From: Szymon Siwek <sls@pld-linux.org>
Date: Thu, 20 Nov 2008 01:09:09 +0000 (+0000)
Subject: - from Fedora
X-Git-Tag: auto/th/libxml2-2_7_2-3~1
X-Git-Url: https://git.pld-linux.org/?a=commitdiff_plain;ds=sidebyside;h=77748baa297742a8b0ad1a5b12f5261a1253d5a8;p=packages%2Flibxml2.git

- from Fedora

Changed files:
    libxml2-CVE-2008-4225.patch -> 1.1
    libxml2-CVE-2008-4226.patch -> 1.1
---

diff --git a/libxml2-CVE-2008-4225.patch b/libxml2-CVE-2008-4225.patch
new file mode 100644
index 0000000..0666795
--- /dev/null
+++ b/libxml2-CVE-2008-4225.patch
@@ -0,0 +1,26 @@
+--- tree.c.orig	2008-10-31 18:14:00.000000000 -0700
++++ tree.c	2008-10-31 18:14:35.000000000 -0700
+@@ -14,7 +14,7 @@
+ #include "libxml.h"
+ 
+ #include <string.h> /* for memset() only ! */
+-
++#include <limits.h>
+ #ifdef HAVE_CTYPE_H
+ #include <ctype.h>
+ #endif
+@@ -6996,7 +6996,13 @@
+ 	case XML_BUFFER_ALLOC_DOUBLEIT:
+ 	    /*take care of empty case*/
+ 	    newSize = (buf->size ? buf->size*2 : size + 10);
+-	    while (size > newSize) newSize *= 2;
++	    while (size > newSize) {
++	        if (newSize > UINT_MAX / 2) {
++	            xmlTreeErrMemory("growing buffer");
++	            return 0;
++	        }
++	        newSize *= 2;
++	    }
+ 	    break;
+ 	case XML_BUFFER_ALLOC_EXACT:
+ 	    newSize = size+10;
diff --git a/libxml2-CVE-2008-4226.patch b/libxml2-CVE-2008-4226.patch
new file mode 100644
index 0000000..79e808b
--- /dev/null
+++ b/libxml2-CVE-2008-4226.patch
@@ -0,0 +1,38 @@
+--- SAX2.c.orig	2008-01-25 08:10:04.000000000 -0500
++++ SAX2.c	2008-11-07 05:07:34.000000000 -0500
+@@ -11,6 +11,7 @@
+ #include "libxml.h"
+ #include <stdlib.h>
+ #include <string.h>
++#include <limits.h>
+ #include <libxml/xmlmemory.h>
+ #include <libxml/tree.h>
+ #include <libxml/parser.h>
+@@ -26,6 +27,11 @@
+ #include <libxml/HTMLtree.h>
+ #include <libxml/globals.h>
+ 
++/* Define SIZE_T_MAX unless defined through <limits.h>. */
++#ifndef SIZE_T_MAX
++# define SIZE_T_MAX     ((size_t)-1)
++#endif /* !SIZE_T_MAX */
++
+ /* #define DEBUG_SAX2 */
+ /* #define DEBUG_SAX2_TREE */
+ 
+@@ -2445,9 +2451,14 @@
+ 	               (xmlDictOwns(ctxt->dict, lastChild->content))) {
+ 		lastChild->content = xmlStrdup(lastChild->content);
+ 	    }
++	    if ((size_t)ctxt->nodelen > SIZE_T_MAX - (size_t)len || 
++	        (size_t)ctxt->nodemem + (size_t)len > SIZE_T_MAX / 2) {
++	            xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
++	            return;
++	    }
+ 	    if (ctxt->nodelen + len >= ctxt->nodemem) {
+ 		xmlChar *newbuf;
+-		int size;
++		size_t size;
+ 
+ 		size = ctxt->nodemem + len;
+ 		size *= 2;