import expat-2.2.5-9.el8

SOURCES/expat-2.2.5-Prevent-integer-overflow-in-copyString.patch

@@ -0,0 +1,19 @@
+commit e5b609876e5a266725fba1c377b0ac95c737e6ed
+Author: Tomas Korbar <tkorbar@redhat.com>
+Date:   Mon May 2 12:44:06 2022 +0200
+
+    Fix CVE-2022-25314
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 1f1413f..ceeec26 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7525,7 +7525,7 @@ static XML_Char *
+ copyString(const XML_Char *s,
+            const XML_Memory_Handling_Suite *memsuite)
+ {
+-    int charsRequired = 0;
++    size_t charsRequired = 0;
+     XML_Char *result;
+ 
+     /* First determine how long the string is */

SOURCES/expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch

@@ -0,0 +1,228 @@
+commit f1b61e6fbaedbb2bbea736269a015d97d4df46ce
+Author: Tomas Korbar <tkorbar@redhat.com>
+Date:   Tue May 3 13:42:54 2022 +0200
+
+    Fix CVE-2022-25313
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ceeec26..d47e42c 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7458,12 +7458,14 @@ build_node(XML_Parser parser,
+ }
+ 
+ static XML_Content *
+-build_model (XML_Parser parser)
+-{
+-  DTD * const dtd = parser->m_dtd;  /* save one level of indirection */
++build_model(XML_Parser parser) {
++  /* Function build_model transforms the existing parser->m_dtd->scaffold
++   * array of CONTENT_SCAFFOLD tree nodes into a new array of
++   * XML_Content tree nodes followed by a gapless list of zero-terminated
++   * strings. */
++  DTD *const dtd = parser->m_dtd; /* save one level of indirection */
+   XML_Content *ret;
+-  XML_Content *cpos;
+-  XML_Char * str;
++  XML_Char *str; /* the current string writing location */
+ 
+   /* Detect and prevent integer overflow.
+    * The preprocessor guard addresses the "always false" warning
+@@ -7486,13 +7488,99 @@ build_model (XML_Parser parser)
+                             + (dtd->contentStringLen * sizeof(XML_Char)));
+ 
+   ret = (XML_Content *)MALLOC(parser, allocsize);
+-  if (!ret)
++  if (! ret)
+     return NULL;
+ 
+-  str =  (XML_Char *) (&ret[dtd->scaffCount]);
+-  cpos = &ret[1];
++  /* What follows is an iterative implementation (of what was previously done
++   * recursively in a dedicated function called "build_node".  The old recursive
++   * build_node could be forced into stack exhaustion from input as small as a
++   * few megabyte, and so that was a security issue.  Hence, a function call
++   * stack is avoided now by resolving recursion.)
++   *
++   * The iterative approach works as follows:
++   *
++   * - We have two writing pointers, both walking up the result array; one does
++   *   the work, the other creates "jobs" for its colleague to do, and leads
++   *   the way:
++   *
++   *   - The faster one, pointer jobDest, always leads and writes "what job
++   *     to do" by the other, once they reach that place in the
++   *     array: leader "jobDest" stores the source node array index (relative
++   *     to array dtd->scaffold) in field "numchildren".
++   *
++   *   - The slower one, pointer dest, looks at the value stored in the
++   *     "numchildren" field (which actually holds a source node array index
++   *     at that time) and puts the real data from dtd->scaffold in.
++   *
++   * - Before the loop starts, jobDest writes source array index 0
++   *   (where the root node is located) so that dest will have something to do
++   *   when it starts operation.
++   *
++   * - Whenever nodes with children are encountered, jobDest appends
++   *   them as new jobs, in order.  As a result, tree node siblings are
++   *   adjacent in the resulting array, for example:
++   *
++   *     [0] root, has two children
++   *       [1] first child of 0, has three children
++   *         [3] first child of 1, does not have children
++   *         [4] second child of 1, does not have children
++   *         [5] third child of 1, does not have children
++   *       [2] second child of 0, does not have children
++   *
++   *   Or (the same data) presented in flat array view:
++   *
++   *     [0] root, has two children
++   *
++   *     [1] first child of 0, has three children
++   *     [2] second child of 0, does not have children
++   *
++   *     [3] first child of 1, does not have children
++   *     [4] second child of 1, does not have children
++   *     [5] third child of 1, does not have children
++   *
++   * - The algorithm repeats until all target array indices have been processed.
++   */
++  XML_Content *dest = ret; /* tree node writing location, moves upwards */
++  XML_Content *const destLimit = &ret[dtd->scaffCount];
++  XML_Content *jobDest = ret; /* next free writing location in target array */
++  str = (XML_Char *)&ret[dtd->scaffCount];
++
++  /* Add the starting job, the root node (index 0) of the source tree  */
++  (jobDest++)->numchildren = 0;
++
++  for (; dest < destLimit; dest++) {
++    /* Retrieve source tree array index from job storage */
++    const int src_node = (int)dest->numchildren;
++
++    /* Convert item */
++    dest->type = dtd->scaffold[src_node].type;
++    dest->quant = dtd->scaffold[src_node].quant;
++    if (dest->type == XML_CTYPE_NAME) {
++      const XML_Char *src;
++      dest->name = str;
++      src = dtd->scaffold[src_node].name;
++      for (;;) {
++        *str++ = *src;
++        if (! *src)
++          break;
++        src++;
++      }
++      dest->numchildren = 0;
++      dest->children = NULL;
++    } else {
++      unsigned int i;
++      int cn;
++      dest->name = NULL;
++      dest->numchildren = dtd->scaffold[src_node].childcnt;
++      dest->children = jobDest;
++
++      /* Append scaffold indices of children to array */
++      for (i = 0, cn = dtd->scaffold[src_node].firstchild;
++           i < dest->numchildren; i++, cn = dtd->scaffold[cn].nextsib)
++        (jobDest++)->numchildren = (unsigned int)cn;
++    }
++  }
+ 
+-  build_node(parser, 0, ret, &cpos, &str);
+   return ret;
+ }
+ 
+diff --git a/tests/runtests.c b/tests/runtests.c
+index eacd163..569ad8c 100644
+--- a/tests/runtests.c
++++ b/tests/runtests.c
+@@ -2848,6 +2848,81 @@ START_TEST(test_dtd_elements)
+ }
+ END_TEST
+ 
++static void XMLCALL
++element_decl_check_model(void *UNUSED_P(userData), const XML_Char *name,
++                         XML_Content *model) {
++  uint32_t errorFlags = 0;
++
++  /* Expected model array structure is this:
++   * [0] (type 6, quant 0)
++   *   [1] (type 5, quant 0)
++   *     [3] (type 4, quant 0, name "bar")
++   *     [4] (type 4, quant 0, name "foo")
++   *     [5] (type 4, quant 3, name "xyz")
++   *   [2] (type 4, quant 2, name "zebra")
++   */
++  errorFlags |= ((xcstrcmp(name, XCS("junk")) == 0) ? 0 : (1u << 0));
++  errorFlags |= ((model != NULL) ? 0 : (1u << 1));
++
++  errorFlags |= ((model[0].type == XML_CTYPE_SEQ) ? 0 : (1u << 2));
++  errorFlags |= ((model[0].quant == XML_CQUANT_NONE) ? 0 : (1u << 3));
++  errorFlags |= ((model[0].numchildren == 2) ? 0 : (1u << 4));
++  errorFlags |= ((model[0].children == &model[1]) ? 0 : (1u << 5));
++  errorFlags |= ((model[0].name == NULL) ? 0 : (1u << 6));
++
++  errorFlags |= ((model[1].type == XML_CTYPE_CHOICE) ? 0 : (1u << 7));
++  errorFlags |= ((model[1].quant == XML_CQUANT_NONE) ? 0 : (1u << 8));
++  errorFlags |= ((model[1].numchildren == 3) ? 0 : (1u << 9));
++  errorFlags |= ((model[1].children == &model[3]) ? 0 : (1u << 10));
++  errorFlags |= ((model[1].name == NULL) ? 0 : (1u << 11));
++
++  errorFlags |= ((model[2].type == XML_CTYPE_NAME) ? 0 : (1u << 12));
++  errorFlags |= ((model[2].quant == XML_CQUANT_REP) ? 0 : (1u << 13));
++  errorFlags |= ((model[2].numchildren == 0) ? 0 : (1u << 14));
++  errorFlags |= ((model[2].children == NULL) ? 0 : (1u << 15));
++  errorFlags |= ((xcstrcmp(model[2].name, XCS("zebra")) == 0) ? 0 : (1u << 16));
++
++  errorFlags |= ((model[3].type == XML_CTYPE_NAME) ? 0 : (1u << 17));
++  errorFlags |= ((model[3].quant == XML_CQUANT_NONE) ? 0 : (1u << 18));
++  errorFlags |= ((model[3].numchildren == 0) ? 0 : (1u << 19));
++  errorFlags |= ((model[3].children == NULL) ? 0 : (1u << 20));
++  errorFlags |= ((xcstrcmp(model[3].name, XCS("bar")) == 0) ? 0 : (1u << 21));
++
++  errorFlags |= ((model[4].type == XML_CTYPE_NAME) ? 0 : (1u << 22));
++  errorFlags |= ((model[4].quant == XML_CQUANT_NONE) ? 0 : (1u << 23));
++  errorFlags |= ((model[4].numchildren == 0) ? 0 : (1u << 24));
++  errorFlags |= ((model[4].children == NULL) ? 0 : (1u << 25));
++  errorFlags |= ((xcstrcmp(model[4].name, XCS("foo")) == 0) ? 0 : (1u << 26));
++
++  errorFlags |= ((model[5].type == XML_CTYPE_NAME) ? 0 : (1u << 27));
++  errorFlags |= ((model[5].quant == XML_CQUANT_PLUS) ? 0 : (1u << 28));
++  errorFlags |= ((model[5].numchildren == 0) ? 0 : (1u << 29));
++  errorFlags |= ((model[5].children == NULL) ? 0 : (1u << 30));
++  errorFlags |= ((xcstrcmp(model[5].name, XCS("xyz")) == 0) ? 0 : (1u << 31));
++
++  XML_SetUserData(parser, (void *)(uintptr_t)errorFlags);
++  XML_FreeContentModel(parser, model);
++}
++
++START_TEST(test_dtd_elements_nesting) {
++  // Payload inspired by a test in Perl's XML::Parser
++  const char *text = "<!DOCTYPE foo [\n"
++                     "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>\n"
++                     "]>\n"
++                     "<foo/>";
++
++  XML_SetUserData(parser, (void *)(uintptr_t)-1);
++
++  XML_SetElementDeclHandler(parser, element_decl_check_model);
++  if (XML_Parse(parser, text, (int)strlen(text), XML_TRUE)
++      == XML_STATUS_ERROR)
++    xml_failure(parser);
++
++  if ((uint32_t)(uintptr_t)XML_GetUserData(parser) != 0)
++    fail("Element declaration model regression detected");
++}
++END_TEST
++
+ /* Test foreign DTD handling */
+ START_TEST(test_set_foreign_dtd)
+ {
+@@ -12256,6 +12331,7 @@ make_suite(void)
+     tcase_add_test(tc_basic, test_memory_allocation);
+     tcase_add_test(tc_basic, test_default_current);
+     tcase_add_test(tc_basic, test_dtd_elements);
++    tcase_add_test(tc_basic, test_dtd_elements_nesting);
+     tcase_add_test(tc_basic, test_set_foreign_dtd);
+     tcase_add_test(tc_basic, test_foreign_dtd_not_standalone);
+     tcase_add_test(tc_basic, test_invalid_foreign_dtd);

SPECS/expat.spec

@@ -3,7 +3,7 @@
 Summary: An XML parser library
 Name: expat
 Version: %(echo %{unversion} | sed 's/_/./g')
-Release: 8%{?dist}
+Release: 9%{?dist}
 Source: https://github.com/libexpat/libexpat/archive/R_%{unversion}.tar.gz#/expat-%{version}.tar.gz
 URL: https://libexpat.github.io/
 License: MIT
@@ -18,6 +18,8 @@ Patch6:	expat-2.2.5-Prevent-more-integer-overflows.patch
 Patch7: expat-2.2.5-Protect-against-malicious-namespace-declarations.patch
 Patch8: expat-2.2.5-Add-missing-validation-of-encoding.patch
 Patch9: expat-2.2.5-Prevent-integer-overflow-in-storeRawNames.patch
+Patch10: expat-2.2.5-Prevent-integer-overflow-in-copyString.patch
+Patch11: expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch
 
 %description
 This is expat, the C library for parsing XML, written by James Clark. Expat
@@ -55,6 +57,8 @@ Install it if you need to link statically with expat.
 %patch7 -p1 -b .CVE-2022-25236
 %patch8 -p1 -b .CVE-2022-25235
 %patch9 -p1 -b .CVE-2022-25315
+%patch10 -p1 -b .CVE-2022-25314
+%patch11 -p1 -b .CVE-2022-25313
 
 sed -i 's/install-data-hook/do-nothing-please/' lib/Makefile.am
 ./buildconf.sh
@@ -93,6 +97,11 @@ make check
 %{_libdir}/lib*.a
 
 %changelog
+* Fri May 06 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-9
+- Fix multiple CVEs
+- Resolves: CVE-2022-25314
+- Resolves: CVE-2022-25313
+
 * Mon Mar 14 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-8
 - Improve patch for CVE-2022-25236
 - Related: CVE-2022-25236