sysutils/rufus
1
0
Fork 0
mirror of https://github.com/pbatard/rufus.git synced 2026-10-24 02:28:58 +03:00
Code Activity

[core] fix unrestricted entity expansion and integer overflow in ezxml

Browse Source 
* Add EZXML_MAXEXP limit (8 MB) to ezxml_decode() to prevent exponential memory growth from nested entity definitions (billion laughs attack).
* Add recursion depth limit to ezxml_ent_ok() to prevent CPU exhaustion during DTD processing of deeply nested entity definitions.
* Change _realloc() parameter from unsigned int to size_t to prevent silent truncation of allocation sizes on 64-bit builds.
* Change size calculation variables in ezxml_decode() from long to size_t/ssize_t to prevent signed integer overflow on Windows where long is 32-bit even on x64.
* Add NULL check for strchr() result before pointer arithmetic in entity expansion to prevent undefined behavior on malformed input.
* Add bounds check in ezxml_internal_dtd() entity name parsing to prevent write past buffer.
* Closes Security Advisory report https://github.com/pbatard/rufus/security/advisories/GHSA-55r2-34wg-8mv9.
This commit is contained in:
Ejigs
2026-05-07 13:49:59 -04:00
committed by Pete Batard
parent 5989fcbc6d
commit 925a014d74
2 changed files with 31 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/rufus.rc
View File

@@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
IDD_DIALOG DIALOGEX 12, 12, 232, 326
STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_ACCEPTFILES
CAPTION "Rufus 4.15.2389"
CAPTION "Rufus 4.15.2390"
FONT 9, "Segoe UI Symbol", 400, 0, 0x0
BEGIN
LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
@@ -409,8 +409,8 @@ END
//
VS_VERSION_INFO VERSIONINFO
FILEVERSION 4,15,2389,0
PRODUCTVERSION 4,15,2389,0
FILEVERSION 4,15,2390,0
PRODUCTVERSION 4,15,2390,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
@@ -428,13 +428,13 @@ BEGIN
VALUE "Comments", "https://rufus.ie"
VALUE "CompanyName", "Akeo Consulting"
VALUE "FileDescription", "Rufus"
VALUE "FileVersion", "4.15.2389"
VALUE "FileVersion", "4.15.2390"
VALUE "InternalName", "Rufus"
VALUE "LegalCopyright", "© 2011-2026 Pete Batard (GPL v3)"
VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
VALUE "OriginalFilename", "rufus-4.15.exe"
VALUE "ProductName", "Rufus"
VALUE "ProductVersion", "4.15.2389"
VALUE "ProductVersion", "4.15.2390"
END
END
BLOCK "VarFileInfo"

38
src/xml.c
View File

@@ -42,8 +42,9 @@
#endif
#define EZXML_NOMMAP
#define EZXML_WS "\t\r\n " // whitespace
#define EZXML_ERRL 256 // maximum error string length
#define EZXML_WS "\t\r\n " // whitespace
#define EZXML_ERRL 256 // maximum error string length
#define EZXML_MAXEXP (8 * MB) // max entity expansion (to prevent "billion laughs" blowup)
#ifdef _MSC_VER
#pragma warning(disable:6011)
@@ -68,7 +69,7 @@ struct ezxml_root { // additional data for the root tag
char *EZXML_NIL[] = { NULL }; // empty, null terminated array of strings
// what realloc should be doing all along
static inline void* _realloc(void* ptr, unsigned int size) {
static inline void* _realloc(void* ptr, size_t size) {
void* old_ptr = ptr;
ptr = realloc(ptr, size);
if (ptr == NULL)
@@ -200,7 +201,8 @@ ezxml_t ezxml_err(ezxml_root_t root, char *s, const char *err, ...)
char *ezxml_decode(char *s, char **ent, char t)
{
char *e, *r = s, *m = s;
long b, c, d, l;
ssize_t b, c, d;
size_t l, o, x = 0;
for (; *s; s++) { // normalize line endings
while (*s == '\r') {
@@ -214,8 +216,8 @@ char *ezxml_decode(char *s, char **ent, char t)
if (! *s) break;
else if (t != 'c' && ! strncmp(s, "&#", 2)) { // character reference
if (s[2] == 'x') c = strtol(s + 3, &e, 16); // base 16
else c = strtol(s + 2, &e, 10); // base 10
if (s[2] == 'x') c = (ssize_t)strtoull(s + 3, &e, 16); // base 16
else c = (ssize_t)strtoull(s + 2, &e, 10); // base 10
if (! c || *e != ';') { s++; continue; } // not a character ref
if (c < 0x80) *(s++) = (char)c; // US-ASCII subset
@@ -236,10 +238,14 @@ char *ezxml_decode(char *s, char **ent, char t)
b += 2); // find entity in entity list
if (ent[b++]) { // found a match
if ((c = (long)strlen(ent[b])) - 1 > (e = strchr(s, ';')) - s) {
l = (d = (long)(s - r)) + c + (long)(e ? strlen(e) : 0); // new length
c = strlen(ent[b]);
x += c;
if (x > EZXML_MAXEXP) break;
if ((e = strchr(s, ';')) && c - 1 > e - s) {
o = s - r;
l = o + c + (e ? strlen(e) : 0); // new length
r = (r == m) ? strcpy(malloc(l), r) : _realloc(r, l);
e = strchr((s = r + d), ';'); // fix up pointers
e = strchr((s = r + o), ';'); // fix up pointers
}
if (!e) return r;
@@ -254,7 +260,7 @@ char *ezxml_decode(char *s, char **ent, char t)
if (t == '*') { // normalize spaces for non-cdata attributes
for (s = r; *s; s++) {
if ((l = (long)strspn(s, " "))) memmove(s, s + l, strlen(s + l) + 1);
if ((l = strspn(s, " "))) memmove(s, s + l, strlen(s + l) + 1);
while (*s && *s != ' ') s++;
}
if (--s >= r && *s == ' ') *s = '\0'; // trim any trailing space
@@ -310,19 +316,27 @@ ezxml_t ezxml_close_tag(ezxml_root_t root, char *name, char *s)
// checks for circular entity references, returns non-zero if no circular
// references are found, zero otherwise
int ezxml_ent_ok(char *name, char *s, char **ent)
static int ezxml_ent_ok_r(char *name, char *s, char **ent, int depth)
{
int i;
if (depth <= 0) return 0; // treat deep nesting as circular
for (; ; s++) {
while (*s && *s != '&') s++; // find next entity reference
if (! *s) return 1;
if (! strncmp(s + 1, name, strlen(name))) return 0; // circular ref.
for (i = 0; ent[i] && strncmp(ent[i], s + 1, strlen(ent[i])); i += 2);
if (ent[i] && ! ezxml_ent_ok(name, ent[i + 1], ent)) return 0;
if (ent[i] && ! ezxml_ent_ok_r(name, ent[i + 1], ent, depth - 1))
return 0;
}
}
int ezxml_ent_ok(char *name, char *s, char **ent)
{
return ezxml_ent_ok_r(name, s, ent, 20);
}
// called when the parser finds a processing instruction
void ezxml_proc_inst(ezxml_root_t root, char *s, size_t len)
{