mirror of
https://git.yoctoproject.org/poky
synced 2026-07-16 03:47:03 +00:00
Tony Tascioglu
fd33741e27
Parsing specially crafted Mixed Content while parsing XML data may lead to invalid data structure being created, as errors were not propagated. This could lead to several NULL Pointer Dereference when post-validating documents parsed in recovery mode. CVE: CVE-2021-3537 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61] (From OE-Core rev: 6d69f7453f78dcb19f472dcea183e859648c5243) Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
50 lines
1.7 KiB
Diff
50 lines
1.7 KiB
Diff
From 5ae9c39401f679648301efa6d2d35e09cc376462 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Sat, 1 May 2021 16:53:33 +0200
|
|
Subject: [PATCH 3/3] Propagate error in xmlParseElementChildrenContentDeclPriv
|
|
|
|
Check return value of recursive calls to
|
|
xmlParseElementChildrenContentDeclPriv and return immediately in case
|
|
of errors. Otherwise, struct xmlElementContent could contain unexpected
|
|
null pointers, leading to a null deref when post-validating documents
|
|
which aren't well-formed and parsed in recovery mode.
|
|
|
|
Fixes #243.
|
|
|
|
CVE: CVE-2021-3537
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61]
|
|
|
|
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
|
|
---
|
|
parser.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/parser.c b/parser.c
|
|
index a34bb6cd..bbcff39f 100644
|
|
--- a/parser.c
|
|
+++ b/parser.c
|
|
@@ -6195,6 +6195,8 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPtr ctxt, int inputchk,
|
|
SKIP_BLANKS;
|
|
cur = ret = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
|
|
depth + 1);
|
|
+ if (cur == NULL)
|
|
+ return(NULL);
|
|
SKIP_BLANKS;
|
|
GROW;
|
|
} else {
|
|
@@ -6328,6 +6330,11 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPtr ctxt, int inputchk,
|
|
SKIP_BLANKS;
|
|
last = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
|
|
depth + 1);
|
|
+ if (last == NULL) {
|
|
+ if (ret != NULL)
|
|
+ xmlFreeDocElementContent(ctxt->myDoc, ret);
|
|
+ return(NULL);
|
|
+ }
|
|
SKIP_BLANKS;
|
|
} else {
|
|
elem = xmlParseName(ctxt);
|
|
--
|
|
2.25.1
|
|
|