organicmaps/libexpat
13
Fork 0
mirror of https://github.com/libexpat/libexpat.git synced 2025-04-07 22:19:12 +00:00
Code Issues 1 Projects Releases Wiki Activity Actions

Merge pull request #650 from libexpat/issue-649-fix-overeager-dtd-destruction

Browse source 
[CVE-2022-43680] Fix overeager DTD destruction (fixes #649)
This commit is contained in:
Sebastian Pipping 2022-10-24 16:34:19 +02:00 • committed by GitHub
commit 56967f83d6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 62 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
expat/Changes
View file

@ -3,6 +3,11 @@ NOTE: We are looking for help with a few things:
If you can help, please get in touch. Thanks!
Release x.x.x xxx xxxxxxxxxxxx xx xxxx
Security fixes:
#616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager
destruction of a shared DTD in function
XML_ExternalEntityParserCreate in out-of-memory situations
Bug fixes:
#612 #645 Fix curruption from undefined entities
#613 #654 Fix case when parsing was suspended while processing nested

8
expat/lib/xmlparse.c
View file

@ -1068,6 +1068,14 @@ parserCreate(const XML_Char *encodingName,
parserInit(parser, encodingName);
if (encodingName && ! parser->m_protocolEncodingName) {
if (dtd) {
// We need to stop the upcoming call to XML_ParserFree from happily
// destroying parser->m_dtd because the DTD is shared with the parent
// parser and the only guard that keeps XML_ParserFree from destroying
// parser->m_dtd is parser->m_isParamEntity but it will be set to
// XML_TRUE only later in XML_ExternalEntityParserCreate (or not at all).
parser->m_dtd = NULL;
}
XML_ParserFree(parser);
return NULL;
}

49
expat/tests/runtests.c
View file

@ -10208,6 +10208,53 @@ START_TEST(test_alloc_long_notation) {
}
END_TEST
static int XMLCALL
external_entity_parser_create_alloc_fail_handler(XML_Parser parser,
const XML_Char *context,
const XML_Char *base,
const XML_Char *systemId,
const XML_Char *publicId) {
UNUSED_P(base);
UNUSED_P(systemId);
UNUSED_P(publicId);
if (context != NULL)
fail("Unexpected non-NULL context");
// The following number intends to fail the upcoming allocation in line
// "parser->m_protocolEncodingName = copyString(encodingName,
// &(parser->m_mem));" in function parserInit.
allocation_count = 3;
const XML_Char *const encodingName = XCS("UTF-8"); // needs something non-NULL
const XML_Parser ext_parser
= XML_ExternalEntityParserCreate(parser, context, encodingName);
if (ext_parser != NULL)
fail(
"Call to XML_ExternalEntityParserCreate was expected to fail out-of-memory");
allocation_count = ALLOC_ALWAYS_SUCCEED;
return XML_STATUS_ERROR;
}
START_TEST(test_alloc_reset_after_external_entity_parser_create_fail) {
const char *const text = "<!DOCTYPE doc SYSTEM 'foo'><doc/>";
XML_SetExternalEntityRefHandler(
g_parser, external_entity_parser_create_alloc_fail_handler);
XML_SetParamEntityParsing(g_parser, XML_PARAM_ENTITY_PARSING_ALWAYS);
if (XML_Parse(g_parser, text, (int)strlen(text), XML_TRUE)
!= XML_STATUS_ERROR)
fail("Call to parse was expected to fail");
if (XML_GetErrorCode(g_parser) != XML_ERROR_EXTERNAL_ENTITY_HANDLING)
fail("Call to parse was expected to fail from the external entity handler");
XML_ParserReset(g_parser, NULL);
}
END_TEST
static void
nsalloc_setup(void) {
XML_Memory_Handling_Suite memsuite = {duff_allocator, duff_reallocator, free};
@ -12401,6 +12448,8 @@ make_suite(void) {
tcase_add_test(tc_alloc, test_alloc_long_public_id);
tcase_add_test(tc_alloc, test_alloc_long_entity_value);
tcase_add_test(tc_alloc, test_alloc_long_notation);
tcase_add_test__ifdef_xml_dtd(
tc_alloc, test_alloc_reset_after_external_entity_parser_create_fail);
suite_add_tcase(s, tc_nsalloc);
tcase_add_checked_fixture(tc_nsalloc, nsalloc_setup, nsalloc_teardown);