forked from microsoft/azurelinux
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
…VE-2024-25062 [High] (microsoft#12556) Co-authored-by: jslobodzian <joslobo@microsoft.com>
- Loading branch information
1 parent
eda146a
commit 8d37859
Showing
9 changed files
with
172 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| From 2b0aac140d739905c7848a42efc60bfe783a39b7 Mon Sep 17 00:00:00 2001 | ||
| From: Nick Wellnhofer <wellnhofer@aevum.de> | ||
| Date: Sat, 14 Oct 2023 22:45:54 +0200 | ||
| Subject: [PATCH] [CVE-2024-25062] xmlreader: Don't expand XIncludes when | ||
| backtracking | ||
|
|
||
| Fixes a use-after-free if XML Reader if used with DTD validation and | ||
| XInclude expansion. | ||
|
|
||
| Fixes #604. | ||
| --- | ||
| xmlreader.c | 1 + | ||
| 1 file changed, 1 insertion(+) | ||
|
|
||
| diff --git a/xmlreader.c b/xmlreader.c | ||
| index 979385a13..fefd68e0b 100644 | ||
| --- a/xmlreader.c | ||
| +++ b/xmlreader.c | ||
| @@ -1443,6 +1443,7 @@ xmlTextReaderRead(xmlTextReaderPtr reader) { | ||
| * Handle XInclude if asked for | ||
| */ | ||
| if ((reader->xinclude) && (reader->in_xinclude == 0) && | ||
| + (reader->state != XML_TEXTREADER_BACKTRACK) && | ||
| (reader->node != NULL) && | ||
| (reader->node->type == XML_ELEMENT_NODE) && | ||
| (reader->node->ns != NULL) && |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| From 5880a9a6bd97c0f9ac8fc4f30110fe023f484746 Mon Sep 17 00:00:00 2001 | ||
| From: Nick Wellnhofer <wellnhofer@aevum.de> | ||
| Date: Tue, 10 Dec 2024 16:52:05 +0100 | ||
| Subject: [PATCH] [CVE-2024-56171] Fix use-after-free after | ||
| xmlSchemaItemListAdd | ||
|
|
||
| xmlSchemaItemListAdd can reallocate the items array. Update local | ||
| variables after adding item in | ||
|
|
||
| - xmlSchemaIDCFillNodeTables | ||
| - xmlSchemaBubbleIDCNodeTables | ||
|
|
||
| Fixes #828. | ||
| --- | ||
| xmlschemas.c | 3 +++ | ||
| 1 file changed, 3 insertions(+) | ||
|
|
||
| diff --git a/xmlschemas.c b/xmlschemas.c | ||
| index 1b3c524f2..95be97c96 100644 | ||
| --- a/xmlschemas.c | ||
| +++ b/xmlschemas.c | ||
| @@ -23374,6 +23374,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt, | ||
| } | ||
| if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1) | ||
| goto internal_error; | ||
| + dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items; | ||
| /* | ||
| * Remove the duplicate entry from the IDC node-table. | ||
| */ | ||
| @@ -23590,6 +23591,8 @@ xmlSchemaBubbleIDCNodeTables(xmlSchemaValidCtxtPtr vctxt) | ||
| goto internal_error; | ||
| } | ||
| xmlSchemaItemListAdd(parBind->dupls, parNode); | ||
| + dupls = (xmlSchemaPSVIIDCNodePtr *) | ||
| + parBind->dupls->items; | ||
| } else { | ||
| /* | ||
| * Add the node-table entry (node and key-sequence) of |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| From 29f5d2b67e31c435cbc08954a12a0267c5887d39 Mon Sep 17 00:00:00 2001 | ||
| From: Kanishk-Bansal <kbkanishk975@gmail.com> | ||
| Date: Sat, 22 Feb 2025 18:12:41 +0000 | ||
| Subject: [PATCH] CVE-2025-24928 | ||
|
|
||
| Upstream Reference: https://github.com/GNOME/libxml2/commit/8c8753ad5280ee13aee5eec9b0f6eee2ed920f57 | ||
|
|
||
| --- | ||
| valid.c | 25 +++++++++++++------------ | ||
| 1 file changed, 13 insertions(+), 12 deletions(-) | ||
|
|
||
| diff --git a/valid.c b/valid.c | ||
| index 67e1b1d..7eb2dd3 100644 | ||
| --- a/valid.c | ||
| +++ b/valid.c | ||
| @@ -5252,25 +5252,26 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { | ||
| return; | ||
| } | ||
| switch (cur->type) { | ||
| - case XML_ELEMENT_NODE: | ||
| + case XML_ELEMENT_NODE: { | ||
| + int qnameLen = xmlStrlen(cur->name); | ||
| + | ||
| + if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) | ||
| + qnameLen += xmlStrlen(cur->ns->prefix) + 1; | ||
| + if (size - len < qnameLen + 10) { | ||
| + if ((size - len > 4) && (buf[len - 1] != '.')) | ||
| + strcat(buf, " ..."); | ||
| + return; | ||
| + } | ||
| if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) { | ||
| - if (size - len < xmlStrlen(cur->ns->prefix) + 10) { | ||
| - if ((size - len > 4) && (buf[len - 1] != '.')) | ||
| - strcat(buf, " ..."); | ||
| - return; | ||
| - } | ||
| strcat(buf, (char *) cur->ns->prefix); | ||
| strcat(buf, ":"); | ||
| } | ||
| - if (size - len < xmlStrlen(cur->name) + 10) { | ||
| - if ((size - len > 4) && (buf[len - 1] != '.')) | ||
| - strcat(buf, " ..."); | ||
| - return; | ||
| - } | ||
| - strcat(buf, (char *) cur->name); | ||
| + if (cur->name != NULL) | ||
| + strcat(buf, (char *) cur->name); | ||
| if (cur->next != NULL) | ||
| strcat(buf, " "); | ||
| break; | ||
| + } | ||
| case XML_TEXT_NODE: | ||
| if (xmlIsBlankNode(cur)) | ||
| break; | ||
| -- | ||
| 2.45.2 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| From 6c716d491dd2e67f08066f4dc0619efeb49e43e6 Mon Sep 17 00:00:00 2001 | ||
| From: Nick Wellnhofer <wellnhofer@aevum.de> | ||
| Date: Thu, 13 Feb 2025 16:48:53 +0100 | ||
| Subject: [PATCH] pattern: Fix compilation of explicit child axis | ||
|
|
||
| The child axis is the default axis and should generate XML_OP_ELEM like | ||
| the case without an axis. | ||
| --- | ||
| pattern.c | 4 ++-- | ||
| 1 file changed, 2 insertions(+), 2 deletions(-) | ||
|
|
||
| diff --git a/pattern.c b/pattern.c | ||
| index 0877fc1a0..6fa88f759 100644 | ||
| --- a/pattern.c | ||
| +++ b/pattern.c | ||
| @@ -1035,10 +1035,10 @@ xmlCompileStepPattern(xmlPatParserContextPtr ctxt) { | ||
| goto error; | ||
| } | ||
| } else { | ||
| - PUSH(XML_OP_CHILD, token, URL); | ||
| + PUSH(XML_OP_ELEM, token, URL); | ||
| } | ||
| } else | ||
| - PUSH(XML_OP_CHILD, name, NULL); | ||
| + PUSH(XML_OP_ELEM, name, NULL); | ||
| return; | ||
| } else if (xmlStrEqual(name, (const xmlChar *) "attribute")) { | ||
| XML_PAT_FREE_STRING(ctxt, name) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters