33 lines
1.1 KiB
Diff
33 lines
1.1 KiB
Diff
From 06d354807ac297374973631a6418edf7e3fcbf30 Mon Sep 17 00:00:00 2001
|
|
From: Rob Crittenden <rcritten@redhat.com>
|
|
Date: Mon, 28 Feb 2022 10:43:23 -0500
|
|
Subject: [PATCH 6/6] Prevent integer overflow on m_groupSize in doProlog
|
|
(CVE-2021-46143)
|
|
|
|
Backported from upstream https://github.com/libexpat/libexpat/pull/538
|
|
|
|
Resolves: #2058560
|
|
---
|
|
lib/expat/xmlparse/xmlparse.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/lib/expat/xmlparse/xmlparse.c b/lib/expat/xmlparse/xmlparse.c
|
|
index 16ab82a..b9aa927 100644
|
|
--- a/lib/expat/xmlparse/xmlparse.c
|
|
+++ b/lib/expat/xmlparse/xmlparse.c
|
|
@@ -3991,6 +3991,11 @@ doProlog(XML_Parser const xmlParserP,
|
|
case XML_ROLE_GROUP_OPEN:
|
|
if (prologState.level >= groupSize) {
|
|
if (groupSize) {
|
|
+ /* Detect and prevent integer overflow */
|
|
+ if (groupSize > (unsigned int)(-1) / 2u) {
|
|
+ *errorCodeP = XML_ERROR_NO_MEMORY;
|
|
+ return;
|
|
+ }
|
|
char *temp = realloc(groupConnector, groupSize *= 2);
|
|
if (!temp) {
|
|
*errorCodeP = XML_ERROR_NO_MEMORY;
|
|
--
|
|
2.31.1
|
|
|