Skip to contentSkip to conversation

xerces: add upstream security fix

PATCH New Baruch Siach 2 participants 4 messages Mar 26, 2018 – Apr 11, 2018

lore
Share & tools
lore

Baruch Siach

author
#0 lore raw

PATCH 1/1 xerces: add upstream security fix

CVE-2017-12627: dereference of a NULL pointer while processing the path to the DTD.

xerces 3.2.1 includes this patch. But this version also added AC_RUN_IFELSE to its configure script, making cross compilation harder.

Switching to cmake is also problematic since the minimum required cmake version is 3.2.0. The host dependencies check currently allows minimum cmake version 3.1.

Signed-off-by Baruch Siach <[email protected]>
---
 package/xerces/0001-fix-CVE-2017-12627.patch | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 package/xerces/0001-fix-CVE-2017-12627.patch
package/xerces/0001-fix-CVE-2017-12627.patch new file +22 -0
new file mode 100644
index 000000000000..010be7e3d5ad
@@ -0,0 +1,22 @@
+XMLString: Don't call catString if relativePath is null
+
+https://xerces.apache.org/xerces-c/secadv/CVE-2017-12627.txt
+
+Upstream status: svn revision 1819998
+
+Signed-off-by: Baruch Siach <[email protected]>
+
+--- trunk/src/xercesc/util/PlatformUtils.cpp	2018/01/03 18:58:30	1819997
++++ trunk/src/xercesc/util/PlatformUtils.cpp	2018/01/03 18:59:30	1819998
+@@ -920,7 +920,10 @@
+ 
+     XMLString::subString(tmpBuf, basePath, 0, (basePtr - basePath + 1), manager);
+     tmpBuf[basePtr - basePath + 1] = 0;
+-    XMLString::catString(tmpBuf, relativePath);
++    if (relativePath)
++    {
++        XMLString::catString(tmpBuf, relativePath);
++    }
+ 
+     removeDotSlash(tmpBuf, manager);
+
Signature · 1 line
2.16.2
#1 lore raw

PATCH 1/1 xerces: add upstream security fix

Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

CVE-2017-12627: dereference of a NULL pointer while processing the path to the DTD.

Quoted 8 lines

xerces 3.2.1 includes this patch. But this version also added AC_RUN_IFELSE to its configure script, making cross compilation harder.

Switching to cmake is also problematic since the minimum required cmake version is 3.2.0. The host dependencies check currently allows minimum cmake version 3.1.

Signed-off-by Baruch Siach <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#2 lore raw

PATCH 1/1 xerces: add upstream security fix

In reply to Baruch Siach
Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

CVE-2017-12627: dereference of a NULL pointer while processing the path to the DTD.

Quoted 8 lines

xerces 3.2.1 includes this patch. But this version also added AC_RUN_IFELSE to its configure script, making cross compilation harder.

Switching to cmake is also problematic since the minimum required cmake version is 3.2.0. The host dependencies check currently allows minimum cmake version 3.1.

Signed-off-by Baruch Siach <[email protected]>

Committed to 2018.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#3 lore raw

PATCH 1/1 xerces: add upstream security fix

In reply to Baruch Siach
Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

CVE-2017-12627: dereference of a NULL pointer while processing the path to the DTD.

Quoted 8 lines

xerces 3.2.1 includes this patch. But this version also added AC_RUN_IFELSE to its configure script, making cross compilation harder.

Switching to cmake is also problematic since the minimum required cmake version is 3.2.0. The host dependencies check currently allows minimum cmake version 3.1.

Signed-off-by Baruch Siach <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard