Attachment #170093 for bug #209360

View | Details | Raw Unified | Return to bug 209360
Collapse All | Expand All




# $FreeBSD$

PORTNAME=	expat
PORTVERSION=	2.1.1
PORTREVISION=	3
CATEGORIES=	textproc
MASTER_SITES=	SF



GNU_CONFIGURE=	yes
ALL_TARGET=	default
USES=		libtool pathfix tar:bz2
USE_LDCONFIG=	yes

EXTRA_PATCHES=	${FILESDIR}/CVE-2015-1283.patch:-p1

post-patch:
	@${REINPLACE_CMD} -e '/^DESTDIR =/d' ${WRKSRC}/Makefile.in

post-stage:
	${LN} -s libexpat.so.1 ${STAGEDIR}${PREFIX}/lib/libexpat.so.6


Lines 1-2 Link Here

(-)textproc/expat2/distinfo (-2 / +2 lines)
1	SHA256 (expat-2.1.0.tar.gz) = 823705472f816df21c8f6aa026dd162b280806838bb55b3432b0fb1fcca7eb86	1	SHA256 (expat-2.1.1.tar.bz2) = aff584e5a2f759dcfc6d48671e9529f6afe1e30b0cd6a4cec200cbe3f793de67
2	SIZE (expat-2.1.0.tar.gz) = 562616	2	SIZE (expat-2.1.1.tar.bz2) = 405103




Found at https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c on 2015-07-27.  Modified: replaced path parser/expat/lib/xmlparse.c with lib/xmlparse.c.
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -1646,29 +1646,40 @@ XML_ParseBuffer(XML_Parser parser, int l
   XmlUpdatePosition(encoding, positionPtr, bufferPtr, &position);
   positionPtr = bufferPtr;
   return result;
 }
 
 void * XMLCALL
 XML_GetBuffer(XML_Parser parser, int len)
 {
+/* BEGIN MOZILLA CHANGE (sanity check len) */
+  if (len < 0) {
+    errorCode = XML_ERROR_NO_MEMORY;
+    return NULL;
+  }
+/* END MOZILLA CHANGE */
   switch (ps_parsing) {
   case XML_SUSPENDED:
     errorCode = XML_ERROR_SUSPENDED;
     return NULL;
   case XML_FINISHED:
     errorCode = XML_ERROR_FINISHED;
     return NULL;
   default: ;
   }
 
   if (len > bufferLim - bufferEnd) {
-    /* FIXME avoid integer overflow */
     int neededSize = len + (int)(bufferEnd - bufferPtr);
+/* BEGIN MOZILLA CHANGE (sanity check neededSize) */
+    if (neededSize < 0) {
+      errorCode = XML_ERROR_NO_MEMORY;
+      return NULL;
+    }
+/* END MOZILLA CHANGE */
 #ifdef XML_CONTEXT_BYTES
     int keep = (int)(bufferPtr - buffer);
 
     if (keep > XML_CONTEXT_BYTES)
       keep = XML_CONTEXT_BYTES;
     neededSize += keep;
 #endif  /* defined XML_CONTEXT_BYTES */
     if (neededSize  <= bufferLim - buffer) {
@@ -1687,17 +1698,25 @@ XML_GetBuffer(XML_Parser parser, int len
     }
     else {
       char *newBuf;
       int bufferSize = (int)(bufferLim - bufferPtr);
       if (bufferSize == 0)
         bufferSize = INIT_BUFFER_SIZE;
       do {
         bufferSize *= 2;
-      } while (bufferSize < neededSize);
+/* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */
+      } while (bufferSize < neededSize && bufferSize > 0);
+/* END MOZILLA CHANGE */
+/* BEGIN MOZILLA CHANGE (sanity check bufferSize) */
+      if (bufferSize <= 0) {
+        errorCode = XML_ERROR_NO_MEMORY;
+        return NULL;
+      }
+/* END MOZILLA CHANGE */
       newBuf = (char *)MALLOC(bufferSize);
       if (newBuf == 0) {
         errorCode = XML_ERROR_NO_MEMORY;
         return NULL;
       }
       bufferLim = newBuf + bufferSize;
 #ifdef XML_CONTEXT_BYTES
       if (bufferPtr) {





Lines 1-5 Link Here

(-)textproc/expat2/pkg-plist (+1 lines)
1	bin/xmlwf	1	bin/xmlwf
2	include/expat.h	2	include/expat.h
		3	include/expat_config.h
3	include/expat_external.h	4	include/expat_external.h
4	lib/libexpat.a	5	lib/libexpat.a
5	lib/libexpat.so	6	lib/libexpat.so

Return to bug 209360

Lines 2-9 Link Here

(-)textproc/expat2/Makefile (-8 / +2 lines)
2	# $FreeBSD$	2	# $FreeBSD$
3		3
4	PORTNAME= expat	4	PORTNAME= expat
5	PORTVERSION= 2.1.0	5	PORTVERSION= 2.1.1
6	PORTREVISION= 3
7	CATEGORIES= textproc	6	CATEGORIES= textproc
8	MASTER_SITES= SF	7	MASTER_SITES= SF
9		8
Lines 12-25 COMMENT= XML 1.0 parser written in C Link Here
12		11
13	GNU_CONFIGURE= yes	12	GNU_CONFIGURE= yes
14	ALL_TARGET= default	13	ALL_TARGET= default
15	USES= libtool pathfix	14	USES= libtool pathfix tar:bz2
16	USE_LDCONFIG= yes	15	USE_LDCONFIG= yes
17		16
18	EXTRA_PATCHES= ${FILESDIR}/CVE-2015-1283.patch:-p1
19
20	post-patch:
21	@${REINPLACE_CMD} -e '/^DESTDIR =/d' ${WRKSRC}/Makefile.in
22
23	post-stage:	17	post-stage:
24	${LN} -s libexpat.so.1 ${STAGEDIR}${PREFIX}/lib/libexpat.so.6	18	${LN} -s libexpat.so.1 ${STAGEDIR}${PREFIX}/lib/libexpat.so.6
25		19

Lines 1-77 Link Here

(-)textproc/expat2/files/CVE-2015-1283.patch (-77 lines)
1	Found at https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c on 2015-07-27. Modified: replaced path parser/expat/lib/xmlparse.c with lib/xmlparse.c.
2	diff --git a/lib/xmlparse.c b/lib/xmlparse.c
3	--- a/lib/xmlparse.c
4	+++ b/lib/xmlparse.c
5	@@ -1646,29 +1646,40 @@ XML_ParseBuffer(XML_Parser parser, int l
6	XmlUpdatePosition(encoding, positionPtr, bufferPtr, &position);
7	positionPtr = bufferPtr;
8	return result;
9	}
10
11	void * XMLCALL
12	XML_GetBuffer(XML_Parser parser, int len)
13	{
14	+/* BEGIN MOZILLA CHANGE (sanity check len) */
15	+ if (len < 0) {
16	+ errorCode = XML_ERROR_NO_MEMORY;
17	+ return NULL;
18	+ }
19	+/* END MOZILLA CHANGE */
20	switch (ps_parsing) {
21	case XML_SUSPENDED:
22	errorCode = XML_ERROR_SUSPENDED;
23	return NULL;
24	case XML_FINISHED:
25	errorCode = XML_ERROR_FINISHED;
26	return NULL;
27	default: ;
28	}
29
30	if (len > bufferLim - bufferEnd) {
31	- /* FIXME avoid integer overflow */
32	int neededSize = len + (int)(bufferEnd - bufferPtr);
33	+/* BEGIN MOZILLA CHANGE (sanity check neededSize) */
34	+ if (neededSize < 0) {
35	+ errorCode = XML_ERROR_NO_MEMORY;
36	+ return NULL;
37	+ }
38	+/* END MOZILLA CHANGE */
39	#ifdef XML_CONTEXT_BYTES
40	int keep = (int)(bufferPtr - buffer);
41
42	if (keep > XML_CONTEXT_BYTES)
43	keep = XML_CONTEXT_BYTES;
44	neededSize += keep;
45	#endif /* defined XML_CONTEXT_BYTES */
46	if (neededSize <= bufferLim - buffer) {
47	@@ -1687,17 +1698,25 @@ XML_GetBuffer(XML_Parser parser, int len
48	}
49	else {
50	char *newBuf;
51	int bufferSize = (int)(bufferLim - bufferPtr);
52	if (bufferSize == 0)
53	bufferSize = INIT_BUFFER_SIZE;
54	do {
55	bufferSize *= 2;
56	- } while (bufferSize < neededSize);
57	+/* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */
58	+ } while (bufferSize < neededSize && bufferSize > 0);
59	+/* END MOZILLA CHANGE */
60	+/* BEGIN MOZILLA CHANGE (sanity check bufferSize) */
61	+ if (bufferSize <= 0) {
62	+ errorCode = XML_ERROR_NO_MEMORY;
63	+ return NULL;
64	+ }
65	+/* END MOZILLA CHANGE */
66	newBuf = (char *)MALLOC(bufferSize);
67	if (newBuf == 0) {
68	errorCode = XML_ERROR_NO_MEMORY;
69	return NULL;
70	}
71	bufferLim = newBuf + bufferSize;
72	#ifdef XML_CONTEXT_BYTES
73	if (bufferPtr) {
74
75
76
77