FreeBSD Bugzilla – Attachment 171758 Details for
Bug 210531
[patch] textproc/expat2: update to 2.2.0
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
patch
expat2.patch (text/plain), 32.98 KB, created by
Tijl Coosemans
on 2016-06-24 15:54:59 UTC
(
hide
)
Description:
patch
Filename:
MIME Type:
Creator:
Tijl Coosemans
Created:
2016-06-24 15:54:59 UTC
Size:
32.98 KB
patch
obsolete
>Index: textproc/expat2/Makefile >=================================================================== >--- textproc/expat2/Makefile (revision 417413) >+++ textproc/expat2/Makefile (working copy) >@@ -2,8 +2,7 @@ > # $FreeBSD$ > > PORTNAME= expat >-PORTVERSION= 2.1.1 >-PORTREVISION= 1 >+PORTVERSION= 2.2.0 > CATEGORIES= textproc > MASTER_SITES= SF > >@@ -12,8 +11,7 @@ COMMENT= XML 1.0 parser written in C > > GNU_CONFIGURE= yes > ALL_TARGET= default >-USES= dos2unix libtool pathfix tar:bz2 >-DOS2UNIX_GLOB= *.txt >+USES= libtool pathfix tar:bz2 > USE_LDCONFIG= yes > > post-stage: >Index: textproc/expat2/distinfo >=================================================================== >--- textproc/expat2/distinfo (revision 417413) >+++ textproc/expat2/distinfo (working copy) >@@ -1,3 +1,3 @@ >-TIMESTAMP = 1463705024 >-SHA256 (expat-2.1.1.tar.bz2) = aff584e5a2f759dcfc6d48671e9529f6afe1e30b0cd6a4cec200cbe3f793de67 >-SIZE (expat-2.1.1.tar.bz2) = 405103 >+TIMESTAMP = 1466782039 >+SHA256 (expat-2.2.0.tar.bz2) = d9e50ff2d19b3538bd2127902a89987474e1a4db8e43a66a4d1a712ab9a504ff >+SIZE (expat-2.2.0.tar.bz2) = 414352 >Index: textproc/expat2/files/patch-CVE-2016-0718-v2-2-1 >=================================================================== >--- textproc/expat2/files/patch-CVE-2016-0718-v2-2-1 (revision 417413) >+++ textproc/expat2/files/patch-CVE-2016-0718-v2-2-1 (nonexistent) >@@ -1,754 +0,0 @@ >-From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001 >-From: Sebastian Pipping <sebastian@pipping.org> >-Date: Mon, 2 May 2016 00:02:44 +0200 >-Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1) >- >-* Out of bounds memory access when doing text conversion on malformed input >-* Integer overflow related to memory allocation >- >-Reported by Gustavo Grieco >- >-Patch credits go to >-* Christian Heimes >-* Karl Waclawek >-* Gustavo Grieco >-* Sebastian Pipping >-* Pascal Cuoq >---- >- expat/lib/xmlparse.c | 34 +++++++++----- >- expat/lib/xmltok.c | 115 +++++++++++++++++++++++++++++++++++------------- >- expat/lib/xmltok.h | 10 ++++- >- expat/lib/xmltok_impl.c | 62 +++++++++++++------------- >- 4 files changed, 146 insertions(+), 75 deletions(-) >- >-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c >-index e308c79..13e080d 100644 >---- lib/xmlparse.c >-+++ lib/xmlparse.c >-@@ -2426,11 +2426,11 @@ doContent(XML_Parser parser, >- for (;;) { >- int bufSize; >- int convLen; >-- XmlConvert(enc, >-+ const enum XML_Convert_Result convert_res = XmlConvert(enc, >- &fromPtr, rawNameEnd, >- (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1); >- convLen = (int)(toPtr - (XML_Char *)tag->buf); >-- if (fromPtr == rawNameEnd) { >-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) { >- tag->name.strLen = convLen; >- break; >- } >-@@ -2651,11 +2651,11 @@ doContent(XML_Parser parser, >- if (MUST_CONVERT(enc, s)) { >- for (;;) { >- ICHAR *dataPtr = (ICHAR *)dataBuf; >-- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); >-+ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); >- *eventEndPP = s; >- charDataHandler(handlerArg, dataBuf, >- (int)(dataPtr - (ICHAR *)dataBuf)); >-- if (s == next) >-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) >- break; >- *eventPP = s; >- } >-@@ -3261,11 +3261,11 @@ doCdataSection(XML_Parser parser, >- if (MUST_CONVERT(enc, s)) { >- for (;;) { >- ICHAR *dataPtr = (ICHAR *)dataBuf; >-- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); >-+ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd); >- *eventEndPP = next; >- charDataHandler(handlerArg, dataBuf, >- (int)(dataPtr - (ICHAR *)dataBuf)); >-- if (s == next) >-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) >- break; >- *eventPP = s; >- } >-@@ -5342,6 +5342,7 @@ reportDefault(XML_Parser parser, const ENCODING *enc, >- const char *s, const char *end) >- { >- if (MUST_CONVERT(enc, s)) { >-+ enum XML_Convert_Result convert_res; >- const char **eventPP; >- const char **eventEndPP; >- if (enc == encoding) { >-@@ -5354,11 +5355,11 @@ reportDefault(XML_Parser parser, const ENCODING *enc, >- } >- do { >- ICHAR *dataPtr = (ICHAR *)dataBuf; >-- XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd); >-+ convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd); >- *eventEndPP = s; >- defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf)); >- *eventPP = s; >-- } while (s != end); >-+ } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE)); >- } >- else >- defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s)); >-@@ -6163,8 +6164,8 @@ poolAppend(STRING_POOL *pool, const ENCODING *enc, >- if (!pool->ptr && !poolGrow(pool)) >- return NULL; >- for (;;) { >-- XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); >-- if (ptr == end) >-+ const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); >-+ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) >- break; >- if (!poolGrow(pool)) >- return NULL; >-@@ -6248,8 +6249,13 @@ poolGrow(STRING_POOL *pool) >- } >- } >- if (pool->blocks && pool->start == pool->blocks->s) { >-- int blockSize = (int)(pool->end - pool->start)*2; >-- BLOCK *temp = (BLOCK *) >-+ BLOCK *temp; >-+ int blockSize = (int)((unsigned)(pool->end - pool->start)*2U); >-+ >-+ if (blockSize < 0) >-+ return XML_FALSE; >-+ >-+ temp = (BLOCK *) >- pool->mem->realloc_fcn(pool->blocks, >- (offsetof(BLOCK, s) >- + blockSize * sizeof(XML_Char))); >-@@ -6264,6 +6270,10 @@ poolGrow(STRING_POOL *pool) >- else { >- BLOCK *tem; >- int blockSize = (int)(pool->end - pool->start); >-+ >-+ if (blockSize < 0) >-+ return XML_FALSE; >-+ >- if (blockSize < INIT_BLOCK_SIZE) >- blockSize = INIT_BLOCK_SIZE; >- else >-diff --git a/expat/lib/xmltok.c b/expat/lib/xmltok.c >-index bf09dfc..cb98ce1 100644 >---- lib/xmltok.c >-+++ lib/xmltok.c >-@@ -318,39 +318,55 @@ enum { /* UTF8_cvalN is value of masked first byte of N byte sequence */ >- UTF8_cval4 = 0xf0 >- }; >- >--static void PTRCALL >-+static enum XML_Convert_Result PTRCALL >- utf8_toUtf8(const ENCODING *enc, >- const char **fromP, const char *fromLim, >- char **toP, const char *toLim) >- { >-+ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; >- char *to; >- const char *from; >- if (fromLim - *fromP > toLim - *toP) { >- /* Avoid copying partial characters. */ >-+ res = XML_CONVERT_OUTPUT_EXHAUSTED; >- for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--) >- if (((unsigned char)fromLim[-1] & 0xc0) != 0x80) >- break; >- } >-- for (to = *toP, from = *fromP; from != fromLim; from++, to++) >-+ for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++) >- *to = *from; >- *fromP = from; >- *toP = to; >-+ >-+ if ((to == toLim) && (from < fromLim)) >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >-+ else >-+ return res; >- } >- >--static void PTRCALL >-+static enum XML_Convert_Result PTRCALL >- utf8_toUtf16(const ENCODING *enc, >- const char **fromP, const char *fromLim, >- unsigned short **toP, const unsigned short *toLim) >- { >-+ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; >- unsigned short *to = *toP; >- const char *from = *fromP; >-- while (from != fromLim && to != toLim) { >-+ while (from < fromLim && to < toLim) { >- switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) { >- case BT_LEAD2: >-+ if (fromLim - from < 2) { >-+ res = XML_CONVERT_INPUT_INCOMPLETE; >-+ break; >-+ } >- *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f)); >- from += 2; >- break; >- case BT_LEAD3: >-+ if (fromLim - from < 3) { >-+ res = XML_CONVERT_INPUT_INCOMPLETE; >-+ break; >-+ } >- *to++ = (unsigned short)(((from[0] & 0xf) << 12) >- | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f)); >- from += 3; >-@@ -358,8 +374,14 @@ utf8_toUtf16(const ENCODING *enc, >- case BT_LEAD4: >- { >- unsigned long n; >-- if (to + 1 == toLim) >-+ if (toLim - to < 2) { >-+ res = XML_CONVERT_OUTPUT_EXHAUSTED; >- goto after; >-+ } >-+ if (fromLim - from < 4) { >-+ res = XML_CONVERT_INPUT_INCOMPLETE; >-+ goto after; >-+ } >- n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12) >- | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f); >- n -= 0x10000; >-@@ -377,6 +399,7 @@ utf8_toUtf16(const ENCODING *enc, >- after: >- *fromP = from; >- *toP = to; >-+ return res; >- } >- >- #ifdef XML_NS >-@@ -425,7 +448,7 @@ static const struct normal_encoding internal_utf8_encoding = { >- STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_) >- }; >- >--static void PTRCALL >-+static enum XML_Convert_Result PTRCALL >- latin1_toUtf8(const ENCODING *enc, >- const char **fromP, const char *fromLim, >- char **toP, const char *toLim) >-@@ -433,30 +456,35 @@ latin1_toUtf8(const ENCODING *enc, >- for (;;) { >- unsigned char c; >- if (*fromP == fromLim) >-- break; >-+ return XML_CONVERT_COMPLETED; >- c = (unsigned char)**fromP; >- if (c & 0x80) { >- if (toLim - *toP < 2) >-- break; >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >- *(*toP)++ = (char)((c >> 6) | UTF8_cval2); >- *(*toP)++ = (char)((c & 0x3f) | 0x80); >- (*fromP)++; >- } >- else { >- if (*toP == toLim) >-- break; >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >- *(*toP)++ = *(*fromP)++; >- } >- } >- } >- >--static void PTRCALL >-+static enum XML_Convert_Result PTRCALL >- latin1_toUtf16(const ENCODING *enc, >- const char **fromP, const char *fromLim, >- unsigned short **toP, const unsigned short *toLim) >- { >-- while (*fromP != fromLim && *toP != toLim) >-+ while (*fromP < fromLim && *toP < toLim) >- *(*toP)++ = (unsigned char)*(*fromP)++; >-+ >-+ if ((*toP == toLim) && (*fromP < fromLim)) >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >-+ else >-+ return XML_CONVERT_COMPLETED; >- } >- >- #ifdef XML_NS >-@@ -483,13 +511,18 @@ static const struct normal_encoding latin1_encoding = { >- STANDARD_VTABLE(sb_) >- }; >- >--static void PTRCALL >-+static enum XML_Convert_Result PTRCALL >- ascii_toUtf8(const ENCODING *enc, >- const char **fromP, const char *fromLim, >- char **toP, const char *toLim) >- { >-- while (*fromP != fromLim && *toP != toLim) >-+ while (*fromP < fromLim && *toP < toLim) >- *(*toP)++ = *(*fromP)++; >-+ >-+ if ((*toP == toLim) && (*fromP < fromLim)) >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >-+ else >-+ return XML_CONVERT_COMPLETED; >- } >- >- #ifdef XML_NS >-@@ -536,13 +569,14 @@ unicode_byte_type(char hi, char lo) >- } >- >- #define DEFINE_UTF16_TO_UTF8(E) \ >--static void PTRCALL \ >-+static enum XML_Convert_Result PTRCALL \ >- E ## toUtf8(const ENCODING *enc, \ >- const char **fromP, const char *fromLim, \ >- char **toP, const char *toLim) \ >- { \ >-- const char *from; \ >-- for (from = *fromP; from != fromLim; from += 2) { \ >-+ const char *from = *fromP; \ >-+ fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \ >-+ for (; from < fromLim; from += 2) { \ >- int plane; \ >- unsigned char lo2; \ >- unsigned char lo = GET_LO(from); \ >-@@ -552,7 +586,7 @@ E ## toUtf8(const ENCODING *enc, \ >- if (lo < 0x80) { \ >- if (*toP == toLim) { \ >- *fromP = from; \ >-- return; \ >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \ >- } \ >- *(*toP)++ = lo; \ >- break; \ >-@@ -562,7 +596,7 @@ E ## toUtf8(const ENCODING *enc, \ >- case 0x4: case 0x5: case 0x6: case 0x7: \ >- if (toLim - *toP < 2) { \ >- *fromP = from; \ >-- return; \ >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \ >- } \ >- *(*toP)++ = ((lo >> 6) | (hi << 2) | UTF8_cval2); \ >- *(*toP)++ = ((lo & 0x3f) | 0x80); \ >-@@ -570,7 +604,7 @@ E ## toUtf8(const ENCODING *enc, \ >- default: \ >- if (toLim - *toP < 3) { \ >- *fromP = from; \ >-- return; \ >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \ >- } \ >- /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \ >- *(*toP)++ = ((hi >> 4) | UTF8_cval3); \ >-@@ -580,7 +614,11 @@ E ## toUtf8(const ENCODING *enc, \ >- case 0xD8: case 0xD9: case 0xDA: case 0xDB: \ >- if (toLim - *toP < 4) { \ >- *fromP = from; \ >-- return; \ >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \ >-+ } \ >-+ if (fromLim - from < 4) { \ >-+ *fromP = from; \ >-+ return XML_CONVERT_INPUT_INCOMPLETE; \ >- } \ >- plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \ >- *(*toP)++ = ((plane >> 2) | UTF8_cval4); \ >-@@ -596,20 +634,32 @@ E ## toUtf8(const ENCODING *enc, \ >- } \ >- } \ >- *fromP = from; \ >-+ if (from < fromLim) \ >-+ return XML_CONVERT_INPUT_INCOMPLETE; \ >-+ else \ >-+ return XML_CONVERT_COMPLETED; \ >- } >- >- #define DEFINE_UTF16_TO_UTF16(E) \ >--static void PTRCALL \ >-+static enum XML_Convert_Result PTRCALL \ >- E ## toUtf16(const ENCODING *enc, \ >- const char **fromP, const char *fromLim, \ >- unsigned short **toP, const unsigned short *toLim) \ >- { \ >-+ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \ >-+ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \ >- /* Avoid copying first half only of surrogate */ \ >- if (fromLim - *fromP > ((toLim - *toP) << 1) \ >-- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \ >-+ && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \ >- fromLim -= 2; \ >-- for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \ >-+ res = XML_CONVERT_INPUT_INCOMPLETE; \ >-+ } \ >-+ for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \ >- *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \ >-+ if ((*toP == toLim) && (*fromP < fromLim)) \ >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; \ >-+ else \ >-+ return res; \ >- } >- >- #define SET2(ptr, ch) \ >-@@ -1288,7 +1338,7 @@ unknown_isInvalid(const ENCODING *enc, const char *p) >- return (c & ~0xFFFF) || checkCharRefNumber(c) < 0; >- } >- >--static void PTRCALL >-+static enum XML_Convert_Result PTRCALL >- unknown_toUtf8(const ENCODING *enc, >- const char **fromP, const char *fromLim, >- char **toP, const char *toLim) >-@@ -1299,21 +1349,21 @@ unknown_toUtf8(const ENCODING *enc, >- const char *utf8; >- int n; >- if (*fromP == fromLim) >-- break; >-+ return XML_CONVERT_COMPLETED; >- utf8 = uenc->utf8[(unsigned char)**fromP]; >- n = *utf8++; >- if (n == 0) { >- int c = uenc->convert(uenc->userData, *fromP); >- n = XmlUtf8Encode(c, buf); >- if (n > toLim - *toP) >-- break; >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >- utf8 = buf; >- *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP] >- - (BT_LEAD2 - 2)); >- } >- else { >- if (n > toLim - *toP) >-- break; >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >- (*fromP)++; >- } >- do { >-@@ -1322,13 +1372,13 @@ unknown_toUtf8(const ENCODING *enc, >- } >- } >- >--static void PTRCALL >-+static enum XML_Convert_Result PTRCALL >- unknown_toUtf16(const ENCODING *enc, >- const char **fromP, const char *fromLim, >- unsigned short **toP, const unsigned short *toLim) >- { >- const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc); >-- while (*fromP != fromLim && *toP != toLim) { >-+ while (*fromP < fromLim && *toP < toLim) { >- unsigned short c = uenc->utf16[(unsigned char)**fromP]; >- if (c == 0) { >- c = (unsigned short) >-@@ -1340,6 +1390,11 @@ unknown_toUtf16(const ENCODING *enc, >- (*fromP)++; >- *(*toP)++ = c; >- } >-+ >-+ if ((*toP == toLim) && (*fromP < fromLim)) >-+ return XML_CONVERT_OUTPUT_EXHAUSTED; >-+ else >-+ return XML_CONVERT_COMPLETED; >- } >- >- ENCODING * >-@@ -1503,7 +1558,7 @@ initScan(const ENCODING * const *encodingTable, >- { >- const ENCODING **encPtr; >- >-- if (ptr == end) >-+ if (ptr >= end) >- return XML_TOK_NONE; >- encPtr = enc->encPtr; >- if (ptr + 1 == end) { >-diff --git a/expat/lib/xmltok.h b/expat/lib/xmltok.h >-index ca867aa..752007e 100644 >---- lib/xmltok.h >-+++ lib/xmltok.h >-@@ -130,6 +130,12 @@ typedef int (PTRCALL *SCANNER)(const ENCODING *, >- const char *, >- const char **); >- >-+enum XML_Convert_Result { >-+ XML_CONVERT_COMPLETED = 0, >-+ XML_CONVERT_INPUT_INCOMPLETE = 1, >-+ XML_CONVERT_OUTPUT_EXHAUSTED = 2 /* and therefore potentially input remaining as well */ >-+}; >-+ >- struct encoding { >- SCANNER scanners[XML_N_STATES]; >- SCANNER literalScanners[XML_N_LITERAL_TYPES]; >-@@ -158,12 +164,12 @@ struct encoding { >- const char *ptr, >- const char *end, >- const char **badPtr); >-- void (PTRCALL *utf8Convert)(const ENCODING *enc, >-+ enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc, >- const char **fromP, >- const char *fromLim, >- char **toP, >- const char *toLim); >-- void (PTRCALL *utf16Convert)(const ENCODING *enc, >-+ enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc, >- const char **fromP, >- const char *fromLim, >- unsigned short **toP, >-diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c >-index 9c2895b..6c5a3ba 100644 >---- lib/xmltok_impl.c >-+++ lib/xmltok_impl.c >-@@ -93,13 +93,13 @@ static int PTRCALL >- PREFIX(scanComment)(const ENCODING *enc, const char *ptr, >- const char *end, const char **nextTokPtr) >- { >-- if (ptr != end) { >-+ if (ptr < end) { >- if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) { >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >- ptr += MINBPC(enc); >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- INVALID_CASES(ptr, nextTokPtr) >- case BT_MINUS: >-@@ -147,7 +147,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- case BT_PERCNT: >- if (ptr + MINBPC(enc) == end) >-@@ -233,7 +233,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- case BT_S: case BT_CR: case BT_LF: >-@@ -242,7 +242,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr, >- return XML_TOK_INVALID; >- } >- ptr += MINBPC(enc); >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- INVALID_CASES(ptr, nextTokPtr) >- case BT_QUEST: >-@@ -305,7 +305,7 @@ static int PTRCALL >- PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr, >- const char *end, const char **nextTokPtr) >- { >-- if (ptr == end) >-+ if (ptr >= end) >- return XML_TOK_NONE; >- if (MINBPC(enc) > 1) { >- size_t n = end - ptr; >-@@ -348,7 +348,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr, >- ptr += MINBPC(enc); >- break; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- #define LEAD_CASE(n) \ >- case BT_LEAD ## n: \ >-@@ -391,11 +391,11 @@ PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- case BT_S: case BT_CR: case BT_LF: >-- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { >-+ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { >- switch (BYTE_TYPE(enc, ptr)) { >- case BT_S: case BT_CR: case BT_LF: >- break; >-@@ -432,7 +432,7 @@ static int PTRCALL >- PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr, >- const char *end, const char **nextTokPtr) >- { >-- if (ptr != end) { >-+ if (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- case BT_DIGIT: >- case BT_HEX: >-@@ -441,7 +441,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { >-+ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { >- switch (BYTE_TYPE(enc, ptr)) { >- case BT_DIGIT: >- case BT_HEX: >-@@ -464,7 +464,7 @@ static int PTRCALL >- PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr, >- const char *end, const char **nextTokPtr) >- { >-- if (ptr != end) { >-+ if (ptr < end) { >- if (CHAR_MATCHES(enc, ptr, ASCII_x)) >- return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr); >- switch (BYTE_TYPE(enc, ptr)) { >-@@ -474,7 +474,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { >-+ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) { >- switch (BYTE_TYPE(enc, ptr)) { >- case BT_DIGIT: >- break; >-@@ -506,7 +506,7 @@ PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- case BT_SEMI: >-@@ -529,7 +529,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end, >- #ifdef XML_NS >- int hadColon = 0; >- #endif >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- #ifdef XML_NS >-@@ -716,7 +716,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end, >- hadColon = 0; >- #endif >- /* we have a start-tag */ >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- #ifdef XML_NS >-@@ -740,7 +740,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end, >- case BT_S: case BT_CR: case BT_LF: >- { >- ptr += MINBPC(enc); >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr) >- case BT_GT: >-@@ -785,7 +785,7 @@ static int PTRCALL >- PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end, >- const char **nextTokPtr) >- { >-- if (ptr == end) >-+ if (ptr >= end) >- return XML_TOK_NONE; >- if (MINBPC(enc) > 1) { >- size_t n = end - ptr; >-@@ -832,7 +832,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end, >- ptr += MINBPC(enc); >- break; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- #define LEAD_CASE(n) \ >- case BT_LEAD ## n: \ >-@@ -895,7 +895,7 @@ PREFIX(scanPercent)(const ENCODING *enc, const char *ptr, const char *end, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- case BT_SEMI: >-@@ -921,7 +921,7 @@ PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- case BT_CR: case BT_LF: case BT_S: >-@@ -941,7 +941,7 @@ PREFIX(scanLit)(int open, const ENCODING *enc, >- const char *ptr, const char *end, >- const char **nextTokPtr) >- { >-- while (ptr != end) { >-+ while (ptr < end) { >- int t = BYTE_TYPE(enc, ptr); >- switch (t) { >- INVALID_CASES(ptr, nextTokPtr) >-@@ -973,7 +973,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end, >- const char **nextTokPtr) >- { >- int tok; >-- if (ptr == end) >-+ if (ptr >= end) >- return XML_TOK_NONE; >- if (MINBPC(enc) > 1) { >- size_t n = end - ptr; >-@@ -1141,7 +1141,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end, >- *nextTokPtr = ptr; >- return XML_TOK_INVALID; >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) >- case BT_GT: case BT_RPAR: case BT_COMMA: >-@@ -1204,10 +1204,10 @@ PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr, >- const char *end, const char **nextTokPtr) >- { >- const char *start; >-- if (ptr == end) >-+ if (ptr >= end) >- return XML_TOK_NONE; >- start = ptr; >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- #define LEAD_CASE(n) \ >- case BT_LEAD ## n: ptr += n; break; >-@@ -1262,10 +1262,10 @@ PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr, >- const char *end, const char **nextTokPtr) >- { >- const char *start; >-- if (ptr == end) >-+ if (ptr >= end) >- return XML_TOK_NONE; >- start = ptr; >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- #define LEAD_CASE(n) \ >- case BT_LEAD ## n: ptr += n; break; >-@@ -1326,7 +1326,7 @@ PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr, >- end = ptr + n; >- } >- } >-- while (ptr != end) { >-+ while (ptr < end) { >- switch (BYTE_TYPE(enc, ptr)) { >- INVALID_CASES(ptr, nextTokPtr) >- case BT_LT: >-@@ -1373,7 +1373,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end, >- { >- ptr += MINBPC(enc); >- end -= MINBPC(enc); >-- for (; ptr != end; ptr += MINBPC(enc)) { >-+ for (; ptr < end; ptr += MINBPC(enc)) { >- switch (BYTE_TYPE(enc, ptr)) { >- case BT_DIGIT: >- case BT_HEX: >-@@ -1760,7 +1760,7 @@ PREFIX(updatePosition)(const ENCODING *enc, >- case BT_CR: >- pos->lineNumber++; >- ptr += MINBPC(enc); >-- if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF) >-+ if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF) >- ptr += MINBPC(enc); >- pos->columnNumber = (XML_Size)-1; >- break; >--- >-2.8.2 > >Property changes on: textproc/expat2/files/patch-CVE-2016-0718-v2-2-1 >___________________________________________________________________ >Deleted: fbsd:nokeywords >## -1 +0,0 ## >-yes >\ No newline at end of property >Deleted: svn:eol-style >## -1 +0,0 ## >-native >\ No newline at end of property >Deleted: svn:mime-type >## -1 +0,0 ## >-text/plain >\ No newline at end of property >Index: textproc/expat2/files/patch-cve-2012-6702-plus-cve-2016-5300-v1 >=================================================================== >--- textproc/expat2/files/patch-cve-2012-6702-plus-cve-2016-5300-v1 (revision 417413) >+++ textproc/expat2/files/patch-cve-2012-6702-plus-cve-2016-5300-v1 (nonexistent) >@@ -1,134 +0,0 @@ >-From cb31522769d11a375078a073cba94e7176cb48a4 Mon Sep 17 00:00:00 2001 >-From: Sebastian Pipping <sebastian@pipping.org> >-Date: Wed, 16 Mar 2016 15:30:12 +0100 >-Subject: [PATCH] Resolve call to srand, use more entropy (patch version 1.0) >- >-Squashed backport against vanilla Expat 2.1.1, addressing: >-* CVE-2012-6702 -- unanticipated internal calls to srand >-* CVE-2016-5300 -- use of too little entropy >- >-Since commit e3e81a6d9f0885ea02d3979151c358f314bf3d6d >-(released with Expat 2.1.0) Expat called srand by itself >-from inside generate_hash_secret_salt for an instance >-of XML_Parser if XML_SetHashSalt was either (a) not called >-for that instance or if (b) salt 0 was passed to XML_SetHashSalt >-prior to parsing. That call to srand passed (rather litle) >-entropy extracted from the current time as a seed for srand. >- >-That call to srand (1) broke repeatability for code calling >-srand with a non-random seed prior to parsing with Expat, >-and (2) resulted in a rather small set of hashing salts in >-Expat in total. >- >-For a short- to mid-term fix, the new approach avoids calling >-srand altogether, extracts more entropy out of the clock and >-other sources, too. >- >-For a long term fix, we may want to read sizeof(long) bytes >-from a source like getrandom(..) on Linux, and from similar >-sources on other supported architectures. >- >-https://bugzilla.redhat.com/show_bug.cgi?id=1197087 >---- >- expat/CMakeLists.txt | 3 +++ >- expat/lib/xmlparse.c | 48 +++++++++++++++++++++++++++++++++++++++++------- >- 2 files changed, 44 insertions(+), 7 deletions(-) >- >-diff --git a/expat/CMakeLists.txt b/expat/CMakeLists.txt >-index 353627e..524d514 100755 >---- CMakeLists.txt >-+++ CMakeLists.txt >-@@ -41,6 +41,9 @@ include_directories(${CMAKE_BINARY_DIR} ${CMAKE_SOURCE_DIR}/lib) >- if(MSVC) >- add_definitions(-D_CRT_SECURE_NO_WARNINGS -wd4996) >- endif(MSVC) >-+if(WIN32) >-+ add_definitions(-DCOMPILED_FROM_DSP) >-+endif(WIN32) >- >- set(expat_SRCS >- lib/xmlparse.c >-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c >-index e308c79..c5f942f 100644 >---- lib/xmlparse.c >-+++ lib/xmlparse.c >-@@ -6,7 +6,14 @@ >- #include <string.h> /* memset(), memcpy() */ >- #include <assert.h> >- #include <limits.h> /* UINT_MAX */ >--#include <time.h> /* time() */ >-+ >-+#ifdef COMPILED_FROM_DSP >-+#define getpid GetCurrentProcessId >-+#else >-+#include <sys/time.h> /* gettimeofday() */ >-+#include <sys/types.h> /* getpid() */ >-+#include <unistd.h> /* getpid() */ >-+#endif >- >- #define XML_BUILDING_EXPAT 1 >- >-@@ -432,7 +439,7 @@ static ELEMENT_TYPE * >- getElementType(XML_Parser parser, const ENCODING *enc, >- const char *ptr, const char *end); >- >--static unsigned long generate_hash_secret_salt(void); >-+static unsigned long generate_hash_secret_salt(XML_Parser parser); >- static XML_Bool startParsing(XML_Parser parser); >- >- static XML_Parser >-@@ -691,11 +698,38 @@ static const XML_Char implicitContext[] = { >- }; >- >- static unsigned long >--generate_hash_secret_salt(void) >-+gather_time_entropy(void) >- { >-- unsigned int seed = time(NULL) % UINT_MAX; >-- srand(seed); >-- return rand(); >-+#ifdef COMPILED_FROM_DSP >-+ FILETIME ft; >-+ GetSystemTimeAsFileTime(&ft); /* never fails */ >-+ return ft.dwHighDateTime ^ ft.dwLowDateTime; >-+#else >-+ struct timeval tv; >-+ int gettimeofday_res; >-+ >-+ gettimeofday_res = gettimeofday(&tv, NULL); >-+ assert (gettimeofday_res == 0); >-+ >-+ /* Microseconds time is <20 bits entropy */ >-+ return tv.tv_usec; >-+#endif >-+} >-+ >-+static unsigned long >-+generate_hash_secret_salt(XML_Parser parser) >-+{ >-+ /* Process ID is 0 bits entropy if attacker has local access >-+ * XML_Parser address is few bits of entropy if attacker has local access */ >-+ const unsigned long entropy = >-+ gather_time_entropy() ^ getpid() ^ (unsigned long)parser; >-+ >-+ /* Factors are 2^31-1 and 2^61-1 (Mersenne primes M31 and M61) */ >-+ if (sizeof(unsigned long) == 4) { >-+ return entropy * 2147483647; >-+ } else { >-+ return entropy * 2305843009213693951; >-+ } >- } >- >- static XML_Bool /* only valid for root parser */ >-@@ -703,7 +737,7 @@ startParsing(XML_Parser parser) >- { >- /* hash functions must be initialized before setContext() is called */ >- if (hash_secret_salt == 0) >-- hash_secret_salt = generate_hash_secret_salt(); >-+ hash_secret_salt = generate_hash_secret_salt(parser); >- if (ns) { >- /* implicit context only set for root parser, since child >- parsers (i.e. external entity parsers) will inherit it >--- >-2.8.2 >- > >Property changes on: textproc/expat2/files/patch-cve-2012-6702-plus-cve-2016-5300-v1 >___________________________________________________________________ >Deleted: fbsd:nokeywords >## -1 +0,0 ## >-yes >\ No newline at end of property >Deleted: svn:mime-type >## -1 +0,0 ## >-text/plain >\ No newline at end of property >Index: textproc/expat2/pkg-plist >=================================================================== >--- textproc/expat2/pkg-plist (revision 417413) >+++ textproc/expat2/pkg-plist (working copy) >@@ -5,7 +5,7 @@ include/expat_external.h > lib/libexpat.a > lib/libexpat.so > lib/libexpat.so.1 >-lib/libexpat.so.1.6.0 >+lib/libexpat.so.1.6.2 > lib/libexpat.so.6 > libdata/pkgconfig/expat.pc > man/man1/xmlwf.1.gz
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=171758">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 210531
: 171758