Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=5dd61fc31858e3d2a574ce64939d42b7f7cbe37a
commit 5dd61fc31858e3d2a574ce64939d42b7f7cbe37a Author: kikadf <[email protected]> Date: Fri Oct 31 08:45:42 2014 +0100 libxml2-2.8.0-3-x86_64 * Fix CVE-2014-3660 * Fix old patches diff --git a/source/base/libxml2/CVE-2013-0339.patch b/source/base/libxml2/CVE-2013-0339.patch index e0d1378..769da50 100644 --- a/source/base/libxml2/CVE-2013-0339.patch +++ b/source/base/libxml2/CVE-2013-0339.patch @@ -1,53 +1,148 @@ -From 4629ee02ac649c27f9c0cf98ba017c6b5526070f Mon Sep 17 00:00:00 2001 +From 23f05e0c33987d6605387b300c4be5da2120a7ab Mon Sep 17 00:00:00 2001 From: Daniel Veillard <[email protected]> -Date: Mon, 23 Jul 2012 06:15:40 +0000 -Subject: Do not fetch external parsed entities +Date: Tue, 19 Feb 2013 02:21:49 +0000 +Subject: Detect excessive entities expansion upon replacement -Unless explicietely asked for when validating or replacing entities -with their value. Problem pointed out by Tom Lane <[email protected]> - -* parser.c: do not load external parsed entities unless needed -* test/errors/extparsedent.xml result/errors/extparsedent.xml*: - add a regression test to avoid change of the behaviour in the future +If entities expansion in the XML parser is asked for, +it is possble to craft relatively small input document leading +to excessive on-the-fly content generation. +This patch accounts for those replacement and stop parsing +after a given threshold. it can be bypassed as usual with the +HUGE parser option. --- -Index: libxml2-2.8.0+dfsg1/parser.c +Index: libxml2-2.8.0+dfsg1/include/libxml/parser.h =================================================================== ---- libxml2-2.8.0+dfsg1.orig/parser.c 2013-07-11 14:29:47.656521477 -0400 -+++ libxml2-2.8.0+dfsg1/parser.c 2013-07-11 14:29:47.652521477 -0400 -@@ -6943,8 +6943,15 @@ - * The first reference to the entity trigger a parsing phase - * where the ent->children is filled with the result from - * the parsing. -+ * Note: external parsed entities will not be loaded, it is not -+ * required for a non-validating parser, unless the parsing option -+ * of validating, or substituting entities were given. Doing so is -+ * far more secure as the parser will only process data coming from -+ * the document entity by default. - */ -- if (ent->checked == 0) { -+ if ((ent->checked == 0) && -+ ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) || -+ (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) { - unsigned long oldnbent = ctxt->nbentities; +--- libxml2-2.8.0+dfsg1.orig/include/libxml/parser.h 2013-03-06 15:25:52.856052514 -0500 ++++ libxml2-2.8.0+dfsg1/include/libxml/parser.h 2013-03-06 15:25:52.840052514 -0500 +@@ -310,6 +310,7 @@ + xmlParserNodeInfo *nodeInfoTab; /* array of nodeInfos */ - /* -Index: libxml2-2.8.0+dfsg1/result/errors/extparsedent.xml + int input_id; /* we need to label inputs */ ++ unsigned long sizeentcopy; /* volume of entity copy */ + }; + + /** +Index: libxml2-2.8.0+dfsg1/parser.c =================================================================== ---- /dev/null 1970-01-01 00:00:00.000000000 +0000 -+++ libxml2-2.8.0+dfsg1/result/errors/extparsedent.xml 2013-07-11 14:29:47.652521477 -0400 -@@ -0,0 +1,5 @@ -+<?xml version="1.0"?> -+<!DOCTYPE foo [ -+<!ENTITY c PUBLIC "bar" "/etc/doesnotexist"> -+]> -+<root>&c;</root> -Index: libxml2-2.8.0+dfsg1/test/errors/extparsedent.xml +--- libxml2-2.8.0+dfsg1.orig/parser.c 2013-03-06 15:25:52.856052514 -0500 ++++ libxml2-2.8.0+dfsg1/parser.c 2013-03-06 15:25:52.848052514 -0500 +@@ -119,7 +119,7 @@ + */ + static int + xmlParserEntityCheck(xmlParserCtxtPtr ctxt, unsigned long size, +- xmlEntityPtr ent) ++ xmlEntityPtr ent, unsigned long replacement) + { + unsigned long consumed = 0; + +@@ -127,7 +127,24 @@ + return (0); + if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) + return (1); +- if (size != 0) { ++ if (replacement != 0) { ++ if (replacement < XML_MAX_TEXT_LENGTH) ++ return(0); ++ ++ /* ++ * If the volume of entity copy reaches 10 times the ++ * amount of parsed data and over the large text threshold ++ * then that's very likely to be an abuse. ++ */ ++ if (ctxt->input != NULL) { ++ consumed = ctxt->input->consumed + ++ (ctxt->input->cur - ctxt->input->base); ++ } ++ consumed += ctxt->sizeentities; ++ ++ if (replacement < XML_PARSER_NON_LINEAR * consumed) ++ return(0); ++ } else if (size != 0) { + /* + * Do the check based on the replacement size of the entity + */ +@@ -173,7 +190,6 @@ + */ + return (0); + } +- + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); + return (1); + } +@@ -2706,7 +2722,7 @@ + buffer[nbchars++] = *current++; + if (nbchars > + buffer_size - XML_PARSER_BUFFER_SIZE) { +- if (xmlParserEntityCheck(ctxt, nbchars, ent)) ++ if (xmlParserEntityCheck(ctxt, nbchars, ent, 0)) + goto int_error; + growBuffer(buffer, XML_PARSER_BUFFER_SIZE); + } +@@ -2748,7 +2764,7 @@ + buffer[nbchars++] = *current++; + if (nbchars > + buffer_size - XML_PARSER_BUFFER_SIZE) { +- if (xmlParserEntityCheck(ctxt, nbchars, ent)) ++ if (xmlParserEntityCheck(ctxt, nbchars, ent, 0)) + goto int_error; + growBuffer(buffer, XML_PARSER_BUFFER_SIZE); + } +@@ -6976,7 +6992,7 @@ + xmlFreeNodeList(list); + return; + } +- if (xmlParserEntityCheck(ctxt, 0, ent)) { ++ if (xmlParserEntityCheck(ctxt, 0, ent, 0)) { + xmlFreeNodeList(list); + return; + } +@@ -7136,6 +7152,13 @@ + xmlNodePtr nw = NULL, cur, firstChild = NULL; + + /* ++ * We are copying here, make sure there is no abuse ++ */ ++ ctxt->sizeentcopy += ent->length; ++ if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy)) ++ return; ++ ++ /* + * when operating on a reader, the entities definitions + * are always owning the entities subtree. + if (ctxt->parseMode == XML_PARSE_READER) +@@ -7175,6 +7198,14 @@ + } else if (list == NULL) { + xmlNodePtr nw = NULL, cur, next, last, + firstChild = NULL; ++ ++ /* ++ * We are copying here, make sure there is no abuse ++ */ ++ ctxt->sizeentcopy += ent->length; ++ if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy)) ++ return; ++ + /* + * Copy the entity child list and make it the new + * entity child list. The goal is to make sure any +@@ -14355,6 +14386,7 @@ + ctxt->catalogs = NULL; + ctxt->nbentities = 0; + ctxt->sizeentities = 0; ++ ctxt->sizeentcopy = 0; + xmlInitNodeInfoSeq(&ctxt->node_seq); + + if (ctxt->attsDefault != NULL) { +Index: libxml2-2.8.0+dfsg1/parserInternals.c =================================================================== ---- /dev/null 1970-01-01 00:00:00.000000000 +0000 -+++ libxml2-2.8.0+dfsg1/test/errors/extparsedent.xml 2013-07-11 14:29:47.652521477 -0400 -@@ -0,0 +1,5 @@ -+<?xml version="1.0"?> -+<!DOCTYPE foo [ -+<!ENTITY c PUBLIC "bar" "/etc/doesnotexist"> -+]> -+<root>&c;</root> +--- libxml2-2.8.0+dfsg1.orig/parserInternals.c 2013-03-06 15:25:52.856052514 -0500 ++++ libxml2-2.8.0+dfsg1/parserInternals.c 2013-03-06 15:25:52.848052514 -0500 +@@ -1761,6 +1761,8 @@ + ctxt->charset = XML_CHAR_ENCODING_UTF8; + ctxt->catalogs = NULL; + ctxt->nbentities = 0; ++ ctxt->sizeentities = 0; ++ ctxt->sizeentcopy = 0; + ctxt->input_id = 1; + xmlInitNodeInfoSeq(&ctxt->node_seq); + return(0); diff --git a/source/base/libxml2/CVE-2014-0191.patch b/source/base/libxml2/CVE-2014-0191.patch index 7527fd7..6611a41 100644 --- a/source/base/libxml2/CVE-2014-0191.patch +++ b/source/base/libxml2/CVE-2014-0191.patch @@ -1,21 +1,21 @@ -From 9cd1c3cfbd32655d60572c0a413e017260c854df Mon Sep 17 00:00:00 2001 -From: Daniel Veillard <[email protected]> -Date: Tue, 22 Apr 2014 15:30:56 +0800 -Subject: Do not fetch external parameter entities +From: Aron Xu <[email protected]> +Date: Sun, 26 Oct 2014 12:24:03 +0800 +Subject: cve-2014-0191 -Unless explicitely asked for when validating or replacing entities -with their value. Problem pointed out by Daniel Berrange <[email protected]> +--- + parser.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) -Index: libxml2-2.8.0+dfsg1/parser.c -=================================================================== ---- libxml2-2.8.0+dfsg1.orig/parser.c 2014-05-08 14:29:31.687027612 -0400 -+++ libxml2-2.8.0+dfsg1/parser.c 2014-05-08 14:29:31.683027612 -0400 -@@ -2566,6 +2566,20 @@ +diff --git a/parser.c b/parser.c +index 57500ef..7ef712d 100644 +--- a/parser.c ++++ b/parser.c +@@ -2564,6 +2564,23 @@ xmlParserHandlePEReference(xmlParserCtxtPtr ctxt) { xmlCharEncoding enc; /* -+ * Note: external parsed entities will not be loaded, it is -+ * not required for a non-validating parser, unless the ++ * Note: external parameter entities will not be loaded, it ++ * is not required for a non-validating parser, unless the + * option of validating, or substituting entities were + * given. Doing so is far more secure as the parser will + * only process data coming from the document entity by @@ -24,6 +24,9 @@ Index: libxml2-2.8.0+dfsg1/parser.c + if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) && + ((ctxt->options & XML_PARSE_NOENT) == 0) && + ((ctxt->options & XML_PARSE_DTDVALID) == 0) && ++ ((ctxt->options & XML_PARSE_DTDLOAD) == 0) && ++ ((ctxt->options & XML_PARSE_DTDATTR) == 0) && ++ (ctxt->replaceEntities == 0) && + (ctxt->validate == 0)) + return; + @@ -31,3 +34,23 @@ Index: libxml2-2.8.0+dfsg1/parser.c * handle the extra spaces added before and after * c.f. http://www.w3.org/TR/REC-xml#as-PE * this is done independently. +@@ -12197,6 +12214,9 @@ xmlIOParseDTD(xmlSAXHandlerPtr sax, xmlParserInputBufferPtr input, + return(NULL); + } + ++ /* We are loading a DTD */ ++ ctxt->options |= XML_PARSE_DTDLOAD; ++ + /* + * Set-up the SAX context + */ +@@ -12324,6 +12344,9 @@ xmlSAXParseDTD(xmlSAXHandlerPtr sax, const xmlChar *ExternalID, + return(NULL); + } + ++ /* We are loading a DTD */ ++ ctxt->options |= XML_PARSE_DTDLOAD; ++ + /* + * Set-up the SAX context + */ diff --git a/source/base/libxml2/CVE-2014-3660.patch b/source/base/libxml2/CVE-2014-3660.patch new file mode 100644 index 0000000..89698f3 --- /dev/null +++ b/source/base/libxml2/CVE-2014-3660.patch @@ -0,0 +1,139 @@ +From: Daniel Veillard <[email protected]> +Date: Sun, 26 Oct 2014 12:35:43 +0800 +Subject: Fix for CVE-2014-3660 + +--- + parser.c | 42 ++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 38 insertions(+), 4 deletions(-) + +diff --git a/parser.c b/parser.c +index 7ef712d..b435913 100644 +--- a/parser.c ++++ b/parser.c +@@ -127,6 +127,29 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, + return (0); + if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) + return (1); ++ ++ /* ++ * This may look absurd but is needed to detect ++ * entities problems ++ */ ++ if ((ent != NULL) && (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) && ++ (ent->content != NULL) && (ent->checked == 0)) { ++ unsigned long oldnbent = ctxt->nbentities; ++ xmlChar *rep; ++ ++ ent->checked = 1; ++ ++ rep = xmlStringDecodeEntities(ctxt, ent->content, ++ XML_SUBSTITUTE_REF, 0, 0, 0); ++ ++ ent->checked = (ctxt->nbentities - oldnbent + 1) * 2; ++ if (rep != NULL) { ++ if (xmlStrchr(rep, '<')) ++ ent->checked |= 1; ++ xmlFree(rep); ++ rep = NULL; ++ } ++ } + if (replacement != 0) { + if (replacement < XML_MAX_TEXT_LENGTH) + return(0); +@@ -186,9 +209,12 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, + return (0); + } else { + /* +- * strange we got no data for checking just return ++ * strange we got no data for checking + */ +- return (0); ++ if (((ctxt->lastError.code != XML_ERR_UNDECLARED_ENTITY) && ++ (ctxt->lastError.code != XML_WAR_UNDECLARED_ENTITY)) || ++ (ctxt->nbentities <= 10000)) ++ return (0); + } + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); + return (1); +@@ -2553,6 +2579,7 @@ xmlParserHandlePEReference(xmlParserCtxtPtr ctxt) { + name, NULL); + ctxt->valid = 0; + } ++ xmlParserEntityCheck(ctxt, 0, NULL, 0); + } else if (ctxt->input->free != deallocblankswrapper) { + input = xmlNewBlanksWrapperInputStream(ctxt, entity); + if (xmlPushInput(ctxt, input) < 0) +@@ -2723,6 +2750,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len, + if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) || + (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR)) + goto int_error; ++ xmlParserEntityCheck(ctxt, 0, ent, 0); + if (ent != NULL) + ctxt->nbentities += ent->checked; + if ((ent != NULL) && +@@ -2774,6 +2802,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len, + ent = xmlParseStringPEReference(ctxt, &str); + if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) + goto int_error; ++ xmlParserEntityCheck(ctxt, 0, ent, 0); + if (ent != NULL) + ctxt->nbentities += ent->checked; + if (ent != NULL) { +@@ -7127,6 +7156,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) { + (ret != XML_WAR_UNDECLARED_ENTITY)) { + xmlFatalErrMsgStr(ctxt, XML_ERR_UNDECLARED_ENTITY, + "Entity '%s' failed to parse\n", ent->name); ++ xmlParserEntityCheck(ctxt, 0, ent, 0); + } else if (list != NULL) { + xmlFreeNodeList(list); + list = NULL; +@@ -7235,7 +7265,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) { + /* + * We are copying here, make sure there is no abuse + */ +- ctxt->sizeentcopy += ent->length; ++ ctxt->sizeentcopy += ent->length + 5; + if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy)) + return; + +@@ -7283,7 +7313,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) { + /* + * We are copying here, make sure there is no abuse + */ +- ctxt->sizeentcopy += ent->length; ++ ctxt->sizeentcopy += ent->length + 5; + if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy)) + return; + +@@ -7467,6 +7497,7 @@ xmlParseEntityRef(xmlParserCtxtPtr ctxt) { + ctxt->sax->reference(ctxt->userData, name); + } + } ++ xmlParserEntityCheck(ctxt, 0, ent, 0); + ctxt->valid = 0; + } + +@@ -7654,6 +7685,7 @@ xmlParseStringEntityRef(xmlParserCtxtPtr ctxt, const xmlChar ** str) { + "Entity '%s' not defined\n", + name); + } ++ xmlParserEntityCheck(ctxt, 0, ent, 0); + /* TODO ? check regressions ctxt->valid = 0; */ + } + +@@ -7812,6 +7844,7 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt) + name, NULL); + ctxt->valid = 0; + } ++ xmlParserEntityCheck(ctxt, 0, NULL, 0); + } else { + /* + * Internal checking in case the entity quest barfed +@@ -8039,6 +8072,7 @@ xmlParseStringPEReference(xmlParserCtxtPtr ctxt, const xmlChar **str) { + name, NULL); + ctxt->valid = 0; + } ++ xmlParserEntityCheck(ctxt, 0, NULL, 0); + } else { + /* + * Internal checking in case the entity quest barfed diff --git a/source/base/libxml2/FrugalBuild b/source/base/libxml2/FrugalBuild index 0873dd2..2b68cec 100644 --- a/source/base/libxml2/FrugalBuild +++ b/source/base/libxml2/FrugalBuild @@ -6,7 +6,7 @@ options+=('asneeded') pkgname=libxml2 pkgver=2.8.0 -pkgrel=2 +pkgrel=3 pkgdesc="XML parsing library" url="http://www.xmlsoft.org/"; groups=('base' 'chroot-core') @@ -27,12 +27,13 @@ subarchs=('i686 x86_64') # FSA fix *** -source=(${source[@]} CVE-2012-5134.patch CVE-2013-0339.patch - CVE-2013-2877.patch CVE-2014-0191.patch) +source=(${source[@]} CVE-2012-5134.patch CVE-2013-0339.patch CVE-2013-2877.patch + CVE-2014-0191.patch CVE-2014-3660.patch) sha1sums=(${sha1sums[@]} '5f2ca3ffa6f8ae87ca5f3be1bdd7c06f8ffdea35' \ - 'f449529958509f9e3b7c1e687bf1424e3e630c2b' \ + '802a1a8c33c8808effd4505419057a5dc27a9599' \ '8856fa620e57369a2c8b30f7e35afb78685ded69' \ - '13d518bbbe1f257d8c9580f9e22be3e28fec9426') + '9005e0b126756aba61e06a5bbfb8c97591caedd6' \ + 'ff56d72e53528ab2b6039d334d2f9834ca44efee') # *********** build() { _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
