package/libxml2/0002-Disallow-namespace-nodes-in-XPointer-ranges.patch

   1 From c1d1f7121194036608bf555f08d3062a36fd344b Mon Sep 17 00:00:00 2001
   2 From: Nick Wellnhofer <wellnhofer@aevum.de>
   3 Date: Tue, 28 Jun 2016 18:34:52 +0200
   4 Subject: [PATCH] Disallow namespace nodes in XPointer ranges
   5
   6 Namespace nodes must be copied to avoid use-after-free errors.
   7 But they don't necessarily have a physical representation in a
   8 document, so simply disallow them in XPointer ranges.
   9
  10 Found with afl-fuzz.
  11
  12 Fixes CVE-2016-4658.
  13
  14 Signed-off-by: Baruch Siach <baruch@tkos.co.il>
  15 ---
  16 Patch status: upstream commit c1d1f712119403
  17
  18  xpointer.c | 149 +++++++++++++++++++++++--------------------------------------
  19  1 file changed, 56 insertions(+), 93 deletions(-)
  20
  21 diff --git a/xpointer.c b/xpointer.c
  22 index a7b03fbdae16..694d120e2e0b 100644
  23 --- a/xpointer.c
  24 +++ b/xpointer.c
  25 @@ -320,6 +320,45 @@ xmlXPtrRangesEqual(xmlXPathObjectPtr range1, xmlXPathObjectPtr range2) {
  26  }
  27
  28  /**
  29 + * xmlXPtrNewRangeInternal:
  30 + * @start:  the starting node
  31 + * @startindex:  the start index
  32 + * @end:  the ending point
  33 + * @endindex:  the ending index
  34 + *
  35 + * Internal function to create a new xmlXPathObjectPtr of type range
  36 + *
  37 + * Returns the newly created object.
  38 + */
  39 +static xmlXPathObjectPtr
  40 +xmlXPtrNewRangeInternal(xmlNodePtr start, int startindex,
  41 +                        xmlNodePtr end, int endindex) {
  42 +    xmlXPathObjectPtr ret;
  43 +
  44 +    /*
  45 +     * Namespace nodes must be copied (see xmlXPathNodeSetDupNs).
  46 +     * Disallow them for now.
  47 +     */
  48 +    if ((start != NULL) && (start->type == XML_NAMESPACE_DECL))
  49 +       return(NULL);
  50 +    if ((end != NULL) && (end->type == XML_NAMESPACE_DECL))
  51 +       return(NULL);
  52 +
  53 +    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
  54 +    if (ret == NULL) {
  55 +        xmlXPtrErrMemory("allocating range");
  56 +       return(NULL);
  57 +    }
  58 +    memset(ret, 0, sizeof(xmlXPathObject));
  59 +    ret->type = XPATH_RANGE;
  60 +    ret->user = start;
  61 +    ret->index = startindex;
  62 +    ret->user2 = end;
  63 +    ret->index2 = endindex;
  64 +    return(ret);
  65 +}
  66 +
  67 +/**
  68   * xmlXPtrNewRange:
  69   * @start:  the starting node
  70   * @startindex:  the start index
  71 @@ -344,17 +383,7 @@ xmlXPtrNewRange(xmlNodePtr start, int startindex,
  72      if (endindex < 0)
  73         return(NULL);
  74
  75 -    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
  76 -    if (ret == NULL) {
  77 -        xmlXPtrErrMemory("allocating range");
  78 -       return(NULL);
  79 -    }
  80 -    memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
  81 -    ret->type = XPATH_RANGE;
  82 -    ret->user = start;
  83 -    ret->index = startindex;
  84 -    ret->user2 = end;
  85 -    ret->index2 = endindex;
  86 +    ret = xmlXPtrNewRangeInternal(start, startindex, end, endindex);
  87      xmlXPtrRangeCheckOrder(ret);
  88      return(ret);
  89  }
  90 @@ -381,17 +410,8 @@ xmlXPtrNewRangePoints(xmlXPathObjectPtr start, xmlXPathObjectPtr end) {
  91      if (end->type != XPATH_POINT)
  92         return(NULL);
  93
  94 -    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
  95 -    if (ret == NULL) {
  96 -        xmlXPtrErrMemory("allocating range");
  97 -       return(NULL);
  98 -    }
  99 -    memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
 100 -    ret->type = XPATH_RANGE;
 101 -    ret->user = start->user;
 102 -    ret->index = start->index;
 103 -    ret->user2 = end->user;
 104 -    ret->index2 = end->index;
 105 +    ret = xmlXPtrNewRangeInternal(start->user, start->index, end->user,
 106 +                                  end->index);
 107      xmlXPtrRangeCheckOrder(ret);
 108      return(ret);
 109  }
 110 @@ -416,17 +436,7 @@ xmlXPtrNewRangePointNode(xmlXPathObjectPtr start, xmlNodePtr end) {
 111      if (start->type != XPATH_POINT)
 112         return(NULL);
 113
 114 -    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
 115 -    if (ret == NULL) {
 116 -        xmlXPtrErrMemory("allocating range");
 117 -       return(NULL);
 118 -    }
 119 -    memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
 120 -    ret->type = XPATH_RANGE;
 121 -    ret->user = start->user;
 122 -    ret->index = start->index;
 123 -    ret->user2 = end;
 124 -    ret->index2 = -1;
 125 +    ret = xmlXPtrNewRangeInternal(start->user, start->index, end, -1);
 126      xmlXPtrRangeCheckOrder(ret);
 127      return(ret);
 128  }
 129 @@ -453,17 +463,7 @@ xmlXPtrNewRangeNodePoint(xmlNodePtr start, xmlXPathObjectPtr end) {
 130      if (end->type != XPATH_POINT)
 131         return(NULL);
 132
 133 -    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
 134 -    if (ret == NULL) {
 135 -        xmlXPtrErrMemory("allocating range");
 136 -       return(NULL);
 137 -    }
 138 -    memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
 139 -    ret->type = XPATH_RANGE;
 140 -    ret->user = start;
 141 -    ret->index = -1;
 142 -    ret->user2 = end->user;
 143 -    ret->index2 = end->index;
 144 +    ret = xmlXPtrNewRangeInternal(start, -1, end->user, end->index);
 145      xmlXPtrRangeCheckOrder(ret);
 146      return(ret);
 147  }
 148 @@ -486,17 +486,7 @@ xmlXPtrNewRangeNodes(xmlNodePtr start, xmlNodePtr end) {
 149      if (end == NULL)
 150         return(NULL);
 151
 152 -    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
 153 -    if (ret == NULL) {
 154 -        xmlXPtrErrMemory("allocating range");
 155 -       return(NULL);
 156 -    }
 157 -    memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
 158 -    ret->type = XPATH_RANGE;
 159 -    ret->user = start;
 160 -    ret->index = -1;
 161 -    ret->user2 = end;
 162 -    ret->index2 = -1;
 163 +    ret = xmlXPtrNewRangeInternal(start, -1, end, -1);
 164      xmlXPtrRangeCheckOrder(ret);
 165      return(ret);
 166  }
 167 @@ -516,17 +506,7 @@ xmlXPtrNewCollapsedRange(xmlNodePtr start) {
 168      if (start == NULL)
 169         return(NULL);
 170
 171 -    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
 172 -    if (ret == NULL) {
 173 -        xmlXPtrErrMemory("allocating range");
 174 -       return(NULL);
 175 -    }
 176 -    memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
 177 -    ret->type = XPATH_RANGE;
 178 -    ret->user = start;
 179 -    ret->index = -1;
 180 -    ret->user2 = NULL;
 181 -    ret->index2 = -1;
 182 +    ret = xmlXPtrNewRangeInternal(start, -1, NULL, -1);
 183      return(ret);
 184  }
 185
 186 @@ -541,6 +521,8 @@ xmlXPtrNewCollapsedRange(xmlNodePtr start) {
 187   */
 188  xmlXPathObjectPtr
 189  xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) {
 190 +    xmlNodePtr endNode;
 191 +    int endIndex;
 192      xmlXPathObjectPtr ret;
 193
 194      if (start == NULL)
 195 @@ -549,7 +531,12 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) {
 196         return(NULL);
 197      switch (end->type) {
 198         case XPATH_POINT:
 199 +           endNode = end->user;
 200 +           endIndex = end->index;
 201 +           break;
 202         case XPATH_RANGE:
 203 +           endNode = end->user2;
 204 +           endIndex = end->index2;
 205             break;
 206         case XPATH_NODESET:
 207             /*
 208 @@ -557,39 +544,15 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) {
 209              */
 210             if (end->nodesetval->nodeNr <= 0)
 211                 return(NULL);
 212 +           endNode = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1];
 213 +           endIndex = -1;
 214             break;
 215         default:
 216             /* TODO */
 217             return(NULL);
 218      }
 219
 220 -    ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
 221 -    if (ret == NULL) {
 222 -        xmlXPtrErrMemory("allocating range");
 223 -       return(NULL);
 224 -    }
 225 -    memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
 226 -    ret->type = XPATH_RANGE;
 227 -    ret->user = start;
 228 -    ret->index = -1;
 229 -    switch (end->type) {
 230 -       case XPATH_POINT:
 231 -           ret->user2 = end->user;
 232 -           ret->index2 = end->index;
 233 -           break;
 234 -       case XPATH_RANGE:
 235 -           ret->user2 = end->user2;
 236 -           ret->index2 = end->index2;
 237 -           break;
 238 -       case XPATH_NODESET: {
 239 -           ret->user2 = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1];
 240 -           ret->index2 = -1;
 241 -           break;
 242 -       }
 243 -       default:
 244 -           STRANGE
 245 -           return(NULL);
 246 -    }
 247 +    ret = xmlXPtrNewRangeInternal(start, -1, endNode, endIndex);
 248      xmlXPtrRangeCheckOrder(ret);
 249      return(ret);
 250  }
 251 --
 252 2.10.2
 253