Fix libxml2 unsafe memory access
cover Fix libxml2 unsafe memory access
From: Kai Kang <[email protected]>
The patch is from:
https://bugzilla.gnome.org/show_bug.cgi?id=746048
Build image with packagegroup-core-buildessential, boot the image and compile following c code:
==================================================
#include "string.h"
#include <libxml/HTMLparser.h>
#include <libxml/HTMLtree.h>
int main(int argc, char** argv)
{
// Nokogiri::HTML::fragment("<!-- ")
htmlDocPtr doc ; int options = HTML_PARSE_RECOVER | HTML_PARSE_NOERROR | HTML_PARSE_NOWARNING | HTML_PARSE_NONET ; char* HTMLFRAG_GOOD = "<html><body><!-- x" ; char* HTMLFRAG_BAD = "<html><body><!--" ; char* HTMLFRAG = HTMLFRAG_BAD ; xmlInitParser();
doc = htmlReadMemory(HTMLFRAG, strlen(HTMLFRAG),
NULL,
"UTF-8",
options); xmlFreeDoc(doc);
}
==================================================
Run with valgrind, there is no warning.
The following changes since commit 8a0d8eee432924433c3e70198aaeab3161476c5f:
toaster manual: Updated the set up and use chapter (2015-10-27 07:28:22 +0000)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib kangkai/libxml2
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=kangkai/libxml2
Kai Kang (1):
libxml2: fix unsafe memory access
.../libxml2/libxml2-fix-unsafe-memory-access.patch | 97 ++++++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.9.2.bb | 3 +- 2 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch
Signature · 1 line
2.6.1
PATCH 1/1 libxml2: fix unsafe memory access
From: Kai Kang <[email protected]>
Backport patch from:
https://bugzilla.gnome.org/show_bug.cgi?id=746048
to fix valgrind errors and unsafe memory access.
Fix the indentation by the way.
--- .../libxml2/libxml2-fix-unsafe-memory-access.patch | 97 ++++++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.9.2.bb | 3 +- 2 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch
meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch new file +97 -0
@@ -0,0 +1,97 @@ +Upstream-Status: Backport + +Backport from + +https://bugzilla.gnome.org/show_bug.cgi?id=746048 + +to fix unsafe memory access. + +Signed-off-by: Kai Kang <[email protected]> +--- +diff --git a/HTMLparser.c b/HTMLparser.c +index d329d3b..6f81424 100644 +--- a/HTMLparser.c ++++ b/HTMLparser.c +@@ -3245,13 +3245,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { + ctxt->instate = state; + return; + } ++ if ((ctxt->input->end - ctxt->input->cur) < 3) { ++ ctxt->instate = XML_PARSER_EOF; ++ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, ++ "Comment not terminated\n", NULL, NULL); ++ xmlFree(buf); ++ return; ++ } + q = CUR_CHAR(ql); + NEXTL(ql); + r = CUR_CHAR(rl); + NEXTL(rl); + cur = CUR_CHAR(l); + len = 0; +- while (IS_CHAR(cur) && ++ while (((ctxt->input->end - ctxt->input->cur) > 0) && IS_CHAR(cur) && + ((cur != '>') || + (r != '-') || (q != '-'))) { + if (len + 5 >= size) { +@@ -3281,7 +3288,7 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { + } + } + buf[len] = 0; +- if (!IS_CHAR(cur)) { ++ if (!(ctxt->input->end - ctxt->input->cur) || !IS_CHAR(cur)) { + htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, + "Comment not terminated \n<!--%.50s\n", buf, NULL); + xmlFree(buf); +@@ -4465,6 +4472,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + depth = ctxt->nameNr; + while (1) { + long cons = ctxt->nbChars; ++ long rem = ctxt->input->end - ctxt->input->cur; + + GROW; + +@@ -4540,7 +4548,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * Sometimes DOCTYPE arrives in the middle of the document + */ +- if ((CUR == '<') && (NXT(1) == '!') && ++ if ((rem >= 9) && (CUR == '<') && (NXT(1) == '!') && + (UPP(2) == 'D') && (UPP(3) == 'O') && + (UPP(4) == 'C') && (UPP(5) == 'T') && + (UPP(6) == 'Y') && (UPP(7) == 'P') && +@@ -4554,7 +4562,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * First case : a comment + */ +- if ((CUR == '<') && (NXT(1) == '!') && ++ if ((rem >= 4) && (CUR == '<') && (NXT(1) == '!') && + (NXT(2) == '-') && (NXT(3) == '-')) { + htmlParseComment(ctxt); + } +@@ -4562,14 +4570,14 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * Second case : a Processing Instruction. + */ +- else if ((CUR == '<') && (NXT(1) == '?')) { ++ else if ((rem >= 2) && (CUR == '<') && (NXT(1) == '?')) { + htmlParsePI(ctxt); + } + + /* + * Third case : a sub-element. + */ +- else if (CUR == '<') { ++ else if ((rem >= 1) && (CUR == '<')) { + htmlParseElementInternal(ctxt); + if (currentNode != NULL) xmlFree(currentNode); + +@@ -4581,7 +4589,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + * Fourth case : a reference. If if has not been resolved, + * parsing returns it's Name, create the node + */ +- else if (CUR == '&') { ++ else if ((rem >= 1) && (CUR == '&')) { + htmlParseReference(ctxt); + } +
meta/recipes-core/libxml/libxml2_2.9.2.bb +2 -1
@@ -2,7 +2,8 @@ require libxml2.inc SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar \ file://72a46a519ce7326d9a00f0b6a7f2a8e958cd1675.patch \ - file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \ + file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \ + file://libxml2-fix-unsafe-memory-access.patch \ " SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788"
Signature · 1 line
2.6.1
Re: [PATCH 1/1] libxml2: fix unsafe memory access
Quoted 29 lines · On 28 October 2015 at 07:22, <[email protected]> wrote:
From: Kai Kang <[email protected]>
Backport patch from:
https://bugzilla.gnome.org/show_bug.cgi?id=746048
to fix valgrind errors and unsafe memory access.
Fix the indentation by the way.
Signed-off-by Kai Kang <[email protected]>--- .../libxml2/libxml2-fix-unsafe-memory-access.patch | 97 ++++++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.9.2.bb | 3 +- 2 files changed, 99 insertions(+), 1 deletion(-) create mode 100644
meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patchdiff --git
a/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patchb/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patchnew file mode 100644
index 0000000..b583032
---/dev/null
+++b/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch
meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch line 1
Quoted 1 line
meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch new file +1
-0@@ -0,0 +1,97 @@ +Upstream-Status: Backport
This may be a nitpick but I don't think DV has taken this patch in the six months it's been available so it's not a backport.
- Jussi
+
Quoted 122 lines
meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch new file +95
-0+Backport from + +https://bugzilla.gnome.org/show_bug.cgi?id=746048 + +to fix unsafe memory access. + +Signed-off-by: Kai Kang <[email protected]> +--- +diff --git a/HTMLparser.c b/HTMLparser.c +index d329d3b..6f81424 100644 +--- a/HTMLparser.c ++++ b/HTMLparser.c +@@ -3245,13 +3245,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { + ctxt->instate = state; + return; + } ++ if ((ctxt->input->end - ctxt->input->cur) < 3) { ++ ctxt->instate = XML_PARSER_EOF; ++ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, ++ "Comment not terminated\n", NULL, NULL); ++ xmlFree(buf); ++ return; ++ } + q = CUR_CHAR(ql); + NEXTL(ql); + r = CUR_CHAR(rl); + NEXTL(rl); + cur = CUR_CHAR(l); + len = 0; +- while (IS_CHAR(cur) && ++ while (((ctxt->input->end - ctxt->input->cur) > 0) && IS_CHAR(cur) && + ((cur != '>') || + (r != '-') || (q != '-'))) { + if (len + 5 >= size) { +@@ -3281,7 +3288,7 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { + } + } + buf[len] = 0; +- if (!IS_CHAR(cur)) { ++ if (!(ctxt->input->end - ctxt->input->cur) || !IS_CHAR(cur)) { + htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, + "Comment not terminated \n<!--%.50s\n", buf, NULL); + xmlFree(buf); +@@ -4465,6 +4472,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + depth = ctxt->nameNr; + while (1) { + long cons = ctxt->nbChars; ++ long rem = ctxt->input->end - ctxt->input->cur; + + GROW; + +@@ -4540,7 +4548,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * Sometimes DOCTYPE arrives in the middle of the document + */ +- if ((CUR == '<') && (NXT(1) == '!') && ++ if ((rem >= 9) && (CUR == '<') && (NXT(1) == '!') && + (UPP(2) == 'D') && (UPP(3) == 'O') && + (UPP(4) == 'C') && (UPP(5) == 'T') && + (UPP(6) == 'Y') && (UPP(7) == 'P') && +@@ -4554,7 +4562,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * First case : a comment + */ +- if ((CUR == '<') && (NXT(1) == '!') && ++ if ((rem >= 4) && (CUR == '<') && (NXT(1) == '!') && + (NXT(2) == '-') && (NXT(3) == '-')) { + htmlParseComment(ctxt); + } +@@ -4562,14 +4570,14 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * Second case : a Processing Instruction. + */ +- else if ((CUR == '<') && (NXT(1) == '?')) { ++ else if ((rem >= 2) && (CUR == '<') && (NXT(1) == '?')) { + htmlParsePI(ctxt); + } + + /* + * Third case : a sub-element. + */ +- else if (CUR == '<') { ++ else if ((rem >= 1) && (CUR == '<')) { + htmlParseElementInternal(ctxt); + if (currentNode != NULL) xmlFree(currentNode); + +@@ -4581,7 +4589,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + * Fourth case : a reference. If if has not been resolved, + * parsing returns it's Name, create the node + */ +- else if (CUR == '&') { ++ else if ((rem >= 1) && (CUR == '&')) { + htmlParseReference(ctxt); + } +meta/recipes-core/libxml/libxml2_2.9.2.bb +2
-1@@ -2,7 +2,8 @@ require libxml2.inc SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar \ file://72a46a519ce7326d9a00f0b6a7f2a8e958cd1675.patch \ - file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \ + file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \ + file://libxml2-fix-unsafe-memory-access.patch \"SRC_URI[libtar.md5sum] = "
9e6a9aca9d155737868b3dc5fd82f788"
--
2.6.1--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
Re: [PATCH 1/1] libxml2: fix unsafe memory access
Quoted 38 lines · Jussi Kukkonen
On 28 October 2015 at 07:22, <[email protected] <mailto:[email protected]>> wrote:
From: Kai Kang <[email protected] <mailto:[email protected]>> Backport patch from: https://bugzilla.gnome.org/show_bug.cgi?id=746048 to fix valgrind errors and unsafe memory access. Fix the indentation by the way. Signed-off-by: Kai Kang <[email protected] <mailto:[email protected]>> --- .../libxml2/libxml2-fix-unsafe-memory-access.patch | 97 ++++++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.9.2.bb <http://libxml2_2.9.2.bb> | 3 +- 2 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch diff --git a/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch b/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch new file mode 100644 index 0000000..b583032 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch @@ -0,0 +1,97 @@ +Upstream-Status: Backport
Quoted 1 line
This may be a nitpick but I don't think DV has taken this patch in the six months it's been available so it's not a backport.
I suppose Backport is the best choice in upstream status [ Pending Submitted Accepted Backport Denied Inappropriate ]. Though it is not from official upstream, it is from somewhere else as listed in the patch.
Thanks.
--Kai
Quoted 141 lines
- Jussi
+ +Backport from + +https://bugzilla.gnome.org/show_bug.cgi?id=746048 + +to fix unsafe memory access. + +Signed-off-by: Kai Kang <[email protected] <mailto:[email protected]>> +--- +diff --git a/HTMLparser.c b/HTMLparser.c +index d329d3b..6f81424 100644 +--- a/HTMLparser.c ++++ b/HTMLparser.c +@@ -3245,13 +3245,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { + ctxt->instate = state; + return; + } ++ if ((ctxt->input->end - ctxt->input->cur) < 3) { ++ ctxt->instate = XML_PARSER_EOF; ++ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, ++ "Comment not terminated\n", NULL, NULL); ++ xmlFree(buf); ++ return; ++ } + q = CUR_CHAR(ql); + NEXTL(ql); + r = CUR_CHAR(rl); + NEXTL(rl); + cur = CUR_CHAR(l); + len = 0; +- while (IS_CHAR(cur) && ++ while (((ctxt->input->end - ctxt->input->cur) > 0) && IS_CHAR(cur) && + ((cur != '>') || + (r != '-') || (q != '-'))) { + if (len + 5 >= size) { +@@ -3281,7 +3288,7 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { + } + } + buf[len] = 0; +- if (!IS_CHAR(cur)) { ++ if (!(ctxt->input->end - ctxt->input->cur) || !IS_CHAR(cur)) { + htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, + "Comment not terminated \n<!--%.50s\n", buf, NULL); + xmlFree(buf); +@@ -4465,6 +4472,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + depth = ctxt->nameNr; + while (1) { + long cons = ctxt->nbChars; ++ long rem = ctxt->input->end - ctxt->input->cur; + + GROW; + +@@ -4540,7 +4548,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * Sometimes DOCTYPE arrives in the middle of the document + */ +- if ((CUR == '<') && (NXT(1) == '!') && ++ if ((rem >= 9) && (CUR == '<') && (NXT(1) == '!') && + (UPP(2) == 'D') && (UPP(3) == 'O') && + (UPP(4) == 'C') && (UPP(5) == 'T') && + (UPP(6) == 'Y') && (UPP(7) == 'P') && +@@ -4554,7 +4562,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * First case : a comment + */ +- if ((CUR == '<') && (NXT(1) == '!') && ++ if ((rem >= 4) && (CUR == '<') && (NXT(1) == '!') && + (NXT(2) == '-') && (NXT(3) == '-')) { + htmlParseComment(ctxt); + } +@@ -4562,14 +4570,14 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + /* + * Second case : a Processing Instruction. + */ +- else if ((CUR == '<') && (NXT(1) == '?')) { ++ else if ((rem >= 2) && (CUR == '<') && (NXT(1) == '?')) { + htmlParsePI(ctxt); + } + + /* + * Third case : a sub-element. + */ +- else if (CUR == '<') { ++ else if ((rem >= 1) && (CUR == '<')) { + htmlParseElementInternal(ctxt); + if (currentNode != NULL) xmlFree(currentNode); + +@@ -4581,7 +4589,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) { + * Fourth case : a reference. If if has not been resolved, + * parsing returns it's Name, create the node + */ +- else if (CUR == '&') { ++ else if ((rem >= 1) && (CUR == '&')) { + htmlParseReference(ctxt); + } + diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb <http://libxml2_2.9.2.bb> b/meta/recipes-core/libxml/libxml2_2.9.2.bb <http://libxml2_2.9.2.bb> index 79a395c..4cafc87 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.2.bb <http://libxml2_2.9.2.bb> +++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb <http://libxml2_2.9.2.bb> @@ -2,7 +2,8 @@ require libxml2.inc SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar \ file://72a46a519ce7326d9a00f0b6a7f2a8e958cd1675.patch \ - file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \ + file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \ + file://libxml2-fix-unsafe-memory-access.patch \ " SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" -- 2.6.1 -- _______________________________________________ Openembedded-core mailing list [email protected] <mailto:[email protected]> http://lists.openembedded.org/mailman/listinfo/openembedded-core
Signature · 2 lines
Regards, Neil | Kai Kang
Re: [PATCH 1/1] libxml2: fix unsafe memory access
Quoted 6 lines · Kang Kai
Quoted 2 lines
This may be a nitpick but I don't think DV has taken this patch in the six months it's been available so it's not a backport.
I suppose Backport is the best choice in upstream status [ Pending Submitted Accepted Backport Denied Inappropriate ]. Though it is not from official upstream, it is from somewhere else as listed in the patch.
'Submitted [where]' is the right choice here, I think.
Alex
Re: [PATCH 1/1] libxml2: fix unsafe memory access
Quoted 7 lines · Alexander Kanavin
I suppose Backport is the best choice in upstream status [ Pending
Quoted 3 lines
Submitted Accepted Backport Denied Inappropriate ]. Though it is not from official upstream, it is from somewhere else as listed in the patch.
'Submitted [where]' is the right choice here, I think.
Yes, this is exactly what Submitted is for.
Ross
Re: [PATCH 1/1] libxml2: fix unsafe memory access
Quoted 10 lines · Ross
On 28 October 2015 at 10:55, Alexander Kanavin <[email protected] <mailto:[email protected]>> wrote:
I suppose Backport is the best choice in upstream status [ Pending Submitted Accepted Backport Denied Inappropriate ]. Though it is not
from official upstream, it is from somewhere else as listed in the patch.
Quoted 4 lines
'Submitted [where]' is the right choice here, I think.
Yes, this is exactly what Submitted is for.
OK. I'll send V2.
Thanks,
Kai
Quoted 4 lines
Ross
Signature · 2 lines
Regards, Neil | Kai Kang