107 lines
3.2 KiB
Diff
107 lines
3.2 KiB
Diff
|
From 66e6f8700959f7a54056ed7946c179d808e838e8 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Rob Crittenden <rcritten@redhat.com>
|
||
|
|
Date: Thu, 25 Apr 2024 09:26:04 -0400
|
||
|
|
Subject: [PATCH] Address segfault found in CVE-2023-52425
|
||
|
|
|
||
|
|
The CVE addresses a possible DoS when unreasonably large tokens
|
||
|
|
are passed into the XML parser for processing. These were taking
|
||
|
|
upwards of 8 seconds per file processed with the exception of
|
||
|
|
aaaaaa_cdata.xml which caused a segmentation fault. The XML
|
||
|
|
processor was effectively losing the start of the string, setting
|
||
|
|
it to NULL. This caused a cascade of errors trying to parse both
|
||
|
|
the next token and in handling errors if a new token was not found.
|
||
|
|
|
||
|
|
This handles both those cases but not the underlying reason why
|
||
|
|
the pointer to inputStart is lost.
|
||
|
|
|
||
|
|
Trying to backport the libexpat changes to address the performance
|
||
|
|
issue would be enormous since the xmlrpc-c custom version of libexpat
|
||
|
|
is extremely old. Since xmlrpc-c is mostly used as a client passing
|
||
|
|
in random values is less of an issue.
|
||
|
|
|
||
|
|
Include the libexpat upstream benchmark test to validate that the
|
||
|
|
tests pass, albeit slowly.
|
||
|
|
|
||
|
|
To run the benchmarks:
|
||
|
|
extract the sources
|
||
|
|
cd xmlrpc-c-1.51.0
|
||
|
|
make
|
||
|
|
cd test
|
||
|
|
make
|
||
|
|
cd benchmark
|
||
|
|
for file in *.xml; do ./benchmark $file 4096 1; done
|
||
|
|
|
||
|
|
One test will error out but this is expected as part of the fix.
|
||
|
|
|
||
|
|
The tests will be extracted as a Source because of their
|
||
|
|
uncompressed size (~48M)
|
||
|
|
|
||
|
|
Fixes: RHEL-24226
|
||
|
|
---
|
||
|
|
lib/expat/xmlparse/xmlparse.c | 3 +++
|
||
|
|
lib/expat/xmltok/xmltok_impl.c | 4 ++++
|
||
|
|
test/Makefile | 7 +++++--
|
||
|
|
3 files changed, 12 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/lib/expat/xmlparse/xmlparse.c b/lib/expat/xmlparse/xmlparse.c
|
||
|
|
index 16ab82a..6621d18 100644
|
||
|
|
--- a/lib/expat/xmlparse/xmlparse.c
|
||
|
|
+++ b/lib/expat/xmlparse/xmlparse.c
|
||
|
|
@@ -35,6 +35,9 @@ extractXmlSample(const char * const start,
|
||
|
|
size_t const maximumLen) {
|
||
|
|
|
||
|
|
size_t const len = MIN(maximumLen, (size_t)(end - start));
|
||
|
|
+ if (start == NULL) {
|
||
|
|
+ return strdup("");
|
||
|
|
+ }
|
||
|
|
|
||
|
|
return xmlrpc_makePrintable_lp(start, len);
|
||
|
|
}
|
||
|
|
diff --git a/lib/expat/xmltok/xmltok_impl.c b/lib/expat/xmltok/xmltok_impl.c
|
||
|
|
index bae79b9..80da94f 100644
|
||
|
|
--- a/lib/expat/xmltok/xmltok_impl.c
|
||
|
|
+++ b/lib/expat/xmltok/xmltok_impl.c
|
||
|
|
@@ -871,6 +871,10 @@ PREFIX(contentTok)(const ENCODING * const enc,
|
||
|
|
*/
|
||
|
|
PREFIX(chopToWholeCharacters)(inputStart, inputEnd, &end);
|
||
|
|
|
||
|
|
+ if (inputStart == NULL) {
|
||
|
|
+ *nextTokPtr = NULL;
|
||
|
|
+ return XML_TOK_INVALID;
|
||
|
|
+ }
|
||
|
|
if (end == inputStart) {
|
||
|
|
*nextTokPtr = inputStart;
|
||
|
|
return XML_TOK_PARTIAL;
|
||
|
|
diff --git a/test/Makefile b/test/Makefile
|
||
|
|
index 4fce824..1242910 100644
|
||
|
|
--- a/test/Makefile
|
||
|
|
+++ b/test/Makefile
|
||
|
|
@@ -7,7 +7,7 @@ SUBDIR := test
|
||
|
|
|
||
|
|
include $(BLDDIR)/config.mk
|
||
|
|
|
||
|
|
-SUBDIRS = cpp
|
||
|
|
+SUBDIRS = cpp benchmark
|
||
|
|
|
||
|
|
XMLRPC_C_CONFIG = $(BLDDIR)/xmlrpc-c-config.test
|
||
|
|
|
||
|
|
@@ -98,11 +98,14 @@ runtests_local: test cgitest1
|
||
|
|
./test
|
||
|
|
|
||
|
|
.PHONY: runtests
|
||
|
|
-runtests: runtests_local cpp/runtests
|
||
|
|
+runtests: runtests_local cpp/runtests benchmark/runtests
|
||
|
|
|
||
|
|
cpp/runtests: FORCE
|
||
|
|
$(MAKE) -C $(dir $@) $(notdir $@)
|
||
|
|
|
||
|
|
+benchmark/runtests:
|
||
|
|
+ $(MAKE) -C $(dir $@) $(notdir $@)
|
||
|
|
+
|
||
|
|
.PHONY: install
|
||
|
|
install:
|
||
|
|
|
||
|
|
--
|
||
|
|
2.42.0
|
||
|
|
|