kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

textproc/expat2: Patch vulnerability

Browse source 
This patch resolves a vulnerability that may still exist due to
compiler optimizations. The previous patches for CVE-2015-1283 and
CVE-2015-2716 may not work as intended in some situations.

MFH:		2016Q2
Security:	CVE-2016-4472
This commit is contained in:
Mark Felder 2016-06-30 22:36:05 +00:00
parent f0208d2875
commit 66ce3cb3fa
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=417847
2 changed files with 27 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
textproc/expat2/Makefile
View file

@ -3,7 +3,7 @@
PORTNAME= expat
PORTVERSION= 2.1.1
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES= textproc
MASTER_SITES= SF

26
textproc/expat2/files/patch-CVE-2016-4472 Normal file
View file

@ -0,0 +1,26 @@
expat/CMakeLists.txt | 3 +++
expat/lib/xmlparse.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
2 files changed, 44 insertions(+), 7 deletions(-)
--- lib/xmlparse.c.orig 2016-06-30 22:23:11 UTC
+++ lib/xmlparse.c
@@ -1693,7 +1693,8 @@ XML_GetBuffer(XML_Parser parser, int len
}
if (len > bufferLim - bufferEnd) {
- int neededSize = len + (int)(bufferEnd - bufferPtr);
+ /* Do not invoke signed arithmetic overflow: */
+ int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
if (neededSize < 0) {
errorCode = XML_ERROR_NO_MEMORY;
return NULL;
@@ -1725,7 +1726,8 @@ XML_GetBuffer(XML_Parser parser, int len
if (bufferSize == 0)
bufferSize = INIT_BUFFER_SIZE;
do {
- bufferSize *= 2;
+ /* Do not invoke signed arithmetic overflow: */
+ bufferSize = (int) (2U * (unsigned) bufferSize);
} while (bufferSize < neededSize && bufferSize > 0);
if (bufferSize <= 0) {
errorCode = XML_ERROR_NO_MEMORY;