Attachment 248731 Details for Bug 276478 – textproc/mxml 3.3.1

[patch] textproc/mxml 3.3.1

0002-textproc-mxml-Update-to-3.3.1.patch (text/plain), 4.90 KB, created by Tijl Coosemans on 2024-02-25 13:32:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tijl Coosemans

Created: 2024-02-25 13:32:14 UTC

Size: 4.90 KB

patch

obsolete

>From b67326810d8355cb95d32a2a6ef9b65db2646735 Mon Sep 17 00:00:00 2001
>From: Tijl Coosemans <tijl@FreeBSD.org>
>Date: Sat, 24 Feb 2024 21:20:15 +0100
>Subject: [PATCH 2/2] textproc/mxml: Update to 3.3.1
>
>Also add a patch to fix a bounds check problem discovered during an
>exp-run for bug 276478.
>
>PR:		276478
>---
> textproc/mxml/Makefile                |   7 +-
> textproc/mxml/distinfo                |   6 +-
> textproc/mxml/files/patch-mxml-file.c | 106 ++++++++++++++++++++++++++
> 3 files changed, 113 insertions(+), 6 deletions(-)
> create mode 100644 textproc/mxml/files/patch-mxml-file.c
>
>diff --git a/textproc/mxml/Makefile b/textproc/mxml/Makefile
>index 48b6e3a85c24..c982c84974fc 100644
>--- a/textproc/mxml/Makefile
>+++ b/textproc/mxml/Makefile
>@@ -1,6 +1,5 @@
> PORTNAME=	mxml
>-DISTVERSION=	3.1
>-PORTREVISION=	1
>+DISTVERSION=	3.3.1
> CATEGORIES=	textproc
> MASTER_SITES=	https://github.com/michaelrsweet/mxml/releases/download/v${DISTVERSION}/
> 
>@@ -11,13 +10,15 @@ WWW=		http://www.minixml.org/
> LICENSE=	APACHE20
> LICENSE_FILE=	${WRKSRC}/LICENSE
> 
>-USES=		desthack
> USE_LDCONFIG=	yes
> 
>+DESTDIRNAME=	DSTROOT
> GNU_CONFIGURE=	yes
>+GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
> MAKE_ARGS=	INSTALL_DATA="${INSTALL_DATA}" \
> 		INSTALL_LIB="${INSTALL_LIB}" \
> 		INSTALL_MAN="${INSTALL_MAN}"
>+TEST_TARGET=	test
> 
> OPTIONS_DEFINE=	DOCS
> 
>diff --git a/textproc/mxml/distinfo b/textproc/mxml/distinfo
>index cbd7a3011972..f6a8b32f719b 100644
>--- a/textproc/mxml/distinfo
>+++ b/textproc/mxml/distinfo
>@@ -1,3 +1,3 @@
>-TIMESTAMP = 1567960906
>-SHA256 (mxml-3.1.tar.gz) = 1ac8d252f62f9dc2b2004518c70d2da313bdfcd92b8350e215f46064a34b52fc
>-SIZE (mxml-3.1.tar.gz) = 9268821
>+TIMESTAMP = 1708794182
>+SHA256 (mxml-3.3.1.tar.gz) = 0c663ed1fe393b5619f80101798202eea43534abd7c8aff389022fd8c1dacc32
>+SIZE (mxml-3.3.1.tar.gz) = 1553469
>diff --git a/textproc/mxml/files/patch-mxml-file.c b/textproc/mxml/files/patch-mxml-file.c
>new file mode 100644
>index 000000000000..a697d80bba87
>--- /dev/null
>+++ b/textproc/mxml/files/patch-mxml-file.c
>@@ -0,0 +1,106 @@
>+mxml-file.c: Fix a bounds check problem
>+
>+When writing XML data into a buffer a pointer is used to keep track of
>+the current position.  When the end of the buffer is reached the writing
>+stops but the pointer continues to be incremented to be able to
>+determine how many bytes would have been written had the buffer been
>+large enough.  The problem is that the bounds check that stops the
>+writing did not handle the case where a large amount of data causes the
>+pointer to wrap around to 0.  This can happen for example when the
>+buffer is allocated on the stack and the stack is close to the end of
>+the address space.
>+
>+--- mxml-file.c.orig	2022-07-25 12:56:27 UTC
>++++ mxml-file.c
>+@@ -50,6 +50,11 @@ typedef struct _mxml_fdbuf_s		/**** File descriptor bu
>+ 		buffer[8192];		/* Character buffer */
>+ } _mxml_fdbuf_t;
>+ 
>++typedef struct _mxml_strbuf_s		/**** String buffer ****/
>++{
>++  char		*current;		/* Current position in buffer */
>++  int		remaining;		/* Remaining size of buffer */
>++} _mxml_strbuf_t;
>+ 
>+ /*
>+  * Local functions...
>+@@ -352,41 +357,43 @@ mxmlSaveString(mxml_node_t    *node,	/* I - Node to wr
>+                mxml_save_cb_t cb)	/* I - Whitespace callback or @code MXML_NO_CALLBACK@ */
>+ {
>+   int	col;				/* Final column */
>+-  char	*ptr[2];			/* Pointers for putc_cb */
>++  _mxml_strbuf_t buf;			/* State for putc_cb */
>+   _mxml_global_t *global = _mxml_global();
>+ 					/* Global data */
>+ 
>++  if (bufsize < 0)
>++    return (-1);
>+ 
>+  /*
>+   * Write the node...
>+   */
>+ 
>+-  ptr[0] = buffer;
>+-  ptr[1] = buffer + bufsize;
>++  buf.current = buffer;
>++  buf.remaining = bufsize;
>+ 
>+-  if ((col = mxml_write_node(node, ptr, cb, 0, mxml_string_putc, global)) < 0)
>++  if ((col = mxml_write_node(node, &buf, cb, 0, mxml_string_putc, global)) < 0)
>+     return (-1);
>+ 
>+   if (col > 0)
>+-    mxml_string_putc('\n', ptr);
>++    mxml_string_putc('\n', &buf);
>+ 
>+  /*
>+   * Nul-terminate the buffer...
>+   */
>+ 
>+-  if (ptr[0] >= ptr[1])
>++  if (buf.remaining == 0)
>+   {
>+-    if (bufsize > 0)
>++    if (bufsize != 0)
>+       buffer[bufsize - 1] = '\0';
>+   }
>+   else
>+-    ptr[0][0] = '\0';
>++    *buf.current = '\0';
>+ 
>+  /*
>+   * Return the number of characters...
>+   */
>+ 
>+-  return ((int)(ptr[0] - buffer));
>++  return ((int)(buf.current - buffer));
>+ }
>+ 
>+ 
>+@@ -2674,17 +2681,19 @@ mxml_string_putc(int  ch,		/* I - Character to write *
>+ 
>+ static int				/* O - 0 on success, -1 on failure */
>+ mxml_string_putc(int  ch,		/* I - Character to write */
>+-                 void *p)		/* I - Pointer to string pointers */
>++                 void *p)		/* I - String buffer */
>+ {
>+-  char	**pp;				/* Pointer to string pointers */
>++  _mxml_strbuf_t *buf;			/* String buffer */
>+ 
>++  buf = (_mxml_strbuf_t *)p;
>+ 
>+-  pp = (char **)p;
>++  if (buf->remaining != 0)
>++  {
>++    *buf->current = ch;
>++    buf->remaining--;
>++  }
>+ 
>+-  if (pp[0] < pp[1])
>+-    pp[0][0] = ch;
>+-
>+-  pp[0] ++;
>++  buf->current++;
>+ 
>+   return (0);
>+ }
>-- 
>2.43.0
>

Actions: View | Diff

Attachments on bug 276478: 247801 | 247897 | 248176 | 248232 | 248511 | 248512 | 248731 | 248732