|
 |
8fe6e1 |
commit a739613cfb5ee60919bd5ad545a5582fa8a6dad9
|
|
|
8fe6e1 |
Author: Tomas Korbar <tkorbar@redhat.com>
|
|
|
8fe6e1 |
Date: Mon Nov 14 12:37:16 2022 +0100
|
|
|
8fe6e1 |
|
|
|
8fe6e1 |
Fix CVE-2022-43680
|
|
|
8fe6e1 |
|
|
|
8fe6e1 |
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
|
|
|
8fe6e1 |
index 0cc24f6..3f765f7 100644
|
|
|
8fe6e1 |
--- a/lib/xmlparse.c
|
|
|
8fe6e1 |
+++ b/lib/xmlparse.c
|
|
|
8fe6e1 |
@@ -1016,6 +1016,14 @@ parserCreate(const XML_Char *encodingName,
|
|
|
8fe6e1 |
parserInit(parser, encodingName);
|
|
|
8fe6e1 |
|
|
|
8fe6e1 |
if (encodingName && !parser->m_protocolEncodingName) {
|
|
|
8fe6e1 |
+ if (dtd) {
|
|
|
8fe6e1 |
+ // We need to stop the upcoming call to XML_ParserFree from happily
|
|
|
8fe6e1 |
+ // destroying parser->m_dtd because the DTD is shared with the parent
|
|
|
8fe6e1 |
+ // parser and the only guard that keeps XML_ParserFree from destroying
|
|
|
8fe6e1 |
+ // parser->m_dtd is parser->m_isParamEntity but it will be set to
|
|
|
8fe6e1 |
+ // XML_TRUE only later in XML_ExternalEntityParserCreate (or not at all).
|
|
|
8fe6e1 |
+ parser->m_dtd = NULL;
|
|
|
8fe6e1 |
+ }
|
|
|
8fe6e1 |
XML_ParserFree(parser);
|
|
|
8fe6e1 |
return NULL;
|
|
|
8fe6e1 |
}
|
|
|
8fe6e1 |
diff --git a/tests/runtests.c b/tests/runtests.c
|
|
|
8fe6e1 |
index f3ebbd7..f58f794 100644
|
|
|
8fe6e1 |
--- a/tests/runtests.c
|
|
|
8fe6e1 |
+++ b/tests/runtests.c
|
|
|
8fe6e1 |
@@ -10819,6 +10819,48 @@ START_TEST(test_alloc_long_notation)
|
|
|
8fe6e1 |
}
|
|
|
8fe6e1 |
END_TEST
|
|
|
8fe6e1 |
|
|
|
8fe6e1 |
+static int XMLCALL
|
|
|
8fe6e1 |
+external_entity_parser_create_alloc_fail_handler(XML_Parser parser,
|
|
|
8fe6e1 |
+ const XML_Char *context,
|
|
|
8fe6e1 |
+ const XML_Char *UNUSED_P(base),
|
|
|
8fe6e1 |
+ const XML_Char *UNUSED_P(systemId),
|
|
|
8fe6e1 |
+ const XML_Char *UNUSED_P(publicId)) {
|
|
|
8fe6e1 |
+ if (context != NULL)
|
|
|
8fe6e1 |
+ fail("Unexpected non-NULL context");
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+ // The following number intends to fail the upcoming allocation in line
|
|
|
8fe6e1 |
+ // "parser->m_protocolEncodingName = copyString(encodingName,
|
|
|
8fe6e1 |
+ // &(parser->m_mem));" in function parserInit.
|
|
|
8fe6e1 |
+ allocation_count = 3;
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+ const XML_Char *const encodingName = XCS("UTF-8"); // needs something non-NULL
|
|
|
8fe6e1 |
+ const XML_Parser ext_parser
|
|
|
8fe6e1 |
+ = XML_ExternalEntityParserCreate(parser, context, encodingName);
|
|
|
8fe6e1 |
+ if (ext_parser != NULL)
|
|
|
8fe6e1 |
+ fail(
|
|
|
8fe6e1 |
+ "Call to XML_ExternalEntityParserCreate was expected to fail out-of-memory");
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+ allocation_count = ALLOC_ALWAYS_SUCCEED;
|
|
|
8fe6e1 |
+ return XML_STATUS_ERROR;
|
|
|
8fe6e1 |
+}
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+START_TEST(test_alloc_reset_after_external_entity_parser_create_fail) {
|
|
|
8fe6e1 |
+ const char *const text = "<doc/>";
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+ XML_SetExternalEntityRefHandler(
|
|
|
8fe6e1 |
+ parser, external_entity_parser_create_alloc_fail_handler);
|
|
|
8fe6e1 |
+ XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS);
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+ if (XML_Parse(parser, text, (int)strlen(text), XML_TRUE)
|
|
|
8fe6e1 |
+ != XML_STATUS_ERROR)
|
|
|
8fe6e1 |
+ fail("Call to parse was expected to fail");
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+ if (XML_GetErrorCode(parser) != XML_ERROR_EXTERNAL_ENTITY_HANDLING)
|
|
|
8fe6e1 |
+ fail("Call to parse was expected to fail from the external entity handler");
|
|
|
8fe6e1 |
+
|
|
|
8fe6e1 |
+ XML_ParserReset(parser, NULL);
|
|
|
8fe6e1 |
+}
|
|
|
8fe6e1 |
+END_TEST
|
|
|
8fe6e1 |
|
|
|
8fe6e1 |
static void
|
|
|
8fe6e1 |
nsalloc_setup(void)
|
|
|
8fe6e1 |
@@ -12653,6 +12695,10 @@ make_suite(void)
|
|
|
8fe6e1 |
tcase_add_test(tc_alloc, test_alloc_long_entity_value);
|
|
|
8fe6e1 |
tcase_add_test(tc_alloc, test_alloc_long_notation);
|
|
|
8fe6e1 |
|
|
|
8fe6e1 |
+ #ifdef XML_DTD
|
|
|
8fe6e1 |
+ tcase_add_test(tc_alloc,
|
|
|
8fe6e1 |
+ test_alloc_reset_after_external_entity_parser_create_fail);
|
|
|
8fe6e1 |
+ #endif
|
|
|
8fe6e1 |
suite_add_tcase(s, tc_nsalloc);
|
|
|
8fe6e1 |
tcase_add_checked_fixture(tc_nsalloc, nsalloc_setup, nsalloc_teardown);
|
|
|
8fe6e1 |
tcase_add_test(tc_nsalloc, test_nsalloc_xmlns);
|