237839f960
Backport upstream commit c2e233fc1b34 to fix CVE-2026-11979,
which adds overflow bounds checks in the usershell() function
of xmlcatalog.c. The patch prevents buffer overflows when
processing large --shell commands by adding capacity checks
for the command buffer, argument buffer, and argv array size.
The upstream test changes were dropped as the test
infrastructure (test/catalogs/test.sh) does not exist in the
v2.9.7 source tree.
CVE: CVE-2026-11979
Upstream patches:
- c2e233fc1b.patch
Resolves: RHEL-215569
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
52 lines
1.6 KiB
Diff
52 lines
1.6 KiB
Diff
From a28c059f727f0bac8d702d03015ee5c959bea159 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
|
|
Date: Fri, 22 May 2026 12:21:20 +0200
|
|
Subject: [PATCH] xmlcatalog: overflow check for large --shell commands
|
|
|
|
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
|
|
---
|
|
xmlcatalog.c | 16 ++++++++++++++++
|
|
1 file changed, 16 insertions(+)
|
|
|
|
diff --git a/xmlcatalog.c b/xmlcatalog.c
|
|
index c02b97f6..a1c9064e 100644
|
|
--- a/xmlcatalog.c
|
|
+++ b/xmlcatalog.c
|
|
@@ -118,6 +118,12 @@ static void usershell(void) {
|
|
(*cur != '\n') && (*cur != '\r')) {
|
|
if (*cur == 0)
|
|
break;
|
|
+ /* Do not read beyond the command array capacity */
|
|
+ if (i >= (int)sizeof(command) - 2) {
|
|
+ printf("Invalid command %s\n", cur);
|
|
+ i = 0;
|
|
+ break;
|
|
+ }
|
|
command[i++] = *cur++;
|
|
}
|
|
command[i] = 0;
|
|
@@ -135,6 +141,11 @@ static void usershell(void) {
|
|
while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
|
|
if (*cur == 0)
|
|
break;
|
|
+ if (i >= (int)sizeof(arg) - 2) {
|
|
+ printf("Invalid arg %s\n", arg);
|
|
+ i = 0;
|
|
+ break;
|
|
+ }
|
|
arg[i++] = *cur++;
|
|
}
|
|
arg[i] = 0;
|
|
@@ -147,6 +158,11 @@ static void usershell(void) {
|
|
cur = arg;
|
|
memset(argv, 0, sizeof(argv));
|
|
while (*cur != 0) {
|
|
+ if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
|
|
+ printf("Too much arguments\n");
|
|
+ break;
|
|
+ }
|
|
+
|
|
while ((*cur == ' ') || (*cur == '\t')) cur++;
|
|
if (*cur == '\'') {
|
|
cur++;
|