diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2020-11-23 14:33:06 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2020-11-23 20:58:30 +0100 |
| commit | f3e4a3a4b491daedd0d7e2d2bab2da30e36c345f (patch) | |
| tree | 760b76fc024068c9b44936b34164f0f5008c821d /external | |
| parent | 943c108071c82541c619ea3071fe97634a7a8bab (diff) | |
CVE-2020-25713 raptor2: malformed input file can lead to a segfault
due to an out of bounds array access in
raptor_xml_writer_start_element_common
See:
https://bugs.mageia.org/show_bug.cgi?id=27605
https://www.openwall.com/lists/oss-security/2020/11/13/1
Change-Id: Ida4783a61412ffce868eacf81310da338d3e2df1
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/106423
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'external')
| -rw-r--r-- | external/redland/UnpackedTarball_raptor.mk | 1 | ||||
| -rw-r--r-- | external/redland/raptor/raptor-fix-oob.patch.1 | 14 |
2 files changed, 15 insertions, 0 deletions
diff --git a/external/redland/UnpackedTarball_raptor.mk b/external/redland/UnpackedTarball_raptor.mk index 2e0ef98fa2b5..3a4d7f17a471 100644 --- a/external/redland/UnpackedTarball_raptor.mk +++ b/external/redland/UnpackedTarball_raptor.mk @@ -28,6 +28,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,raptor,\ $(if $(SYSTEM_LIBXML),,external/redland/raptor/rpath.patch) \ external/redland/raptor/xml2-config.patch \ external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1 \ + external/redland/raptor/raptor-fix-oob.patch.1\ external/redland/raptor/libtool.patch \ external/redland/raptor/libxml-override.patch \ )) diff --git a/external/redland/raptor/raptor-fix-oob.patch.1 b/external/redland/raptor/raptor-fix-oob.patch.1 new file mode 100644 index 000000000000..04106dc9a70e --- /dev/null +++ b/external/redland/raptor/raptor-fix-oob.patch.1 @@ -0,0 +1,14 @@ +diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c +index 56993dc3..163f34d5 100644 +--- a/src/raptor_xml_writer.c ++++ b/src/raptor_xml_writer.c +@@ -216,6 +216,9 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, + + if(nstack && element->attributes) { + for(i = 0; i < element->attribute_count; i++) { ++ if (nspace_declarations_count > element->attribute_count) ++ goto error; ++ + /* qname */ + if(element->attributes[i]->nspace) { + /* Check if we need a namespace declaration attribute */ |