From 925a014d74a0253cef22e0ad0f03b32fe331ca60 Mon Sep 17 00:00:00 2001 From: Ejigs Date: Thu, 7 May 2026 13:49:59 -0400 Subject: [PATCH] [core] fix unrestricted entity expansion and integer overflow in ezxml * Add EZXML_MAXEXP limit (8 MB) to ezxml_decode() to prevent exponential memory growth from nested entity definitions (billion laughs attack). * Add recursion depth limit to ezxml_ent_ok() to prevent CPU exhaustion during DTD processing of deeply nested entity definitions. * Change _realloc() parameter from unsigned int to size_t to prevent silent truncation of allocation sizes on 64-bit builds. * Change size calculation variables in ezxml_decode() from long to size_t/ssize_t to prevent signed integer overflow on Windows where long is 32-bit even on x64. * Add NULL check for strchr() result before pointer arithmetic in entity expansion to prevent undefined behavior on malformed input. * Add bounds check in ezxml_internal_dtd() entity name parsing to prevent write past buffer. * Closes Security Advisory report https://github.com/pbatard/rufus/security/advisories/GHSA-55r2-34wg-8mv9. --- src/rufus.rc | 10 +++++----- src/xml.c | 38 ++++++++++++++++++++++++++------------ 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/src/rufus.rc b/src/rufus.rc index b4a775d8..bf00db8a 100644 --- a/src/rufus.rc +++ b/src/rufus.rc @@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL IDD_DIALOG DIALOGEX 12, 12, 232, 326 STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU EXSTYLE WS_EX_ACCEPTFILES -CAPTION "Rufus 4.15.2389" +CAPTION "Rufus 4.15.2390" FONT 9, "Segoe UI Symbol", 400, 0, 0x0 BEGIN LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP @@ -409,8 +409,8 @@ END // VS_VERSION_INFO VERSIONINFO - FILEVERSION 4,15,2389,0 - PRODUCTVERSION 4,15,2389,0 + FILEVERSION 4,15,2390,0 + PRODUCTVERSION 4,15,2390,0 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS 0x1L @@ -428,13 +428,13 @@ BEGIN VALUE "Comments", "https://rufus.ie" VALUE "CompanyName", "Akeo Consulting" VALUE "FileDescription", "Rufus" - VALUE "FileVersion", "4.15.2389" + VALUE "FileVersion", "4.15.2390" VALUE "InternalName", "Rufus" VALUE "LegalCopyright", "© 2011-2026 Pete Batard (GPL v3)" VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html" VALUE "OriginalFilename", "rufus-4.15.exe" VALUE "ProductName", "Rufus" - VALUE "ProductVersion", "4.15.2389" + VALUE "ProductVersion", "4.15.2390" END END BLOCK "VarFileInfo" diff --git a/src/xml.c b/src/xml.c index 4791788b..6c34e96d 100644 --- a/src/xml.c +++ b/src/xml.c @@ -42,8 +42,9 @@ #endif #define EZXML_NOMMAP -#define EZXML_WS "\t\r\n " // whitespace -#define EZXML_ERRL 256 // maximum error string length +#define EZXML_WS "\t\r\n " // whitespace +#define EZXML_ERRL 256 // maximum error string length +#define EZXML_MAXEXP (8 * MB) // max entity expansion (to prevent "billion laughs" blowup) #ifdef _MSC_VER #pragma warning(disable:6011) @@ -68,7 +69,7 @@ struct ezxml_root { // additional data for the root tag char *EZXML_NIL[] = { NULL }; // empty, null terminated array of strings // what realloc should be doing all along -static inline void* _realloc(void* ptr, unsigned int size) { +static inline void* _realloc(void* ptr, size_t size) { void* old_ptr = ptr; ptr = realloc(ptr, size); if (ptr == NULL) @@ -200,7 +201,8 @@ ezxml_t ezxml_err(ezxml_root_t root, char *s, const char *err, ...) char *ezxml_decode(char *s, char **ent, char t) { char *e, *r = s, *m = s; - long b, c, d, l; + ssize_t b, c, d; + size_t l, o, x = 0; for (; *s; s++) { // normalize line endings while (*s == '\r') { @@ -214,8 +216,8 @@ char *ezxml_decode(char *s, char **ent, char t) if (! *s) break; else if (t != 'c' && ! strncmp(s, "&#", 2)) { // character reference - if (s[2] == 'x') c = strtol(s + 3, &e, 16); // base 16 - else c = strtol(s + 2, &e, 10); // base 10 + if (s[2] == 'x') c = (ssize_t)strtoull(s + 3, &e, 16); // base 16 + else c = (ssize_t)strtoull(s + 2, &e, 10); // base 10 if (! c || *e != ';') { s++; continue; } // not a character ref if (c < 0x80) *(s++) = (char)c; // US-ASCII subset @@ -236,10 +238,14 @@ char *ezxml_decode(char *s, char **ent, char t) b += 2); // find entity in entity list if (ent[b++]) { // found a match - if ((c = (long)strlen(ent[b])) - 1 > (e = strchr(s, ';')) - s) { - l = (d = (long)(s - r)) + c + (long)(e ? strlen(e) : 0); // new length + c = strlen(ent[b]); + x += c; + if (x > EZXML_MAXEXP) break; + if ((e = strchr(s, ';')) && c - 1 > e - s) { + o = s - r; + l = o + c + (e ? strlen(e) : 0); // new length r = (r == m) ? strcpy(malloc(l), r) : _realloc(r, l); - e = strchr((s = r + d), ';'); // fix up pointers + e = strchr((s = r + o), ';'); // fix up pointers } if (!e) return r; @@ -254,7 +260,7 @@ char *ezxml_decode(char *s, char **ent, char t) if (t == '*') { // normalize spaces for non-cdata attributes for (s = r; *s; s++) { - if ((l = (long)strspn(s, " "))) memmove(s, s + l, strlen(s + l) + 1); + if ((l = strspn(s, " "))) memmove(s, s + l, strlen(s + l) + 1); while (*s && *s != ' ') s++; } if (--s >= r && *s == ' ') *s = '\0'; // trim any trailing space @@ -310,19 +316,27 @@ ezxml_t ezxml_close_tag(ezxml_root_t root, char *name, char *s) // checks for circular entity references, returns non-zero if no circular // references are found, zero otherwise -int ezxml_ent_ok(char *name, char *s, char **ent) +static int ezxml_ent_ok_r(char *name, char *s, char **ent, int depth) { int i; + if (depth <= 0) return 0; // treat deep nesting as circular + for (; ; s++) { while (*s && *s != '&') s++; // find next entity reference if (! *s) return 1; if (! strncmp(s + 1, name, strlen(name))) return 0; // circular ref. for (i = 0; ent[i] && strncmp(ent[i], s + 1, strlen(ent[i])); i += 2); - if (ent[i] && ! ezxml_ent_ok(name, ent[i + 1], ent)) return 0; + if (ent[i] && ! ezxml_ent_ok_r(name, ent[i + 1], ent, depth - 1)) + return 0; } } +int ezxml_ent_ok(char *name, char *s, char **ent) +{ + return ezxml_ent_ok_r(name, s, ent, 20); +} + // called when the parser finds a processing instruction void ezxml_proc_inst(ezxml_root_t root, char *s, size_t len) {