From 003f386af992eca5ec35a4d2d6897622cd8b9f44 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 10 May 2022 04:10:18 +0000 Subject: [PATCH] import expat-2.2.5-9.el8 --- ...event-integer-overflow-in-copyString.patch | 19 ++ ...vent-stack-exhaustion-in-build_model.patch | 228 ++++++++++++++++++ SPECS/expat.spec | 11 +- 3 files changed, 257 insertions(+), 1 deletion(-) create mode 100644 SOURCES/expat-2.2.5-Prevent-integer-overflow-in-copyString.patch create mode 100644 SOURCES/expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch diff --git a/SOURCES/expat-2.2.5-Prevent-integer-overflow-in-copyString.patch b/SOURCES/expat-2.2.5-Prevent-integer-overflow-in-copyString.patch new file mode 100644 index 0000000..f67a898 --- /dev/null +++ b/SOURCES/expat-2.2.5-Prevent-integer-overflow-in-copyString.patch @@ -0,0 +1,19 @@ +commit e5b609876e5a266725fba1c377b0ac95c737e6ed +Author: Tomas Korbar +Date: Mon May 2 12:44:06 2022 +0200 + + Fix CVE-2022-25314 + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 1f1413f..ceeec26 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -7525,7 +7525,7 @@ static XML_Char * + copyString(const XML_Char *s, + const XML_Memory_Handling_Suite *memsuite) + { +- int charsRequired = 0; ++ size_t charsRequired = 0; + XML_Char *result; + + /* First determine how long the string is */ diff --git a/SOURCES/expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch b/SOURCES/expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch new file mode 100644 index 0000000..52af442 --- /dev/null +++ b/SOURCES/expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch @@ -0,0 +1,228 @@ +commit f1b61e6fbaedbb2bbea736269a015d97d4df46ce +Author: Tomas Korbar +Date: Tue May 3 13:42:54 2022 +0200 + + Fix CVE-2022-25313 + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index ceeec26..d47e42c 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -7458,12 +7458,14 @@ build_node(XML_Parser parser, + } + + static XML_Content * +-build_model (XML_Parser parser) +-{ +- DTD * const dtd = parser->m_dtd; /* save one level of indirection */ ++build_model(XML_Parser parser) { ++ /* Function build_model transforms the existing parser->m_dtd->scaffold ++ * array of CONTENT_SCAFFOLD tree nodes into a new array of ++ * XML_Content tree nodes followed by a gapless list of zero-terminated ++ * strings. */ ++ DTD *const dtd = parser->m_dtd; /* save one level of indirection */ + XML_Content *ret; +- XML_Content *cpos; +- XML_Char * str; ++ XML_Char *str; /* the current string writing location */ + + /* Detect and prevent integer overflow. + * The preprocessor guard addresses the "always false" warning +@@ -7486,13 +7488,99 @@ build_model (XML_Parser parser) + + (dtd->contentStringLen * sizeof(XML_Char))); + + ret = (XML_Content *)MALLOC(parser, allocsize); +- if (!ret) ++ if (! ret) + return NULL; + +- str = (XML_Char *) (&ret[dtd->scaffCount]); +- cpos = &ret[1]; ++ /* What follows is an iterative implementation (of what was previously done ++ * recursively in a dedicated function called "build_node". The old recursive ++ * build_node could be forced into stack exhaustion from input as small as a ++ * few megabyte, and so that was a security issue. Hence, a function call ++ * stack is avoided now by resolving recursion.) ++ * ++ * The iterative approach works as follows: ++ * ++ * - We have two writing pointers, both walking up the result array; one does ++ * the work, the other creates "jobs" for its colleague to do, and leads ++ * the way: ++ * ++ * - The faster one, pointer jobDest, always leads and writes "what job ++ * to do" by the other, once they reach that place in the ++ * array: leader "jobDest" stores the source node array index (relative ++ * to array dtd->scaffold) in field "numchildren". ++ * ++ * - The slower one, pointer dest, looks at the value stored in the ++ * "numchildren" field (which actually holds a source node array index ++ * at that time) and puts the real data from dtd->scaffold in. ++ * ++ * - Before the loop starts, jobDest writes source array index 0 ++ * (where the root node is located) so that dest will have something to do ++ * when it starts operation. ++ * ++ * - Whenever nodes with children are encountered, jobDest appends ++ * them as new jobs, in order. As a result, tree node siblings are ++ * adjacent in the resulting array, for example: ++ * ++ * [0] root, has two children ++ * [1] first child of 0, has three children ++ * [3] first child of 1, does not have children ++ * [4] second child of 1, does not have children ++ * [5] third child of 1, does not have children ++ * [2] second child of 0, does not have children ++ * ++ * Or (the same data) presented in flat array view: ++ * ++ * [0] root, has two children ++ * ++ * [1] first child of 0, has three children ++ * [2] second child of 0, does not have children ++ * ++ * [3] first child of 1, does not have children ++ * [4] second child of 1, does not have children ++ * [5] third child of 1, does not have children ++ * ++ * - The algorithm repeats until all target array indices have been processed. ++ */ ++ XML_Content *dest = ret; /* tree node writing location, moves upwards */ ++ XML_Content *const destLimit = &ret[dtd->scaffCount]; ++ XML_Content *jobDest = ret; /* next free writing location in target array */ ++ str = (XML_Char *)&ret[dtd->scaffCount]; ++ ++ /* Add the starting job, the root node (index 0) of the source tree */ ++ (jobDest++)->numchildren = 0; ++ ++ for (; dest < destLimit; dest++) { ++ /* Retrieve source tree array index from job storage */ ++ const int src_node = (int)dest->numchildren; ++ ++ /* Convert item */ ++ dest->type = dtd->scaffold[src_node].type; ++ dest->quant = dtd->scaffold[src_node].quant; ++ if (dest->type == XML_CTYPE_NAME) { ++ const XML_Char *src; ++ dest->name = str; ++ src = dtd->scaffold[src_node].name; ++ for (;;) { ++ *str++ = *src; ++ if (! *src) ++ break; ++ src++; ++ } ++ dest->numchildren = 0; ++ dest->children = NULL; ++ } else { ++ unsigned int i; ++ int cn; ++ dest->name = NULL; ++ dest->numchildren = dtd->scaffold[src_node].childcnt; ++ dest->children = jobDest; ++ ++ /* Append scaffold indices of children to array */ ++ for (i = 0, cn = dtd->scaffold[src_node].firstchild; ++ i < dest->numchildren; i++, cn = dtd->scaffold[cn].nextsib) ++ (jobDest++)->numchildren = (unsigned int)cn; ++ } ++ } + +- build_node(parser, 0, ret, &cpos, &str); + return ret; + } + +diff --git a/tests/runtests.c b/tests/runtests.c +index eacd163..569ad8c 100644 +--- a/tests/runtests.c ++++ b/tests/runtests.c +@@ -2848,6 +2848,81 @@ START_TEST(test_dtd_elements) + } + END_TEST + ++static void XMLCALL ++element_decl_check_model(void *UNUSED_P(userData), const XML_Char *name, ++ XML_Content *model) { ++ uint32_t errorFlags = 0; ++ ++ /* Expected model array structure is this: ++ * [0] (type 6, quant 0) ++ * [1] (type 5, quant 0) ++ * [3] (type 4, quant 0, name "bar") ++ * [4] (type 4, quant 0, name "foo") ++ * [5] (type 4, quant 3, name "xyz") ++ * [2] (type 4, quant 2, name "zebra") ++ */ ++ errorFlags |= ((xcstrcmp(name, XCS("junk")) == 0) ? 0 : (1u << 0)); ++ errorFlags |= ((model != NULL) ? 0 : (1u << 1)); ++ ++ errorFlags |= ((model[0].type == XML_CTYPE_SEQ) ? 0 : (1u << 2)); ++ errorFlags |= ((model[0].quant == XML_CQUANT_NONE) ? 0 : (1u << 3)); ++ errorFlags |= ((model[0].numchildren == 2) ? 0 : (1u << 4)); ++ errorFlags |= ((model[0].children == &model[1]) ? 0 : (1u << 5)); ++ errorFlags |= ((model[0].name == NULL) ? 0 : (1u << 6)); ++ ++ errorFlags |= ((model[1].type == XML_CTYPE_CHOICE) ? 0 : (1u << 7)); ++ errorFlags |= ((model[1].quant == XML_CQUANT_NONE) ? 0 : (1u << 8)); ++ errorFlags |= ((model[1].numchildren == 3) ? 0 : (1u << 9)); ++ errorFlags |= ((model[1].children == &model[3]) ? 0 : (1u << 10)); ++ errorFlags |= ((model[1].name == NULL) ? 0 : (1u << 11)); ++ ++ errorFlags |= ((model[2].type == XML_CTYPE_NAME) ? 0 : (1u << 12)); ++ errorFlags |= ((model[2].quant == XML_CQUANT_REP) ? 0 : (1u << 13)); ++ errorFlags |= ((model[2].numchildren == 0) ? 0 : (1u << 14)); ++ errorFlags |= ((model[2].children == NULL) ? 0 : (1u << 15)); ++ errorFlags |= ((xcstrcmp(model[2].name, XCS("zebra")) == 0) ? 0 : (1u << 16)); ++ ++ errorFlags |= ((model[3].type == XML_CTYPE_NAME) ? 0 : (1u << 17)); ++ errorFlags |= ((model[3].quant == XML_CQUANT_NONE) ? 0 : (1u << 18)); ++ errorFlags |= ((model[3].numchildren == 0) ? 0 : (1u << 19)); ++ errorFlags |= ((model[3].children == NULL) ? 0 : (1u << 20)); ++ errorFlags |= ((xcstrcmp(model[3].name, XCS("bar")) == 0) ? 0 : (1u << 21)); ++ ++ errorFlags |= ((model[4].type == XML_CTYPE_NAME) ? 0 : (1u << 22)); ++ errorFlags |= ((model[4].quant == XML_CQUANT_NONE) ? 0 : (1u << 23)); ++ errorFlags |= ((model[4].numchildren == 0) ? 0 : (1u << 24)); ++ errorFlags |= ((model[4].children == NULL) ? 0 : (1u << 25)); ++ errorFlags |= ((xcstrcmp(model[4].name, XCS("foo")) == 0) ? 0 : (1u << 26)); ++ ++ errorFlags |= ((model[5].type == XML_CTYPE_NAME) ? 0 : (1u << 27)); ++ errorFlags |= ((model[5].quant == XML_CQUANT_PLUS) ? 0 : (1u << 28)); ++ errorFlags |= ((model[5].numchildren == 0) ? 0 : (1u << 29)); ++ errorFlags |= ((model[5].children == NULL) ? 0 : (1u << 30)); ++ errorFlags |= ((xcstrcmp(model[5].name, XCS("xyz")) == 0) ? 0 : (1u << 31)); ++ ++ XML_SetUserData(parser, (void *)(uintptr_t)errorFlags); ++ XML_FreeContentModel(parser, model); ++} ++ ++START_TEST(test_dtd_elements_nesting) { ++ // Payload inspired by a test in Perl's XML::Parser ++ const char *text = "\n" ++ "]>\n" ++ ""; ++ ++ XML_SetUserData(parser, (void *)(uintptr_t)-1); ++ ++ XML_SetElementDeclHandler(parser, element_decl_check_model); ++ if (XML_Parse(parser, text, (int)strlen(text), XML_TRUE) ++ == XML_STATUS_ERROR) ++ xml_failure(parser); ++ ++ if ((uint32_t)(uintptr_t)XML_GetUserData(parser) != 0) ++ fail("Element declaration model regression detected"); ++} ++END_TEST ++ + /* Test foreign DTD handling */ + START_TEST(test_set_foreign_dtd) + { +@@ -12256,6 +12331,7 @@ make_suite(void) + tcase_add_test(tc_basic, test_memory_allocation); + tcase_add_test(tc_basic, test_default_current); + tcase_add_test(tc_basic, test_dtd_elements); ++ tcase_add_test(tc_basic, test_dtd_elements_nesting); + tcase_add_test(tc_basic, test_set_foreign_dtd); + tcase_add_test(tc_basic, test_foreign_dtd_not_standalone); + tcase_add_test(tc_basic, test_invalid_foreign_dtd); diff --git a/SPECS/expat.spec b/SPECS/expat.spec index 6fc6f49..a0c8a18 100644 --- a/SPECS/expat.spec +++ b/SPECS/expat.spec @@ -3,7 +3,7 @@ Summary: An XML parser library Name: expat Version: %(echo %{unversion} | sed 's/_/./g') -Release: 8%{?dist} +Release: 9%{?dist} Source: https://github.com/libexpat/libexpat/archive/R_%{unversion}.tar.gz#/expat-%{version}.tar.gz URL: https://libexpat.github.io/ License: MIT @@ -18,6 +18,8 @@ Patch6: expat-2.2.5-Prevent-more-integer-overflows.patch Patch7: expat-2.2.5-Protect-against-malicious-namespace-declarations.patch Patch8: expat-2.2.5-Add-missing-validation-of-encoding.patch Patch9: expat-2.2.5-Prevent-integer-overflow-in-storeRawNames.patch +Patch10: expat-2.2.5-Prevent-integer-overflow-in-copyString.patch +Patch11: expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch %description This is expat, the C library for parsing XML, written by James Clark. Expat @@ -55,6 +57,8 @@ Install it if you need to link statically with expat. %patch7 -p1 -b .CVE-2022-25236 %patch8 -p1 -b .CVE-2022-25235 %patch9 -p1 -b .CVE-2022-25315 +%patch10 -p1 -b .CVE-2022-25314 +%patch11 -p1 -b .CVE-2022-25313 sed -i 's/install-data-hook/do-nothing-please/' lib/Makefile.am ./buildconf.sh @@ -93,6 +97,11 @@ make check %{_libdir}/lib*.a %changelog +* Fri May 06 2022 Tomas Korbar - 2.2.5-9 +- Fix multiple CVEs +- Resolves: CVE-2022-25314 +- Resolves: CVE-2022-25313 + * Mon Mar 14 2022 Tomas Korbar - 2.2.5-8 - Improve patch for CVE-2022-25236 - Related: CVE-2022-25236