base != base) goto base_changed; if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
goto base_changed;
} }
/* /*
@@ -9772,6 +9777,17 @@ base_changed:
if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL)) if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
xmlFree((xmlChar *) atts[i]); xmlFree((xmlChar *) atts[i]);
} }
/*
* We can't switch from one entity to another in the middle
* of a start tag
*/
if (inputNr != ctxt->inputNr) {
xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
"Start tag doesn't start and stop in the same entity\n");
return(NULL);
}
ctxt->input->cur = ctxt->input->base + cur; ctxt->input->cur = ctxt->input->base + cur;
ctxt->input->line = oldline; ctxt->input->line = oldline;
ctxt->input->col = oldcol; ctxt->input->col = oldcol;

7
result/errors/754946.xml.err
View File

@@ -11,6 +11,9 @@ Entity: line 1: parser error : DOCTYPE improperly terminated
Entity: line 1: Entity: line 1:
A<lbbbbbbbbbbbbbbbbbbb_ A<lbbbbbbbbbbbbbbbbbbb_
^ ^
./test/errors/754946.xml:1: parser error : Extra content at the end of the document ./test/errors/754946.xml:1: parser error : Start tag doesn't start and stop in the same entity
<!DOCTYPEA[<!ENTITY % >%SYSTEM;<![
^
./test/errors/754946.xml:1: parser error : Extra content at the end of the document
>%SYSTEM;<![
^ ^