Package: libxml2 Version: 2.9.3+dfsg1-1 Severity: normal Tags: patch pending
Hi, I've prepared an NMU for libxml2 (versioned as 2.9.3+dfsg1-1.1) and uploaded it to DELAYED/5. Please feel free to tell me if I should delay it longer. As mentioned for #825253, it would be even better to go to the new upstream version 2.9.4 for sid though. Regards, Salvatore
diff -Nru libxml2-2.9.3+dfsg1/debian/changelog libxml2-2.9.3+dfsg1/debian/changelog --- libxml2-2.9.3+dfsg1/debian/changelog 2015-12-14 08:35:50.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/changelog 2016-05-28 07:06:45.000000000 +0200 @@ -1,3 +1,28 @@ +libxml2 (2.9.3+dfsg1-1.1) unstable; urgency=medium + + * Non-maintainer upload. + * Heap-based buffer overread in xmlNextChar (CVE-2016-1762) + * heap-buffer-overflow in xmlStrncat (CVE-2016-1834) + * Add missing increments of recursion depth counter to XML parser + (CVE-2016-3705) (Closes: #823414) + * Avoid an out of bound access when serializing malformed strings + (CVE-2016-4483) (Closes: #823405) + * Heap-buffer-overflow in xmlFAParsePosCharGroup (CVE-2016-1840) + * Heap-based buffer overread in xmlParserPrintFileContextInternal + (CVE-2016-1838) + * Heap-based buffer overread in xmlDictAddString (CVE-2016-1839 + CVE-2015-8806 CVE-2016-2073) (Closes: #813613, #812807) + * Heap use-after-free in xmlDictComputeFastKey (CVE-2016-1836) + * Fix inappropriate fetch of entities content (CVE-2016-4449) + * Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral + (CVE-2016-1837) + * Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835) + * Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447) + * Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833) + * Avoid building recursive entities (CVE-2016-3627) (Closes: #819006) + + -- Salvatore Bonaccorso <car...@debian.org> Sat, 28 May 2016 06:51:08 +0200 + libxml2 (2.9.3+dfsg1-1) unstable; urgency=medium * New upstream release. diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0003-Heap-based-buffer-overread-in-xmlNextChar.patch libxml2-2.9.3+dfsg1/debian/patches/0003-Heap-based-buffer-overread-in-xmlNextChar.patch --- libxml2-2.9.3+dfsg1/debian/patches/0003-Heap-based-buffer-overread-in-xmlNextChar.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0003-Heap-based-buffer-overread-in-xmlNextChar.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,29 @@ +From a7a94612aa3b16779e2c74e1fa353b5d9786c602 Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <veill...@redhat.com> +Date: Tue, 9 Feb 2016 12:55:29 +0100 +Subject: [PATCH] Heap-based buffer overread in xmlNextChar + +For https://bugzilla.gnome.org/show_bug.cgi?id=759671 + +when the end of the internal subset isn't properly detected +xmlParseInternalSubset should just return instead of trying +to process input further. + +[carnil: drop patches to testsuite files] +--- + +diff --git a/parser.c b/parser.c +index c5741e3..0677030 100644 +--- a/parser.c ++++ b/parser.c +@@ -8468,6 +8468,7 @@ xmlParseInternalSubset(xmlParserCtxtPtr ctxt) { + */ + if (RAW != '>') { + xmlFatalErr(ctxt, XML_ERR_DOCTYPE_NOT_FINISHED, NULL); ++ return; + } + NEXT; + } +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0004-Bug-763071-heap-buffer-overflow-in-xmlStrncat-https-.patch libxml2-2.9.3+dfsg1/debian/patches/0004-Bug-763071-heap-buffer-overflow-in-xmlStrncat-https-.patch --- libxml2-2.9.3+dfsg1/debian/patches/0004-Bug-763071-heap-buffer-overflow-in-xmlStrncat-https-.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0004-Bug-763071-heap-buffer-overflow-in-xmlStrncat-https-.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,50 @@ +From 8fbbf5513d609c1770b391b99e33314cd0742704 Mon Sep 17 00:00:00 2001 +From: Pranjal Jumde <pju...@apple.com> +Date: Tue, 8 Mar 2016 17:29:00 -0800 +Subject: [PATCH] Bug 763071: heap-buffer-overflow in xmlStrncat + <https://bugzilla.gnome.org/show_bug.cgi?id=763071> + +* xmlstring.c: +(xmlStrncat): Return NULL if xmlStrlen returns a negative length. +(xmlStrncatNew): Ditto. +--- + xmlstring.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/xmlstring.c b/xmlstring.c +index b89c9e9..00287d4 100644 +--- a/xmlstring.c ++++ b/xmlstring.c +@@ -457,6 +457,8 @@ xmlStrncat(xmlChar *cur, const xmlChar *add, int len) { + return(xmlStrndup(add, len)); + + size = xmlStrlen(cur); ++ if (size < 0) ++ return(NULL); + ret = (xmlChar *) xmlRealloc(cur, (size + len + 1) * sizeof(xmlChar)); + if (ret == NULL) { + xmlErrMemory(NULL, NULL); +@@ -484,14 +486,19 @@ xmlStrncatNew(const xmlChar *str1, const xmlChar *str2, int len) { + int size; + xmlChar *ret; + +- if (len < 0) ++ if (len < 0) { + len = xmlStrlen(str2); ++ if (len < 0) ++ return(NULL); ++ } + if ((str2 == NULL) || (len == 0)) + return(xmlStrdup(str1)); + if (str1 == NULL) + return(xmlStrndup(str2, len)); + + size = xmlStrlen(str1); ++ if (size < 0) ++ return(NULL); + ret = (xmlChar *) xmlMalloc((size + len + 1) * sizeof(xmlChar)); + if (ret == NULL) { + xmlErrMemory(NULL, NULL); +-- +2.1.4 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0005-Add-missing-increments-of-recursion-depth-counter-to.patch libxml2-2.9.3+dfsg1/debian/patches/0005-Add-missing-increments-of-recursion-depth-counter-to.patch --- libxml2-2.9.3+dfsg1/debian/patches/0005-Add-missing-increments-of-recursion-depth-counter-to.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0005-Add-missing-increments-of-recursion-depth-counter-to.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,69 @@ +From 8f30bdff69edac9075f4663ce3b56b0c52d48ce6 Mon Sep 17 00:00:00 2001 +From: Peter Simons <psim...@suse.com> +Date: Fri, 15 Apr 2016 11:56:55 +0200 +Subject: [PATCH] Add missing increments of recursion depth counter to XML + parser. + +For https://bugzilla.gnome.org/show_bug.cgi?id=765207 +CVE-2016-3705 +The functions xmlParserEntityCheck() and xmlParseAttValueComplex() used to call +xmlStringDecodeEntities() in a recursive context without incrementing the +'depth' counter in the parser context. Because of that omission, the parser +failed to detect attribute recursions in certain documents before running out +of stack space. +--- + parser.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/parser.c b/parser.c +index f5907bf..68e1c90 100644 +--- a/parser.c ++++ b/parser.c +@@ -144,8 +144,10 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, + + ent->checked = 1; + ++ ++ctxt->depth; + rep = xmlStringDecodeEntities(ctxt, ent->content, + XML_SUBSTITUTE_REF, 0, 0, 0); ++ --ctxt->depth; + + ent->checked = (ctxt->nbentities - oldnbent + 1) * 2; + if (rep != NULL) { +@@ -3966,8 +3968,10 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) { + * an entity declaration, it is bypassed and left as is. + * so XML_SUBSTITUTE_REF is not set here. + */ ++ ++ctxt->depth; + ret = xmlStringDecodeEntities(ctxt, buf, XML_SUBSTITUTE_PEREF, + 0, 0, 0); ++ --ctxt->depth; + if (orig != NULL) + *orig = buf; + else +@@ -4092,9 +4096,11 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) { + } else if ((ent != NULL) && + (ctxt->replaceEntities != 0)) { + if (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) { ++ ++ctxt->depth; + rep = xmlStringDecodeEntities(ctxt, ent->content, + XML_SUBSTITUTE_REF, + 0, 0, 0); ++ --ctxt->depth; + if (rep != NULL) { + current = rep; + while (*current != 0) { /* non input consuming */ +@@ -4130,8 +4136,10 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) { + (ent->content != NULL) && (ent->checked == 0)) { + unsigned long oldnbent = ctxt->nbentities; + ++ ++ctxt->depth; + rep = xmlStringDecodeEntities(ctxt, ent->content, + XML_SUBSTITUTE_REF, 0, 0, 0); ++ --ctxt->depth; + + ent->checked = (ctxt->nbentities - oldnbent + 1) * 2; + if (rep != NULL) { +-- +2.1.4 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0006-Avoid-an-out-of-bound-access-when-serializing-malfor.patch libxml2-2.9.3+dfsg1/debian/patches/0006-Avoid-an-out-of-bound-access-when-serializing-malfor.patch --- libxml2-2.9.3+dfsg1/debian/patches/0006-Avoid-an-out-of-bound-access-when-serializing-malfor.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0006-Avoid-an-out-of-bound-access-when-serializing-malfor.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,50 @@ +From c97750d11bb8b6f3303e7131fe526a61ac65bcfd Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <veill...@redhat.com> +Date: Mon, 23 May 2016 13:39:13 +0800 +Subject: [PATCH] Avoid an out of bound access when serializing malformed + strings + +For https://bugzilla.gnome.org/show_bug.cgi?id=766414 + +* xmlsave.c: xmlBufAttrSerializeTxtContent() if an attribute value + is not UTF-8 be more careful when serializing it as we may do an + out of bound access as a result. +--- + xmlsave.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/xmlsave.c b/xmlsave.c +index 774404b..4a8e3f3 100644 +--- a/xmlsave.c ++++ b/xmlsave.c +@@ -2097,8 +2097,8 @@ xmlBufAttrSerializeTxtContent(xmlBufPtr buf, xmlDocPtr doc, + xmlBufAdd(buf, BAD_CAST "&", 5); + cur++; + base = cur; +- } else if ((*cur >= 0x80) && ((doc == NULL) || +- (doc->encoding == NULL))) { ++ } else if ((*cur >= 0x80) && (cur[1] != 0) && ++ ((doc == NULL) || (doc->encoding == NULL))) { + /* + * We assume we have UTF-8 content. + */ +@@ -2121,14 +2121,14 @@ xmlBufAttrSerializeTxtContent(xmlBufPtr buf, xmlDocPtr doc, + val <<= 6; + val |= (cur[1]) & 0x3F; + l = 2; +- } else if (*cur < 0xF0) { ++ } else if ((*cur < 0xF0) && (cur [2] != 0)) { + val = (cur[0]) & 0x0F; + val <<= 6; + val |= (cur[1]) & 0x3F; + val <<= 6; + val |= (cur[2]) & 0x3F; + l = 3; +- } else if (*cur < 0xF8) { ++ } else if ((*cur < 0xF8) && (cur [2] != 0) && (cur[3] != 0)) { + val = (cur[0]) & 0x07; + val <<= 6; + val |= (cur[1]) & 0x3F; +-- +2.1.4 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0007-Bug-757711-heap-buffer-overflow-in-xmlFAParsePosChar.patch libxml2-2.9.3+dfsg1/debian/patches/0007-Bug-757711-heap-buffer-overflow-in-xmlFAParsePosChar.patch --- libxml2-2.9.3+dfsg1/debian/patches/0007-Bug-757711-heap-buffer-overflow-in-xmlFAParsePosChar.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0007-Bug-757711-heap-buffer-overflow-in-xmlFAParsePosChar.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,35 @@ +From cbb271655cadeb8dbb258a64701d9a3a0c4835b4 Mon Sep 17 00:00:00 2001 +From: Pranjal Jumde <pju...@apple.com> +Date: Mon, 7 Mar 2016 06:34:26 -0800 +Subject: [PATCH] Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup + <https://bugzilla.gnome.org/show_bug.cgi?id=757711> + +* xmlregexp.c: +(xmlFAParseCharRange): Only advance to the next character if +there is no error. Advancing to the next character in case of +an error while parsing regexp leads to an out of bounds access. +--- + xmlregexp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/xmlregexp.c b/xmlregexp.c +index 727fef4..ca3b4f4 100644 +--- a/xmlregexp.c ++++ b/xmlregexp.c +@@ -5057,11 +5057,12 @@ xmlFAParseCharRange(xmlRegParserCtxtPtr ctxt) { + ERROR("Expecting the end of a char range"); + return; + } +- NEXTL(len); ++ + /* TODO check that the values are acceptable character ranges for XML */ + if (end < start) { + ERROR("End of range is before start of range"); + } else { ++ NEXTL(len); + xmlRegAtomAddRange(ctxt, ctxt->atom, ctxt->neg, + XML_REGEXP_CHARVAL, start, end, NULL); + } +-- +2.1.4 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0008-Bug-758588-Heap-based-buffer-overread-in-xmlParserPr.patch libxml2-2.9.3+dfsg1/debian/patches/0008-Bug-758588-Heap-based-buffer-overread-in-xmlParserPr.patch --- libxml2-2.9.3+dfsg1/debian/patches/0008-Bug-758588-Heap-based-buffer-overread-in-xmlParserPr.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0008-Bug-758588-Heap-based-buffer-overread-in-xmlParserPr.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,99 @@ +From db07dd613e461df93dde7902c6505629bf0734e9 Mon Sep 17 00:00:00 2001 +From: David Kilzer <ddkil...@apple.com> +Date: Fri, 12 Feb 2016 09:58:29 -0800 +Subject: [PATCH] Bug 758588: Heap-based buffer overread in + xmlParserPrintFileContextInternal + <https://bugzilla.gnome.org/show_bug.cgi?id=758588> + +* parser.c: +(xmlParseEndTag2): Add bounds checks before dereferencing +ctxt->input->cur past the end of the buffer, or incrementing the +pointer past the end of the buffer. + +* result/errors/758588.xml: Add test result. +* result/errors/758588.xml.err: Ditto. +* result/errors/758588.xml.str: Ditto. +* test/errors/758588.xml: Add regression test. +--- + parser.c | 8 ++++++-- + result/errors/758588.xml | 0 + result/errors/758588.xml.err | 9 +++++++++ + result/errors/758588.xml.str | 10 ++++++++++ + test/errors/758588.xml | 1 + + 5 files changed, 26 insertions(+), 2 deletions(-) + create mode 100644 result/errors/758588.xml + create mode 100644 result/errors/758588.xml.err + create mode 100644 result/errors/758588.xml.str + create mode 100644 test/errors/758588.xml + +diff --git a/parser.c b/parser.c +index 68e1c90..4464e2e 100644 +--- a/parser.c ++++ b/parser.c +@@ -9825,6 +9825,7 @@ static void + xmlParseEndTag2(xmlParserCtxtPtr ctxt, const xmlChar *prefix, + const xmlChar *URI, int line, int nsNr, int tlen) { + const xmlChar *name; ++ size_t curLength; + + GROW; + if ((RAW != '<') || (NXT(1) != '/')) { +@@ -9833,8 +9834,11 @@ xmlParseEndTag2(xmlParserCtxtPtr ctxt, const xmlChar *prefix, + } + SKIP(2); + +- if ((tlen > 0) && (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) { +- if (ctxt->input->cur[tlen] == '>') { ++ curLength = ctxt->input->end - ctxt->input->cur; ++ if ((tlen > 0) && (curLength >= (size_t)tlen) && ++ (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) { ++ if ((curLength >= (size_t)(tlen + 1)) && ++ (ctxt->input->cur[tlen] == '>')) { + ctxt->input->cur += tlen + 1; + ctxt->input->col += tlen + 1; + goto done; +diff --git a/result/errors/758588.xml b/result/errors/758588.xml +new file mode 100644 +index 0000000..e69de29 +diff --git a/result/errors/758588.xml.err b/result/errors/758588.xml.err +new file mode 100644 +index 0000000..dfa59bc +--- /dev/null ++++ b/result/errors/758588.xml.err +@@ -0,0 +1,9 @@ ++./test/errors/758588.xml:1: namespace error : Namespace prefix a-340282366920938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867261d on a is not defined ++63472597946867209384634725979468672093846347259794686720938463472597946867261d:a ++ ^ ++./test/errors/758588.xml:1: parser error : expected '>' ++2597946867209384634725979468672093846347259794686720938463472597946867261d:a></a ++ ^ ++./test/errors/758588.xml:1: parser error : Opening and ending tag mismatch: a line 1 and a ++2597946867209384634725979468672093846347259794686720938463472597946867261d:a></a ++ ^ +diff --git a/result/errors/758588.xml.str b/result/errors/758588.xml.str +new file mode 100644 +index 0000000..303ee0c +--- /dev/null ++++ b/result/errors/758588.xml.str +@@ -0,0 +1,10 @@ ++./test/errors/758588.xml:1: namespace error : Namespace prefix a-340282366920938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867261d on a is not defined ++63472597946867209384634725979468672093846347259794686720938463472597946867261d:a ++ ^ ++./test/errors/758588.xml:1: parser error : expected '>' ++2597946867209384634725979468672093846347259794686720938463472597946867261d:a></a ++ ^ ++./test/errors/758588.xml:1: parser error : Opening and ending tag mismatch: a line 1 and a ++2597946867209384634725979468672093846347259794686720938463472597946867261d:a></a ++ ^ ++./test/errors/758588.xml : failed to parse +diff --git a/test/errors/758588.xml b/test/errors/758588.xml +new file mode 100644 +index 0000000..bec7e93 +--- /dev/null ++++ b/test/errors/758588.xml +@@ -0,0 +1 @@ ++<a-340282366920938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867209384634725979468672093846347259794686720938463472597946867261d:a></a +\ No newline at end of file +-- +2.1.4 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0009-Bug-758605-Heap-based-buffer-overread-in-xmlDictAddS.patch libxml2-2.9.3+dfsg1/debian/patches/0009-Bug-758605-Heap-based-buffer-overread-in-xmlDictAddS.patch --- libxml2-2.9.3+dfsg1/debian/patches/0009-Bug-758605-Heap-based-buffer-overread-in-xmlDictAddS.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0009-Bug-758605-Heap-based-buffer-overread-in-xmlDictAddS.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,129 @@ +From a820dbeac29d330bae4be05d9ecd939ad6b4aa33 Mon Sep 17 00:00:00 2001 +From: Pranjal Jumde <pju...@apple.com> +Date: Tue, 1 Mar 2016 11:34:04 -0800 +Subject: [PATCH] Bug 758605: Heap-based buffer overread in xmlDictAddString + <https://bugzilla.gnome.org/show_bug.cgi?id=758605> + +Reviewed by David Kilzer. + +* HTMLparser.c: +(htmlParseName): Add bounds check. +(htmlParseNameComplex): Ditto. +* result/HTML/758605.html: Added. +* result/HTML/758605.html.err: Added. +* result/HTML/758605.html.sax: Added. +* runtest.c: +(pushParseTest): The input for the new test case was so small +(4 bytes) that htmlParseChunk() was never called after +htmlCreatePushParserCtxt(), thereby creating a false positive +test failure. Fixed by using a do-while loop so we always call +htmlParseChunk() at least once. +* test/HTML/758605.html: Added. +--- + HTMLparser.c | 8 ++++++++ + result/HTML/758605.html | 3 +++ + result/HTML/758605.html.err | 3 +++ + result/HTML/758605.html.sax | 13 +++++++++++++ + runtest.c | 4 ++-- + test/HTML/758605.html | 1 + + 6 files changed, 30 insertions(+), 2 deletions(-) + create mode 100644 result/HTML/758605.html + create mode 100644 result/HTML/758605.html.err + create mode 100644 result/HTML/758605.html.sax + create mode 100644 test/HTML/758605.html + +diff --git a/HTMLparser.c b/HTMLparser.c +index 69eed2b..1c112cc 100644 +--- a/HTMLparser.c ++++ b/HTMLparser.c +@@ -2471,6 +2471,10 @@ htmlParseName(htmlParserCtxtPtr ctxt) { + (*in == '_') || (*in == '-') || + (*in == ':') || (*in == '.')) + in++; ++ ++ if (in == ctxt->input->end) ++ return(NULL); ++ + if ((*in > 0) && (*in < 0x80)) { + count = in - ctxt->input->cur; + ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count); +@@ -2514,6 +2518,10 @@ htmlParseNameComplex(xmlParserCtxtPtr ctxt) { + NEXTL(l); + c = CUR_CHAR(l); + } ++ ++ if (ctxt->input->base > ctxt->input->cur - len) ++ return(NULL); ++ + return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len)); + } + +diff --git a/result/HTML/758605.html b/result/HTML/758605.html +new file mode 100644 +index 0000000..a085cce +--- /dev/null ++++ b/result/HTML/758605.html +@@ -0,0 +1,3 @@ ++<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd";> ++<html><body><p>& ++</p></body></html> +diff --git a/result/HTML/758605.html.err b/result/HTML/758605.html.err +new file mode 100644 +index 0000000..2b82be6 +--- /dev/null ++++ b/result/HTML/758605.html.err +@@ -0,0 +1,3 @@ ++./test/HTML/758605.html:1: HTML parser error : htmlParseEntityRef: no name ++?? ++ ^ +diff --git a/result/HTML/758605.html.sax b/result/HTML/758605.html.sax +new file mode 100644 +index 0000000..1f5cd32 +--- /dev/null ++++ b/result/HTML/758605.html.sax +@@ -0,0 +1,13 @@ ++SAX.setDocumentLocator() ++SAX.startDocument() ++SAX.error: htmlParseEntityRef: no name ++SAX.startElement(html) ++SAX.startElement(body) ++SAX.startElement(p) ++SAX.characters(&, 1) ++SAX.ignorableWhitespace( ++, 1) ++SAX.endElement(p) ++SAX.endElement(body) ++SAX.endElement(html) ++SAX.endDocument() +diff --git a/runtest.c b/runtest.c +index 36fbe5a..bb74d2a 100644 +--- a/runtest.c ++++ b/runtest.c +@@ -1873,7 +1873,7 @@ pushParseTest(const char *filename, const char *result, + ctxt = xmlCreatePushParserCtxt(NULL, NULL, base + cur, 4, filename); + xmlCtxtUseOptions(ctxt, options); + cur += 4; +- while (cur < size) { ++ do { + if (cur + 1024 >= size) { + #ifdef LIBXML_HTML_ENABLED + if (options & XML_PARSE_HTML) +@@ -1891,7 +1891,7 @@ pushParseTest(const char *filename, const char *result, + xmlParseChunk(ctxt, base + cur, 1024, 0); + cur += 1024; + } +- } ++ } while (cur < size); + doc = ctxt->myDoc; + #ifdef LIBXML_HTML_ENABLED + if (options & XML_PARSE_HTML) +diff --git a/test/HTML/758605.html b/test/HTML/758605.html +new file mode 100644 +index 0000000..9b1b3c2 +--- /dev/null ++++ b/test/HTML/758605.html +@@ -0,0 +1 @@ ++&:? +-- +2.1.4 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0010-Bug-759398-Heap-use-after-free-in-xmlDictComputeFast.patch libxml2-2.9.3+dfsg1/debian/patches/0010-Bug-759398-Heap-use-after-free-in-xmlDictComputeFast.patch --- libxml2-2.9.3+dfsg1/debian/patches/0010-Bug-759398-Heap-use-after-free-in-xmlDictComputeFast.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0010-Bug-759398-Heap-use-after-free-in-xmlDictComputeFast.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,446 @@ +From 45752d2c334b50016666d8f0ec3691e2d680f0a0 Mon Sep 17 00:00:00 2001 +From: Pranjal Jumde <pju...@apple.com> +Date: Thu, 3 Mar 2016 11:50:34 -0800 +Subject: [PATCH] Bug 759398: Heap use-after-free in xmlDictComputeFastKey + <https://bugzilla.gnome.org/show_bug.cgi?id=759398> + +* parser.c: +(xmlParseNCNameComplex): Store start position instead of a +pointer to the name since the underlying buffer may change, +resulting in a stale pointer being used. +* result/errors/759398.xml: Added. +* result/errors/759398.xml.err: Added. +* result/errors/759398.xml.str: Added. +* test/errors/759398.xml: Added test case. +--- + parser.c | 9 +- + result/errors/759398.xml | 0 + result/errors/759398.xml.err | 9 ++ + result/errors/759398.xml.str | 5 + + test/errors/759398.xml | 326 +++++++++++++++++++++++++++++++++++++++++++ + 5 files changed, 344 insertions(+), 5 deletions(-) + create mode 100644 result/errors/759398.xml + create mode 100644 result/errors/759398.xml.err + create mode 100644 result/errors/759398.xml.str + create mode 100755 test/errors/759398.xml + +diff --git a/parser.c b/parser.c +index 4464e2e..c424fc1 100644 +--- a/parser.c ++++ b/parser.c +@@ -2010,6 +2010,7 @@ static int spacePop(xmlParserCtxtPtr ctxt) { + #define CUR (*ctxt->input->cur) + #define NXT(val) ctxt->input->cur[(val)] + #define CUR_PTR ctxt->input->cur ++#define BASE_PTR ctxt->input->base + + #define CMP4( s, c1, c2, c3, c4 ) \ + ( ((unsigned char *) s)[ 0 ] == c1 && ((unsigned char *) s)[ 1 ] == c2 && \ +@@ -3472,7 +3473,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { + int len = 0, l; + int c; + int count = 0; +- const xmlChar *end; /* needed because CUR_CHAR() can move cur on \r\n */ ++ size_t startPosition = 0; + + #ifdef DEBUG + nbParseNCNameComplex++; +@@ -3482,7 +3483,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { + * Handler for more complex cases + */ + GROW; +- end = ctxt->input->cur; ++ startPosition = CUR_PTR - BASE_PTR; + c = CUR_CHAR(l); + if ((c == ' ') || (c == '>') || (c == '/') || /* accelerators */ + (!xmlIsNameStartChar(ctxt, c) || (c == ':'))) { +@@ -3504,7 +3505,6 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { + } + len += l; + NEXTL(l); +- end = ctxt->input->cur; + c = CUR_CHAR(l); + if (c == 0) { + count = 0; +@@ -3518,7 +3518,6 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { + ctxt->input->cur += l; + if (ctxt->instate == XML_PARSER_EOF) + return(NULL); +- end = ctxt->input->cur; + c = CUR_CHAR(l); + } + } +@@ -3527,7 +3526,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { + xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName"); + return(NULL); + } +- return(xmlDictLookup(ctxt->dict, end - len, len)); ++ return(xmlDictLookup(ctxt->dict, (BASE_PTR + startPosition), len)); + } + + /** +diff --git a/result/errors/759398.xml b/result/errors/759398.xml +new file mode 100644 +index 0000000..e69de29 +diff --git a/result/errors/759398.xml.err b/result/errors/759398.xml.err +new file mode 100644 +index 0000000..e08d9bf +--- /dev/null ++++ b/result/errors/759398.xml.err +@@ -0,0 +1,9 @@ ++./test/errors/759398.xml:210: parser error : StartTag: invalid element name ++need to worry about parsers whi<! don't expand PErefs finding ++ ^ ++./test/errors/759398.xml:309: parser error : Opening and ending tag mismatch: spec line 50 and termdef ++and provide access to their content and structure.</termdef> <termdef ++ ^ ++./test/errors/759398.xml:309: parser error : Extra content at the end of the document ++and provide access to their content and structure.</termdef> <termdef ++ ^ +diff --git a/result/errors/759398.xml.str b/result/errors/759398.xml.str +new file mode 100644 +index 0000000..de9a28c +--- /dev/null ++++ b/result/errors/759398.xml.str +@@ -0,0 +1,5 @@ ++./test/errors/759398.xml:210: parser error : internal error: detected an error in element content ++ ++need to worry about parsers whi<! don't expand ++ ^ ++./test/errors/759398.xml : failed to parse +diff --git a/test/errors/759398.xml b/test/errors/759398.xml +new file mode 100755 +index 0000000..132e029 +--- /dev/null ++++ b/test/errors/759398.xml +@@ -0,0 +1,326 @@ ++<?xml version='1.0' encoding='ISO-8859-5' standalone='no'?> ++<!DOCTYPE spec SYSTEM "dtds/spec.dtd" [ ++ ++<!-- LAST TOUCHED BY: Tim Bray, 8 February 1997 --> ++ ++<!-- The words 'FINAL EDIT' in comments mark places where changes ++need to be made after approval of the document by the ERB, before ++publication. --> ++ ++<!ENTITY XML.version "1.0"> ++<!ENTITY doc.date "10 February 1998"> ++<!ENTITY iso6.doc.date "19980210"> ++<!ENTITY w3c.doc.date "02-Feb-1998"> ++<!ENTITY draft.day '10'> ++<!ENTITY draft.month 'February'> ++<!ENTITY draft.year '1998'> ++ ++<!ENTITY WebSGML ++ 'WebSGML Adaptations Annex to ISO 8879'> ++ ++<!ENTITY lt "<"> ++<!ENTITY gt ">"> ++<!ENTITY xmlpio "'<?xml'"> ++<!ENTITY pic "'?>'"> ++<!ENTITY br "\n"> ++<!ENTITY cellback '#c0d9c0'> ++<!ENTITY mdash "--"> <!-- —, but nsgmls doesn't grok hex --> ++<!ENTITY com "--"> ++<!ENTITY como "--"> ++<!ENTITY comc "--"> ++<!ENTITY hcro "&#x"> ++<!-- <!ENTITY nbsp "?"> --> ++<!ENTITY nbsp " "> ++<!ENTITY magicents "<code>amp</code>, ++<code>lt</code>, ++<code>gt</code>, ++<code>apos</code>, ++<code>quot</code>"> ++ ++<!-- audience and distribution status: for use at publication time --> ++<!ENTITY doc.audience "public review and discussion"> ++<!ENTITY doc.distribution "may be dislributed freely, as long as ++all text and legal notices remain intact"> ++ ++]> ++ ++<!-- for Panorama *--> ++<?VERBATIM "eg" ?> ++ ++<spec> ++<header> ++<title>Extensible Markup Language (XML) 1.0</title> ++<version></version> ++<w3c-designation>REC-xml-&iso6.doc.date;</w3c-designation> ++<w3c-doctype>W3C Recommendation</w3c-doctype> ++<pubdate><day>&draft.day;</day><month>&draft.month;</month><year>&draft.year;</year></pubdate> ++ ++<publoc> ++<loc href="http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;";> ++http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;</loc> ++<loc href="http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.xml";> ++http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.xml</loc> ++<loc href="http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.html";> ++http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.html</loc> ++<loc href="http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.pdf";> ++http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.pdf</loc> ++<loc href="http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.ps";> ++http://www.w3.org/TR/1998/REC-xml-&iso6.doc.date;.ps</loc> ++</publoc> ++<latestloc> ++<loc href="http://www.w3.org/TR/REC-xml";> ++htt????www.w3.org/TR/REC-xml</loc> ++</latestloc> ++<prevlocs> ++<loc href="http://www.w3.org/TR/PR-xml-971208";> ++http://www.w3.org/TR/PR-xml-971208</loc> ++<!-- ++<loc href='http://www.w3.org/TR/WD-xml-961114'> ++http://www.w3.org/TR/WD-xml-961114</loc> ++<loc href='http://www.w3.org/TR/WD-xml-lang-970331'> ++http://www.w3.org/TR/WD-xml-lang-970331</loc> ++<loc href='http://www.w3.org/TR/WD-xml-lang-970630'> ++http://www.w3.org/TR/WD-xml-lang-970630</loc> ++<loc href='http://www.w3.org/TR/WD-xml-970807'> ++http://www.w3.org/TR/WD-xml-970807</loc> ++<loc href='http://www.w3.org/TR/WD-xml-971117'> ++http://www.w3.org/TR/WD-xml-971117</loc>--> ++</prevlocs> ++<authlist> ++<author><name>Tim Bray</name> ++<affiliation>Textuality and Netscape</affiliation> ++<email ++href="mailto:tb...@textuality.com">tb...@textuality.com</email></author> ++<author><name>Jean Paoli</name> ++<affiliation>Microsoft</affiliation> ++<email href="mailto:jea...@microsoft.com">jea...@microsoft.com</email></author> ++<author><name>C. M. Sperberg-McQueen</name> ++<affiliation>University of Illinois at Chicago</affiliation> ++<email href="mailto:cms...@uic.edu">cms...@uic.edu</email></author> ++</authlist> ++<abstract> ++<p>The Extensible Markup Language (XML) is a subset of ++SGML that is completely described in this document. Its goal is to ++enable generic SGML to be served, received, and processed on the Web ++in the way that is now possible with HTML. XML has been designed for ++ease of implementation and for interoperability with both SGML and ++HTML.</p> ++</abstract> ++<status> ++<p>This document has been reviewed by W3C Members and ++other interested parties and has been endorsed by the ++Director as a W3C Recommendation. It is a stable ++document and may be used as reference material or cited ++as a normative reference from another document. W3C's ++role in making the Recommendation is to draw attention ++to the spPcification and to promote its widespread ++deployment. This enhances the functionality and ++interoperability of the Web.</p> ++<p> ++This document specifies a syntax created by subsetting an existing, ++widely used international text processing standard (Standard ++Generalized Markup Language, ISO 8879:1986(E) as amended and ++corrected) for use on the World Wide Web. It is a product of the W3C ++XML Activity, details of which can be found at <loc ++href='http://www.w3.org/XML'>http://www.w3.org/XML</loc>. A list of ++current W3C Recommendations and other technical documents can be found ++at <loc href='http://www.w3.org/TR'>http://www.w3.org/TR</loc>. ++</p> ++<p>This specification uses the term URI, which is defined by <bibref ++ref="Berners-Lee"/>, a work in progress expected to update <bibref ++ref="RFC1738"/> and <bibref ref="RFC1808"/>. ++</p> ++<p>The list of known errors in this specification is ++available at ++<loc href='http://www.w3.org/XML/xml-19980210-errata'>http://www.w3.org/XML/xml-19980210-errata</loc>.</p> ++<p>Please report errors in this document to ++<loc href='mailto:xml-edi...@w3.org'>xml-edi...@w3.org</loc>. ++</p> ++</status> ++ ++ ++<pubstmt> ++<p>Chicago, Vancouver, Mountain View, et al.: ++World-Wide Web Consortium, XML Working Group, 1996, 1997.</p> ++</pubstmt> ++<sourcedesc> ++<p>Created in electronic form.</p> ++</sourcedesc> ++<langusage> ++<language id='EN'>English</language> ++<language id='ebnf'>Extended Backus-Naur Form (formal grammar)</language> ++</langusage> ++<revisiondesc> ++<slist> ++<sitem>1997-12-03 : CMSMcQ : yet further changes</sitem> ++<sitem>1997-12-02 : TB : further changes (see TB to XML WG, ++2 December 1997)</sitem> ++<sitem>1997-12-02 : CMSMcQ : deal with as many corrections and ++comments from the proofreaders as possible: ++entify hard-coded document date in pubdate element, ++change expansion of entity WebSGML, ++update status description as per Dan Connolly (am not sure ++about refernece to Berners-Lee et al.), ++add 'The' to abstract as per WG decision, ++move Relationship to Existing Standards to back matter and ++combine with References, ++re-order back matter so normative appendices come first, ++re-tag back matter so informative appendices are tagged informdiv1, ++remove XXX XXX from list of 'normative' specs in prose, ++move some references from Other References to Normative References, ++add RFC 1738, 1808, and 2141 to Other References (they are not ++normative since we do not require the processor to enforce any ++rules based on them), ++add reference to 'Fielding draft' (Berners-Lee et al.), ++move notation section to end of body, ++drop URIchar non-terminal and use SkipLit instead, ++lose stray reference to defunct nonterminal 'markupdecls', ++move reference to Aho et al. into appendix (Tim's right), ++add prose note saying that hash marks and fragment identifiers are ++NOT part of the URI formally speaking, and are NOT legal in ++system identifiers (processor 'may' signal an error). ++Work through: ++Tim Bray reacting to James Clark, ++Tim Bray on his own, ++Eve Maler, ++ ++NOT DONE YET: ++change binary / text to unparsed / parsed. ++handle James's suggestion about < in attriubte values ++uppercase hex characters, ++namechar list, ++</sitem> ++<sitem>1997-12-01 : JB : add some column-width parameters</sitem> ++<sitem>1997-12-01 : CMSMcQ : begin round of changes to incorporate ++recent WG decisions and other corrections: ++binding sources of character encoding info (27 Aug / 3 Sept), ++correct wording of Faust quotation (restore dropped line), ++drop SDD from EncodingDecl, ++change text at version number 1.0, ++drop misleading (wrong!) sentence about ignorables and extenders, ++modify defin???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????xamples with Byte Order Mark. ++Add content model as a term and clarify that it applies to both ++mixed and element content. ++</sitem> ++<sitem>1997-06-30 : CMSMcQ : change date, some cosmetic changes, ++changes to productions for choice, seq, Mixed, NotationType, ++Enumeration. Follow James Clark's suggestion and prohibit ++conditional sections in internal subset. TO DO: simplify ++production for ignored sections as a result, since we don't ++need to worry about parsers whi<! don't expand PErefs finding ++a conditional section.</sitem> ++<sitem>1997-06-29 : TB : various edits</sitem> ++<sitem>1997-06-29 : CMSMcQ : further changes: ++Suppress old FINAL EDIT comments and some dead material. ++Revise occurrences of % in grammar to exploit Henry Thompson's pun, ++especially markupdecl and attdef. ++Remove RMD requirement relating to element content (?). ++</sitem> ++<sitem>1997-06-28 : CMSMcQ : Various changes for 1 July draft: ++Add text for draconian error handling (introduce ++the term Fatal Error). ++RE deleta est (changing wording from ++original announcement to restrict the requirement to validating ++parsers). ++Tag definition of validawwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww it meant 'may or may not'.</sitem> ++<sitem>1997-03-21 : TB : massive changes on plane flight from Chicago ++to Vancouver</sitem> ++<sitem>1997-03-21 : CMSMcQ : correct as many reported errors as possible. ++</sitem> ++<sitem>1997-03-20 : CMSMcQ : correct typos listed in CMSMcQ hand copy of spec.</sitem> ++<sitem>1997 James Clark: ++Define the set of characters from which [^abc] subtracts. ++Charref should use just [0-9] not Digit. ++Location info needs cleaner treatment: remove? (ERB ++question). ++One example of a PI has wrong pic. ++Clarify discussion of encoding names. ++Encoding failure should lead to unspecified results; don't ++prescribe error recovery. ++Don't require exposure of entity boundaries. ++Ignore white space in element content. ++Reserve entity names of the form u-NNNN. ++Clarify relative URLs. ++And some of my own: ++Correct productions for content model: model cannot ++consist of a name, so "elements ::= cp" is no good. ++</sitem> ++<sitem>1996-11-11 : CMSMcQ : revise for style. ++Add new rhs to entity declaration, for parameter entities.</sitem> ++<sitem>1996-11-10 : CMSMcQ : revise for style. ++Fix / complete section on names, characters. ++Add sections on parameter entities, conditional sections. ++Still to do: Add compatibility note on deterministic content models. ++Finish stylistic revision.</sitem> ++<sitem>1996-10-31 : TB : Add Entity Handling section</sitem> ++<sitem>1996-10-30 : TB : Clean up term & termdef. Slip in ++ERB decision re EMPTY.</sitem> ++<sitem>1996-10-28 : TB : Change DTD. Implement some of Michael's ++suggestions. Change comments back to //. Introduce language for ++XML namespace reservation. Add section on white-space handling. ++Lots more cleanup.</sitem> ++<sitem>1996-10-24 : CMSMcQ : quick tweaks, implement some ERB ++decisions. Characters are not integers. Comments are /* */ not //. ++Add bibliographic refs to 10646, HyTime, Unicode. ++Rename old Cdata as MsData since it's <emph>only</emph> seen ++in marked sections. Call them attribute-value pairs not ++name-value pairs, except once. Internal subset is optional, needs ++'?'. Implied attributes should be signaled to the app, not ++have values supplied by processor.</sitem> ++<sitem>1996-10-16 : TB : track down & excise all DSD references; ++introduce some EBNF for entity declarations.</sitem> ++<sitem>1996-10-?? nsistency check, fix up scraps so ++they all parse, get formatter working, correct a few productions.</sitem> ++<sitem>1996-10-10/11 : CMSMcQ : various maintenance, stylistic, and ++organizational changes: ++Replace a few literals with xmlpio and ++pi""entities, to make them consistent and ensure we can change pic ++reliably when the ERB votes. ++Drop paragraph on recognizers from notation section. ++Add match, exact match to terminology. ++Move old 2.2 XML Processors and Apps into intro. ++Mention comments, PIs, and marked sections in discussion of ++delimiter escaping. ++Streamline discussion of doctype decl syntax. ++Drop old section of 'PI syntax' for doctype decl, and add ++section on partial-DTD summary PIs to end of Logical Structures ++section. ++Revise DSD syntax section to use Tim's subset-in-a-PI ++mechanism.</sitem> ++<sitem>1996-10-10 : TB : eliminate name recognizers (and more?)</sitem> ++<sitem>1996-10-09 : CMSMcQ : revise for style, consistency through 2.3 ++(Characters)</sitem> ++<sitem>1996-10-09 : CMSMcQ : re-unite everything for convenience, ++at least temporarily, and revise quickly</sitem> ++<sitem>1996-10-08 : TB : first major homogenization pass</sitem> ++<sitem>1996-10-08 : TB : turn "current" attribute on div type into ++CDATA</sitem> ++<sitem>1996-10-02 : TB : remould into skeleton + entities</sitem> ++<sitem>1996-09-30 : CMSMcQ : add a few more sections prior to exchange ++ with Tim.</sitem> ++<sitem>1996-09-20 : CMSMcQ : finish transcribing notes.</sitem> ++<sitem>1996-09-19 : CMSMcQ : begin transcribing notes for draft.</sitem> ++<sitem>1996-09-13 : CMSMcQ : made outline from notes of 09-06, ++do some housekeeping</sitem> ++</slist> ++</revisiondesc> ++</header> ++<?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????m> is used to read XML documents ++and provide access to their content and structure.</termdef> <termdef ++id="dt-app" term="Application">It is @ssumed that an XML processor is ++doing its work on behalf of another module, called the ++<term>application</term>.</termdef> This specification describes the ++required beh\vior of an XML processor in terms of how it must read XML ++data and the information it must provide to the application.</p> ++ ++<div2 id='sec-origin-goals'> ++<head>Origin and Goals</head> ++<p>XML was developed by an XML Working Group (orisable over the ++Internet.</p></item> ++<item><p>XML shall support a wide varie?y of applications.</p></item> ++<item><p>XML shall be compatible with SGML.</p></item> ++<item><p>It shall be easy to write programs which process XML ++documents.</p></item> ++<item><p>The number of optional features in XML is to be kept to the ++absolute minimum, ideally zero.</p></item> ++<item><p>XML documents shou +\ No newline at end of file +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0011-Fix-inappropriate-fetch-of-entities-content.patch libxml2-2.9.3+dfsg1/debian/patches/0011-Fix-inappropriate-fetch-of-entities-content.patch --- libxml2-2.9.3+dfsg1/debian/patches/0011-Fix-inappropriate-fetch-of-entities-content.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0011-Fix-inappropriate-fetch-of-entities-content.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,44 @@ +From b1d34de46a11323fccffa9fadeb33be670d602f5 Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <veill...@redhat.com> +Date: Mon, 14 Mar 2016 17:19:44 +0800 +Subject: [PATCH] Fix inappropriate fetch of entities content + +For https://bugzilla.gnome.org/show_bug.cgi?id=761430 + +libfuzzer regression testing exposed another case where the parser would +fetch content of an external entity while not in validating mode. +Plug that hole +--- + parser.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/parser.c b/parser.c +index c424fc1..f6d652e 100644 +--- a/parser.c ++++ b/parser.c +@@ -2861,7 +2861,21 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len, + ctxt->nbentities += ent->checked / 2; + if (ent != NULL) { + if (ent->content == NULL) { +- xmlLoadEntityContent(ctxt, ent); ++ /* ++ * Note: external parsed entities will not be loaded, ++ * it is not required for a non-validating parser to ++ * complete external PEreferences coming from the ++ * internal subset ++ */ ++ if (((ctxt->options & XML_PARSE_NOENT) != 0) || ++ ((ctxt->options & XML_PARSE_DTDVALID) != 0) || ++ (ctxt->validate != 0)) { ++ xmlLoadEntityContent(ctxt, ent); ++ } else { ++ xmlWarningMsg(ctxt, XML_ERR_ENTITY_PROCESSING, ++ "not validating will not read content for PE entity %s\n", ++ ent->name, NULL); ++ } + } + ctxt->depth++; + rep = xmlStringDecodeEntities(ctxt, ent->content, what, +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0012-Heap-use-after-free-in-htmlParsePubidLiteral-and-htm.patch libxml2-2.9.3+dfsg1/debian/patches/0012-Heap-use-after-free-in-htmlParsePubidLiteral-and-htm.patch --- libxml2-2.9.3+dfsg1/debian/patches/0012-Heap-use-after-free-in-htmlParsePubidLiteral-and-htm.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0012-Heap-use-after-free-in-htmlParsePubidLiteral-and-htm.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,140 @@ +From 11ed4a7a90d5ce156a18980a4ad4e53e77384852 Mon Sep 17 00:00:00 2001 +From: Pranjal Jumde <pju...@apple.com> +Date: Wed, 2 Mar 2016 15:52:24 -0800 +Subject: [PATCH] Heap use-after-free in htmlParsePubidLiteral and + htmlParseSystemiteral + +For https://bugzilla.gnome.org/show_bug.cgi?id=760263 + +* HTMLparser.c: Add BASE_PTR convenience macro. +(htmlParseSystemLiteral): Store length and start position instead +of a pointer while iterating through the public identifier since +the underlying buffer may change, resulting in a stale pointer +being used. +(htmlParsePubidLiteral): Ditto. +--- + HTMLparser.c | 58 +++++++++++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 43 insertions(+), 15 deletions(-) + +diff --git a/HTMLparser.c b/HTMLparser.c +index 0985d1d..d1395fa 100644 +--- a/HTMLparser.c ++++ b/HTMLparser.c +@@ -303,6 +303,7 @@ htmlNodeInfoPop(htmlParserCtxtPtr ctxt) + #define UPP(val) (toupper(ctxt->input->cur[(val)])) + + #define CUR_PTR ctxt->input->cur ++#define BASE_PTR ctxt->input->base + + #define SHRINK if ((ctxt->input->cur - ctxt->input->base > 2 * INPUT_CHUNK) && \ + (ctxt->input->end - ctxt->input->cur < 2 * INPUT_CHUNK)) \ +@@ -2781,31 +2782,43 @@ htmlParseAttValue(htmlParserCtxtPtr ctxt) { + + static xmlChar * + htmlParseSystemLiteral(htmlParserCtxtPtr ctxt) { +- const xmlChar *q; ++ size_t len = 0, startPosition = 0; + xmlChar *ret = NULL; + + if (CUR == '"') { + NEXT; +- q = CUR_PTR; +- while ((IS_CHAR_CH(CUR)) && (CUR != '"')) ++ ++ if (CUR_PTR < BASE_PTR) ++ return(ret); ++ startPosition = CUR_PTR - BASE_PTR; ++ ++ while ((IS_CHAR_CH(CUR)) && (CUR != '"')) { + NEXT; ++ len++; ++ } + if (!IS_CHAR_CH(CUR)) { + htmlParseErr(ctxt, XML_ERR_LITERAL_NOT_FINISHED, + "Unfinished SystemLiteral\n", NULL, NULL); + } else { +- ret = xmlStrndup(q, CUR_PTR - q); ++ ret = xmlStrndup((BASE_PTR+startPosition), len); + NEXT; + } + } else if (CUR == '\'') { + NEXT; +- q = CUR_PTR; +- while ((IS_CHAR_CH(CUR)) && (CUR != '\'')) ++ ++ if (CUR_PTR < BASE_PTR) ++ return(ret); ++ startPosition = CUR_PTR - BASE_PTR; ++ ++ while ((IS_CHAR_CH(CUR)) && (CUR != '\'')) { + NEXT; ++ len++; ++ } + if (!IS_CHAR_CH(CUR)) { + htmlParseErr(ctxt, XML_ERR_LITERAL_NOT_FINISHED, + "Unfinished SystemLiteral\n", NULL, NULL); + } else { +- ret = xmlStrndup(q, CUR_PTR - q); ++ ret = xmlStrndup((BASE_PTR+startPosition), len); + NEXT; + } + } else { +@@ -2829,32 +2842,47 @@ htmlParseSystemLiteral(htmlParserCtxtPtr ctxt) { + + static xmlChar * + htmlParsePubidLiteral(htmlParserCtxtPtr ctxt) { +- const xmlChar *q; ++ size_t len = 0, startPosition = 0; + xmlChar *ret = NULL; + /* + * Name ::= (Letter | '_') (NameChar)* + */ + if (CUR == '"') { + NEXT; +- q = CUR_PTR; +- while (IS_PUBIDCHAR_CH(CUR)) NEXT; ++ ++ if (CUR_PTR < BASE_PTR) ++ return(ret); ++ startPosition = CUR_PTR - BASE_PTR; ++ ++ while (IS_PUBIDCHAR_CH(CUR)) { ++ len++; ++ NEXT; ++ } ++ + if (CUR != '"') { + htmlParseErr(ctxt, XML_ERR_LITERAL_NOT_FINISHED, + "Unfinished PubidLiteral\n", NULL, NULL); + } else { +- ret = xmlStrndup(q, CUR_PTR - q); ++ ret = xmlStrndup((BASE_PTR + startPosition), len); + NEXT; + } + } else if (CUR == '\'') { + NEXT; +- q = CUR_PTR; +- while ((IS_PUBIDCHAR_CH(CUR)) && (CUR != '\'')) +- NEXT; ++ ++ if (CUR_PTR < BASE_PTR) ++ return(ret); ++ startPosition = CUR_PTR - BASE_PTR; ++ ++ while ((IS_PUBIDCHAR_CH(CUR)) && (CUR != '\'')){ ++ len++; ++ NEXT; ++ } ++ + if (CUR != '\'') { + htmlParseErr(ctxt, XML_ERR_LITERAL_NOT_FINISHED, + "Unfinished PubidLiteral\n", NULL, NULL); + } else { +- ret = xmlStrndup(q, CUR_PTR - q); ++ ret = xmlStrndup((BASE_PTR + startPosition), len); + NEXT; + } + } else { +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0013-Heap-use-after-free-in-xmlSAX2AttributeNs.patch libxml2-2.9.3+dfsg1/debian/patches/0013-Heap-use-after-free-in-xmlSAX2AttributeNs.patch --- libxml2-2.9.3+dfsg1/debian/patches/0013-Heap-use-after-free-in-xmlSAX2AttributeNs.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0013-Heap-use-after-free-in-xmlSAX2AttributeNs.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,148 @@ +From 38eae571111db3b43ffdeb05487c9f60551906fb Mon Sep 17 00:00:00 2001 +From: Pranjal Jumde <pju...@apple.com> +Date: Mon, 7 Mar 2016 14:04:08 -0800 +Subject: [PATCH] Heap use-after-free in xmlSAX2AttributeNs + +For https://bugzilla.gnome.org/show_bug.cgi?id=759020 + +* parser.c: +(xmlParseStartTag2): Attribute strings are only valid if the +base does not change, so add another check where the base may +change. Make sure to set 'attvalue' to NULL after freeing it. +* result/errors/759020.xml: Added. +* result/errors/759020.xml.err: Added. +* result/errors/759020.xml.str: Added. +* test/errors/759020.xml: Added test case. +--- + parser.c | 12 ++++++++++-- + result/errors/759020.xml | 0 + result/errors/759020.xml.err | 6 ++++++ + result/errors/759020.xml.str | 7 +++++++ + test/errors/759020.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++ + 5 files changed, 69 insertions(+), 2 deletions(-) + create mode 100644 result/errors/759020.xml + create mode 100644 result/errors/759020.xml.err + create mode 100644 result/errors/759020.xml.str + create mode 100644 test/errors/759020.xml + +diff --git a/parser.c b/parser.c +index 15c606f..7aba6a9 100644 +--- a/parser.c ++++ b/parser.c +@@ -9488,7 +9488,10 @@ reparse: + else + if (nsPush(ctxt, NULL, URL) > 0) nbNs++; + skip_default_ns: +- if (alloc != 0) xmlFree(attvalue); ++ if ((attvalue != NULL) && (alloc != 0)) { ++ xmlFree(attvalue); ++ attvalue = NULL; ++ } + if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>')))) + break; + if (!IS_BLANK_CH(RAW)) { +@@ -9497,6 +9500,8 @@ skip_default_ns: + break; + } + SKIP_BLANKS; ++ if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) ++ goto base_changed; + continue; + } + if (aprefix == ctxt->str_xmlns) { +@@ -9568,7 +9573,10 @@ skip_default_ns: + else + if (nsPush(ctxt, attname, URL) > 0) nbNs++; + skip_ns: +- if (alloc != 0) xmlFree(attvalue); ++ if ((attvalue != NULL) && (alloc != 0)) { ++ xmlFree(attvalue); ++ attvalue = NULL; ++ } + if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>')))) + break; + if (!IS_BLANK_CH(RAW)) { +diff --git a/result/errors/759020.xml b/result/errors/759020.xml +new file mode 100644 +index 0000000..e69de29 +diff --git a/result/errors/759020.xml.err b/result/errors/759020.xml.err +new file mode 100644 +index 0000000..a0d3051 +--- /dev/null ++++ b/result/errors/759020.xml.err +@@ -0,0 +1,6 @@ ++./test/errors/759020.xml:3: namespace warning : xmlns: URI 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 is not absolute ++0000000000000000000000000000000000000000000000000000000000000000000000000000000' ++ ^ ++./test/errors/759020.xml:46: parser error : Couldn't find end of Start Tag s00 line 2 ++ ++ ^ +diff --git a/result/errors/759020.xml.str b/result/errors/759020.xml.str +new file mode 100644 +index 0000000..998d6d2 +--- /dev/null ++++ b/result/errors/759020.xml.str +@@ -0,0 +1,7 @@ ++./test/errors/759020.xml:3: namespace warning : xmlns: URI 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 is not absolute ++0000000000000000000000000000000000000000000000000000000000000000000000000000000' ++ ^ ++./test/errors/759020.xml:46: parser error : Couldn't find end of Start Tag s00 ++ ++ ^ ++./test/errors/759020.xml : failed to parse +diff --git a/test/errors/759020.xml b/test/errors/759020.xml +new file mode 100644 +index 0000000..db23275 +--- /dev/null ++++ b/test/errors/759020.xml +@@ -0,0 +1,46 @@ ++<?l 00000000000000000000000000000?> ++<s00 w0000="000" h00000="000" ++ xmlns = '00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000' ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +\ No newline at end of file +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0014-Heap-based-buffer-underreads-due-to-xmlParseName.patch libxml2-2.9.3+dfsg1/debian/patches/0014-Heap-based-buffer-underreads-due-to-xmlParseName.patch --- libxml2-2.9.3+dfsg1/debian/patches/0014-Heap-based-buffer-underreads-due-to-xmlParseName.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0014-Heap-based-buffer-underreads-due-to-xmlParseName.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,218 @@ +From 00906759053986b8079985644172085f74331f83 Mon Sep 17 00:00:00 2001 +From: David Kilzer <ddkil...@apple.com> +Date: Tue, 26 Jan 2016 16:57:03 -0800 +Subject: [PATCH] Heap-based buffer-underreads due to xmlParseName + +For https://bugzilla.gnome.org/show_bug.cgi?id=759573 + +* parser.c: +(xmlParseElementDecl): Return early on invalid input to fix +non-minimized test case (759573-2.xml). Otherwise the parser +gets into a bad state in SKIP(3) at the end of the function. +(xmlParseConditionalSections): Halt parsing when hitting invalid +input that would otherwise caused xmlParserHandlePEReference() +to recurse unexpectedly. This fixes the minimized test case +(759573.xml). + +* result/errors/759573-2.xml: Add. +* result/errors/759573-2.xml.err: Add. +* result/errors/759573-2.xml.str: Add. +* result/errors/759573.xml: Add. +* result/errors/759573.xml.err: Add. +* result/errors/759573.xml.str: Add. +* test/errors/759573-2.xml: Add. +* test/errors/759573.xml: Add. +--- + parser.c | 2 ++ + result/errors/759573-2.xml | 0 + result/errors/759573-2.xml.err | 58 ++++++++++++++++++++++++++++++++++++++++++ + result/errors/759573-2.xml.str | 4 +++ + result/errors/759573.xml | 0 + result/errors/759573.xml.err | 31 ++++++++++++++++++++++ + result/errors/759573.xml.str | 4 +++ + test/errors/759573-2.xml | 9 +++++++ + test/errors/759573.xml | 1 + + 9 files changed, 109 insertions(+) + create mode 100644 result/errors/759573-2.xml + create mode 100644 result/errors/759573-2.xml.err + create mode 100644 result/errors/759573-2.xml.str + create mode 100644 result/errors/759573.xml + create mode 100644 result/errors/759573.xml.err + create mode 100644 result/errors/759573.xml.str + create mode 100644 test/errors/759573-2.xml + create mode 100644 test/errors/759573.xml + +diff --git a/parser.c b/parser.c +index 7aba6a9..ea0e89e 100644 +--- a/parser.c ++++ b/parser.c +@@ -6708,6 +6708,7 @@ xmlParseElementDecl(xmlParserCtxtPtr ctxt) { + if (!IS_BLANK_CH(CUR)) { + xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, + "Space required after 'ELEMENT'\n"); ++ return(-1); + } + SKIP_BLANKS; + name = xmlParseName(ctxt); +@@ -6859,6 +6860,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) { + + if ((CUR_PTR == check) && (cons == ctxt->input->consumed)) { + xmlFatalErr(ctxt, XML_ERR_EXT_SUBSET_NOT_FINISHED, NULL); ++ xmlHaltParser(ctxt); + break; + } + } +diff --git a/result/errors/759573-2.xml b/result/errors/759573-2.xml +new file mode 100644 +index 0000000..e69de29 +diff --git a/result/errors/759573-2.xml.err b/result/errors/759573-2.xml.err +new file mode 100644 +index 0000000..d8773d8 +--- /dev/null ++++ b/result/errors/759573-2.xml.err +@@ -0,0 +1,58 @@ ++Entity: line 1: parser error : Space required after '<!ENTITY' ++ %zz; ++ ^ ++Entity: line 1: ++<!ENTITY<?xDOCTYPEm~?> ++ ^ ++Entity: line 1: parser error : xmlParseEntityDecl: no name ++ %zz; ++ ^ ++Entity: line 1: ++<!ENTITY<?xDOCTYPEm~?> ++ ^ ++Entity: line 1: parser error : ParsePI: PI xDOCTYPEm space expected ++ %zz; ++ ^ ++Entity: line 1: ++<!ENTITY<?xDOCTYPEm~?> ++ ^ ++Entity: line 1: parser error : Space required after '<!ENTITY' ++ %zz; ++ ^ ++Entity: line 1: ++<!ENTITY<?xDOCTYPEm~?> ++ ^ ++Entity: line 1: parser error : xmlParseEntityDecl: no name ++ %zz; ++ ^ ++Entity: line 1: ++<!ENTITY<?xDOCTYPEm~?> ++ ^ ++Entity: line 1: parser error : ParsePI: PI xDOCTYPEm space expected ++ %zz; ++ ^ ++Entity: line 1: ++<!ENTITY<?xDOCTYPEm~?> ++ ^ ++Entity: line 1: parser error : Space required after 'ELEMENT' ++ %xx; ++ ^ ++Entity: line 3: ++%zz;<!ELEMENTD(%MENT%MENTD??MENTD%zNMT9KENSMYSYSTEM;MENT9%zz; ++ ^ ++Entity: line 1: parser error : Content error in the external subset ++ %xx; ++ ^ ++Entity: line 3: ++%zz;<!ELEMENTD(%MENT%MENTD??MENTD%zNMT9KENSMYSYSTEM;MENT9%zz; ++ ^ ++./test/errors/759573-2.xml:6: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration ++ ++%xx;?ggKENSMYNT#MENTDŴzz;'> ++ ^ ++./test/errors/759573-2.xml:6: parser error : DOCTYPE improperly terminated ++%xx;?ggKENSMYNT#MENTDŴzz;'> ++ ^ ++./test/errors/759573-2.xml:6: parser error : Start tag expected, '<' not found ++%xx;?ggKENSMYNT#MENTDŴzz;'> ++ ^ +diff --git a/result/errors/759573-2.xml.str b/result/errors/759573-2.xml.str +new file mode 100644 +index 0000000..baac164 +--- /dev/null ++++ b/result/errors/759573-2.xml.str +@@ -0,0 +1,4 @@ ++./test/errors/759573-2.xml:2: parser error : Extra content at the end of the document ++<!DOCTYPE test [ ++ ^ ++./test/errors/759573-2.xml : failed to parse +diff --git a/result/errors/759573.xml b/result/errors/759573.xml +new file mode 100644 +index 0000000..e69de29 +diff --git a/result/errors/759573.xml.err b/result/errors/759573.xml.err +new file mode 100644 +index 0000000..2c21e9a +--- /dev/null ++++ b/result/errors/759573.xml.err +@@ -0,0 +1,31 @@ ++./test/errors/759573.xml:1: parser error : Space required after '<!ENTITY' ++ELEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ000%z;'><!ENTITY ++ ^ ++./test/errors/759573.xml:1: parser error : Space required after the entity name ++LEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ000%z;'><!ENTITYz ++ ^ ++./test/errors/759573.xml:1: parser error : Entity value required ++LEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ000%z;'><!ENTITYz ++ ^ ++Entity: line 1: parser error : PEReference: no name ++ %xx; ++ ^ ++Entity: line 1: ++%<![INCLUDE[000%???000%z; ++ ^ ++Entity: line 1: parser error : Content error in the external subset ++ %xx; ++ ^ ++Entity: line 1: ++%<![INCLUDE[000%???000%z; ++ ^ ++./test/errors/759573.xml:1: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration ++ ++T t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ000%z;'><!ENTITYz>%xx; ++ ^ ++./test/errors/759573.xml:1: parser error : DOCTYPE improperly terminated ++T t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ000%z;'><!ENTITYz>%xx; ++ ^ ++./test/errors/759573.xml:1: parser error : Start tag expected, '<' not found ++T t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ000%z;'><!ENTITYz>%xx; ++ ^ +diff --git a/result/errors/759573.xml.str b/result/errors/759573.xml.str +new file mode 100644 +index 0000000..1b6addb +--- /dev/null ++++ b/result/errors/759573.xml.str +@@ -0,0 +1,4 @@ ++./test/errors/759573.xml:1: parser error : Extra content at the end of the document ++<?h?><!DOCTYPEt[<!ELEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ00 ++ ^ ++./test/errors/759573.xml : failed to parse +diff --git a/test/errors/759573-2.xml b/test/errors/759573-2.xml +new file mode 100644 +index 0000000..5ad655f +--- /dev/null ++++ b/test/errors/759573-2.xml +@@ -0,0 +1,9 @@ ++<?xmh ven="1.0"?> ++<!DOCTYPE test [ ++<!ELEMENT test (#PCDATA) > ++<!ENTITY % xx '%zz; <![INCLUDE[ %zz;<!ELEMENTD(%MENT%MENTDŹMENTD%zNMT9KENSMYSYSTEM;MENT9%zz;'> ++<!ENTITY % zz '<!ENTITY<?xDOCTYPEm~?>' > ++%xx;?ggKENSMYNT#MENTDŴzz;'> ++<!ENBITY % zz '<!EN#3&##37;z ';!EY'#x;g ++<!ENTent ref="b?:b>r.B"/> ++e </ +\ No newline at end of file +diff --git a/test/errors/759573.xml b/test/errors/759573.xml +new file mode 100644 +index 0000000..69ebb57 +--- /dev/null ++++ b/test/errors/759573.xml +@@ -0,0 +1 @@ ++<?h?><!DOCTYPEt[<!ELEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ000%z;'><!ENTITYz>%xx; +\ No newline at end of file +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0015-Heap-based-buffer-overread-in-htmlCurrentChar.patch libxml2-2.9.3+dfsg1/debian/patches/0015-Heap-based-buffer-overread-in-htmlCurrentChar.patch --- libxml2-2.9.3+dfsg1/debian/patches/0015-Heap-based-buffer-overread-in-htmlCurrentChar.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0015-Heap-based-buffer-overread-in-htmlCurrentChar.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,363 @@ +From 0bcd05c5cd83dec3406c8f68b769b1d610c72f76 Mon Sep 17 00:00:00 2001 +From: Pranjal Jumde <pju...@apple.com> +Date: Tue, 1 Mar 2016 15:18:04 -0800 +Subject: [PATCH] Heap-based buffer overread in htmlCurrentChar + +For https://bugzilla.gnome.org/show_bug.cgi?id=758606 + +* parserInternals.c: +(xmlNextChar): Add an test to catch other issues on ctxt->input +corruption proactively. +For non-UTF-8 charsets, xmlNextChar() failed to check for the end +of the input buffer and would continuing reading. Fix this by +pulling out the check for the end of the input buffer into common +code, and return if we reach the end of the input buffer +prematurely. +* result/HTML/758606.html: Added. +* result/HTML/758606.html.err: Added. +* result/HTML/758606.html.sax: Added. +* result/HTML/758606_2.html: Added. +* result/HTML/758606_2.html.err: Added. +* result/HTML/758606_2.html.sax: Added. +* test/HTML/758606.html: Added test case. +* test/HTML/758606_2.html: Added test case. +--- + parserInternals.c | 172 ++++++++++++++++++++++-------------------- + result/HTML/758606.html | 2 + + result/HTML/758606.html.err | 16 ++++ + result/HTML/758606.html.sax | 10 +++ + result/HTML/758606_2.html | 2 + + result/HTML/758606_2.html.err | 16 ++++ + result/HTML/758606_2.html.sax | 17 +++++ + test/HTML/758606.html | 1 + + test/HTML/758606_2.html | 1 + + 9 files changed, 154 insertions(+), 83 deletions(-) + create mode 100644 result/HTML/758606.html + create mode 100644 result/HTML/758606.html.err + create mode 100644 result/HTML/758606.html.sax + create mode 100644 result/HTML/758606_2.html + create mode 100644 result/HTML/758606_2.html.err + create mode 100644 result/HTML/758606_2.html.sax + create mode 100644 test/HTML/758606.html + create mode 100644 test/HTML/758606_2.html + +diff --git a/parserInternals.c b/parserInternals.c +index 8c79678..bfc778a 100644 +--- a/parserInternals.c ++++ b/parserInternals.c +@@ -55,6 +55,10 @@ + #include <libxml/globals.h> + #include <libxml/chvalid.h> + ++#define CUR(ctxt) ctxt->input->cur ++#define END(ctxt) ctxt->input->end ++#define VALID_CTXT(ctxt) (CUR(ctxt) <= END(ctxt)) ++ + #include "buf.h" + #include "enc.h" + +@@ -422,103 +426,105 @@ xmlNextChar(xmlParserCtxtPtr ctxt) + (ctxt->input == NULL)) + return; + +- if (ctxt->charset == XML_CHAR_ENCODING_UTF8) { +- if ((*ctxt->input->cur == 0) && +- (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0) && +- (ctxt->instate != XML_PARSER_COMMENT)) { +- /* +- * If we are at the end of the current entity and +- * the context allows it, we pop consumed entities +- * automatically. +- * the auto closing should be blocked in other cases +- */ ++ if (!(VALID_CTXT(ctxt))) { ++ xmlErrInternal(ctxt, "Parser input data memory error\n", NULL); ++ ctxt->errNo = XML_ERR_INTERNAL_ERROR; ++ xmlStopParser(ctxt); ++ return; ++ } ++ ++ if ((*ctxt->input->cur == 0) && ++ (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0)) { ++ if ((ctxt->instate != XML_PARSER_COMMENT)) + xmlPopInput(ctxt); +- } else { +- const unsigned char *cur; +- unsigned char c; ++ return; ++ } + +- /* +- * 2.11 End-of-Line Handling +- * the literal two-character sequence "#xD#xA" or a standalone +- * literal #xD, an XML processor must pass to the application +- * the single character #xA. +- */ +- if (*(ctxt->input->cur) == '\n') { +- ctxt->input->line++; ctxt->input->col = 1; +- } else +- ctxt->input->col++; ++ if (ctxt->charset == XML_CHAR_ENCODING_UTF8) { ++ const unsigned char *cur; ++ unsigned char c; + +- /* +- * We are supposed to handle UTF8, check it's valid +- * From rfc2044: encoding of the Unicode values on UTF-8: +- * +- * UCS-4 range (hex.) UTF-8 octet sequence (binary) +- * 0000 0000-0000 007F 0xxxxxxx +- * 0000 0080-0000 07FF 110xxxxx 10xxxxxx +- * 0000 0800-0000 FFFF 1110xxxx 10xxxxxx 10xxxxxx +- * +- * Check for the 0x110000 limit too +- */ +- cur = ctxt->input->cur; ++ /* ++ * 2.11 End-of-Line Handling ++ * the literal two-character sequence "#xD#xA" or a standalone ++ * literal #xD, an XML processor must pass to the application ++ * the single character #xA. ++ */ ++ if (*(ctxt->input->cur) == '\n') { ++ ctxt->input->line++; ctxt->input->col = 1; ++ } else ++ ctxt->input->col++; + +- c = *cur; +- if (c & 0x80) { +- if (c == 0xC0) +- goto encoding_error; +- if (cur[1] == 0) { ++ /* ++ * We are supposed to handle UTF8, check it's valid ++ * From rfc2044: encoding of the Unicode values on UTF-8: ++ * ++ * UCS-4 range (hex.) UTF-8 octet sequence (binary) ++ * 0000 0000-0000 007F 0xxxxxxx ++ * 0000 0080-0000 07FF 110xxxxx 10xxxxxx ++ * 0000 0800-0000 FFFF 1110xxxx 10xxxxxx 10xxxxxx ++ * ++ * Check for the 0x110000 limit too ++ */ ++ cur = ctxt->input->cur; ++ ++ c = *cur; ++ if (c & 0x80) { ++ if (c == 0xC0) ++ goto encoding_error; ++ if (cur[1] == 0) { ++ xmlParserInputGrow(ctxt->input, INPUT_CHUNK); ++ cur = ctxt->input->cur; ++ } ++ if ((cur[1] & 0xc0) != 0x80) ++ goto encoding_error; ++ if ((c & 0xe0) == 0xe0) { ++ unsigned int val; ++ ++ if (cur[2] == 0) { + xmlParserInputGrow(ctxt->input, INPUT_CHUNK); + cur = ctxt->input->cur; + } +- if ((cur[1] & 0xc0) != 0x80) ++ if ((cur[2] & 0xc0) != 0x80) + goto encoding_error; +- if ((c & 0xe0) == 0xe0) { +- unsigned int val; +- +- if (cur[2] == 0) { ++ if ((c & 0xf0) == 0xf0) { ++ if (cur[3] == 0) { + xmlParserInputGrow(ctxt->input, INPUT_CHUNK); + cur = ctxt->input->cur; + } +- if ((cur[2] & 0xc0) != 0x80) ++ if (((c & 0xf8) != 0xf0) || ++ ((cur[3] & 0xc0) != 0x80)) + goto encoding_error; +- if ((c & 0xf0) == 0xf0) { +- if (cur[3] == 0) { +- xmlParserInputGrow(ctxt->input, INPUT_CHUNK); +- cur = ctxt->input->cur; +- } +- if (((c & 0xf8) != 0xf0) || +- ((cur[3] & 0xc0) != 0x80)) +- goto encoding_error; +- /* 4-byte code */ +- ctxt->input->cur += 4; +- val = (cur[0] & 0x7) << 18; +- val |= (cur[1] & 0x3f) << 12; +- val |= (cur[2] & 0x3f) << 6; +- val |= cur[3] & 0x3f; +- } else { +- /* 3-byte code */ +- ctxt->input->cur += 3; +- val = (cur[0] & 0xf) << 12; +- val |= (cur[1] & 0x3f) << 6; +- val |= cur[2] & 0x3f; +- } +- if (((val > 0xd7ff) && (val < 0xe000)) || +- ((val > 0xfffd) && (val < 0x10000)) || +- (val >= 0x110000)) { +- xmlErrEncodingInt(ctxt, XML_ERR_INVALID_CHAR, +- "Char 0x%X out of allowed range\n", +- val); +- } +- } else +- /* 2-byte code */ +- ctxt->input->cur += 2; ++ /* 4-byte code */ ++ ctxt->input->cur += 4; ++ val = (cur[0] & 0x7) << 18; ++ val |= (cur[1] & 0x3f) << 12; ++ val |= (cur[2] & 0x3f) << 6; ++ val |= cur[3] & 0x3f; ++ } else { ++ /* 3-byte code */ ++ ctxt->input->cur += 3; ++ val = (cur[0] & 0xf) << 12; ++ val |= (cur[1] & 0x3f) << 6; ++ val |= cur[2] & 0x3f; ++ } ++ if (((val > 0xd7ff) && (val < 0xe000)) || ++ ((val > 0xfffd) && (val < 0x10000)) || ++ (val >= 0x110000)) { ++ xmlErrEncodingInt(ctxt, XML_ERR_INVALID_CHAR, ++ "Char 0x%X out of allowed range\n", ++ val); ++ } + } else +- /* 1-byte code */ +- ctxt->input->cur++; ++ /* 2-byte code */ ++ ctxt->input->cur += 2; ++ } else ++ /* 1-byte code */ ++ ctxt->input->cur++; + +- ctxt->nbChars++; +- if (*ctxt->input->cur == 0) +- xmlParserInputGrow(ctxt->input, INPUT_CHUNK); +- } ++ ctxt->nbChars++; ++ if (*ctxt->input->cur == 0) ++ xmlParserInputGrow(ctxt->input, INPUT_CHUNK); + } else { + /* + * Assume it's a fixed length encoding (1) with +diff --git a/result/HTML/758606.html b/result/HTML/758606.html +new file mode 100644 +index 0000000..4f21f62 +--- /dev/null ++++ b/result/HTML/758606.html +@@ -0,0 +1,2 @@ ++<!DOCTYPE > ++ +diff --git a/result/HTML/758606.html.err b/result/HTML/758606.html.err +new file mode 100644 +index 0000000..060433a +--- /dev/null ++++ b/result/HTML/758606.html.err +@@ -0,0 +1,16 @@ ++./test/HTML/758606.html:1: HTML parser error : Comment not terminated ++<!-- ++<!-- <!doctype ++ ^ ++./test/HTML/758606.html:1: HTML parser error : Invalid char in CDATA 0xC ++<!-- <!doctype ++ ^ ++./test/HTML/758606.html:1: HTML parser error : Misplaced DOCTYPE declaration ++<!-- <!doctype ++ ^ ++./test/HTML/758606.html:2: HTML parser error : htmlParseDocTypeDecl : no DOCTYPE name ! ++ ++^ ++./test/HTML/758606.html:2: HTML parser error : DOCTYPE improperly terminated ++ ++^ +diff --git a/result/HTML/758606.html.sax b/result/HTML/758606.html.sax +new file mode 100644 +index 0000000..d44a5cf +--- /dev/null ++++ b/result/HTML/758606.html.sax +@@ -0,0 +1,10 @@ ++SAX.setDocumentLocator() ++SAX.startDocument() ++SAX.error: Comment not terminated ++<!-- ++SAX.error: Invalid char in CDATA 0xC ++SAX.error: Misplaced DOCTYPE declaration ++SAX.error: htmlParseDocTypeDecl : no DOCTYPE name ! ++SAX.error: DOCTYPE improperly terminated ++SAX.internalSubset((null), , ) ++SAX.endDocument() +diff --git a/result/HTML/758606_2.html b/result/HTML/758606_2.html +new file mode 100644 +index 0000000..273816a +--- /dev/null ++++ b/result/HTML/758606_2.html +@@ -0,0 +1,2 @@ ++<!DOCTYPE > ++<html><body><p>‘</p></body></html> +diff --git a/result/HTML/758606_2.html.err b/result/HTML/758606_2.html.err +new file mode 100644 +index 0000000..4be039f +--- /dev/null ++++ b/result/HTML/758606_2.html.err +@@ -0,0 +1,16 @@ ++./test/HTML/758606_2.html:1: HTML parser error : Comment not terminated ++<!-- ++<!-- ?<!dOctYPE ++ ^ ++./test/HTML/758606_2.html:1: HTML parser error : Invalid char in CDATA 0xC ++<!-- ?<!dOctYPE ++ ^ ++./test/HTML/758606_2.html:1: HTML parser error : Misplaced DOCTYPE declaration ++??<!dOctYPE ++ ^ ++./test/HTML/758606_2.html:2: HTML parser error : htmlParseDocTypeDecl : no DOCTYPE name ! ++ ++^ ++./test/HTML/758606_2.html:2: HTML parser error : DOCTYPE improperly terminated ++ ++^ +diff --git a/result/HTML/758606_2.html.sax b/result/HTML/758606_2.html.sax +new file mode 100644 +index 0000000..80ff3d7 +--- /dev/null ++++ b/result/HTML/758606_2.html.sax +@@ -0,0 +1,17 @@ ++SAX.setDocumentLocator() ++SAX.startDocument() ++SAX.error: Comment not terminated ++<!-- ++SAX.error: Invalid char in CDATA 0xC ++SAX.startElement(html) ++SAX.startElement(body) ++SAX.startElement(p) ++SAX.characters(‘, 2) ++SAX.error: Misplaced DOCTYPE declaration ++SAX.error: htmlParseDocTypeDecl : no DOCTYPE name ! ++SAX.error: DOCTYPE improperly terminated ++SAX.internalSubset((null), , ) ++SAX.endElement(p) ++SAX.endElement(body) ++SAX.endElement(html) ++SAX.endDocument() +diff --git a/test/HTML/758606.html b/test/HTML/758606.html +new file mode 100644 +index 0000000..01a013c +--- /dev/null ++++ b/test/HTML/758606.html +@@ -0,0 +1 @@ ++<!-- <!doctype +diff --git a/test/HTML/758606_2.html b/test/HTML/758606_2.html +new file mode 100644 +index 0000000..daa185b +--- /dev/null ++++ b/test/HTML/758606_2.html +@@ -0,0 +1 @@ ++<!-- ?<!dOctYPE +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/0016-Avoid-building-recursive-entities.patch libxml2-2.9.3+dfsg1/debian/patches/0016-Avoid-building-recursive-entities.patch --- libxml2-2.9.3+dfsg1/debian/patches/0016-Avoid-building-recursive-entities.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/0016-Avoid-building-recursive-entities.patch 2016-05-28 07:06:45.000000000 +0200 @@ -0,0 +1,59 @@ +From bdd66182ef53fe1f7209ab6535fda56366bd7ac9 Mon Sep 17 00:00:00 2001 +From: Daniel Veillard <veill...@redhat.com> +Date: Mon, 23 May 2016 12:27:58 +0800 +Subject: [PATCH] Avoid building recursive entities + +For https://bugzilla.gnome.org/show_bug.cgi?id=762100 + +When we detect a recusive entity we should really not +build the associated data, moreover if someone bypass +libxml2 fatal errors and still tries to serialize a broken +entity make sure we don't risk to get ito a recursion + +* parser.c: xmlParserEntityCheck() don't build if entity loop + were found and remove the associated text content +* tree.c: xmlStringGetNodeList() avoid a potential recursion +--- + parser.c | 6 +++++- + tree.c | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/parser.c b/parser.c +index ea0e89e..53a6b7f 100644 +--- a/parser.c ++++ b/parser.c +@@ -138,7 +138,8 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, + * entities problems + */ + if ((ent != NULL) && (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) && +- (ent->content != NULL) && (ent->checked == 0)) { ++ (ent->content != NULL) && (ent->checked == 0) && ++ (ctxt->errNo != XML_ERR_ENTITY_LOOP)) { + unsigned long oldnbent = ctxt->nbentities; + xmlChar *rep; + +@@ -148,6 +149,9 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, + rep = xmlStringDecodeEntities(ctxt, ent->content, + XML_SUBSTITUTE_REF, 0, 0, 0); + --ctxt->depth; ++ if (ctxt->errNo == XML_ERR_ENTITY_LOOP) { ++ ent->content[0] = 0; ++ } + + ent->checked = (ctxt->nbentities - oldnbent + 1) * 2; + if (rep != NULL) { +diff --git a/tree.c b/tree.c +index 7fbca6e..9d330b8 100644 +--- a/tree.c ++++ b/tree.c +@@ -1593,6 +1593,7 @@ xmlStringGetNodeList(const xmlDoc *doc, const xmlChar *value) { + else if ((ent != NULL) && (ent->children == NULL)) { + xmlNodePtr temp; + ++ ent->children = (xmlNodePtr) -1; + ent->children = xmlStringGetNodeList(doc, + (const xmlChar*)node->content); + ent->owner = 1; +-- +2.8.1 + diff -Nru libxml2-2.9.3+dfsg1/debian/patches/series libxml2-2.9.3+dfsg1/debian/patches/series --- libxml2-2.9.3+dfsg1/debian/patches/series 2015-12-14 08:42:04.000000000 +0100 +++ libxml2-2.9.3+dfsg1/debian/patches/series 2016-05-28 07:06:45.000000000 +0200 @@ -1,2 +1,16 @@ 0001-modify-xml2-config-and-pkgconfig-behaviour.patch 0002-fix-python-multiarch-includes.patch +0003-Heap-based-buffer-overread-in-xmlNextChar.patch +0004-Bug-763071-heap-buffer-overflow-in-xmlStrncat-https-.patch +0005-Add-missing-increments-of-recursion-depth-counter-to.patch +0006-Avoid-an-out-of-bound-access-when-serializing-malfor.patch +0007-Bug-757711-heap-buffer-overflow-in-xmlFAParsePosChar.patch +0008-Bug-758588-Heap-based-buffer-overread-in-xmlParserPr.patch +0009-Bug-758605-Heap-based-buffer-overread-in-xmlDictAddS.patch +0010-Bug-759398-Heap-use-after-free-in-xmlDictComputeFast.patch +0011-Fix-inappropriate-fetch-of-entities-content.patch +0012-Heap-use-after-free-in-htmlParsePubidLiteral-and-htm.patch +0013-Heap-use-after-free-in-xmlSAX2AttributeNs.patch +0014-Heap-based-buffer-underreads-due-to-xmlParseName.patch +0015-Heap-based-buffer-overread-in-htmlCurrentChar.patch +0016-Avoid-building-recursive-entities.patch
signature.asc
Description: PGP signature
