pkgsrc/textproc/libxml/patches/patch-ae
jmmv ed6f6b18b5 Backport security fixes (in the nanohttp and the nanoftp modules) from
libxml2 (several buffer overflows).  Bump PKGREVISION to 3.
2004-11-20 22:07:49 +00:00

47 lines
1.4 KiB
Text

$NetBSD: patch-ae,v 1.1 2004/11/20 22:07:49 jmmv Exp $
--- nanohttp.c.orig 2000-06-28 20:33:46.000000000 +0200
+++ nanohttp.c
@@ -161,6 +161,7 @@ xmlNanoHTTPScanURL(xmlNanoHTTPCtxtPtr ct
const char *cur = URL;
char buf[4096];
int index = 0;
+ const int indexMax = 4096 - 1;
int port = 0;
if (ctxt->protocol != NULL) {
@@ -177,7 +178,7 @@ xmlNanoHTTPScanURL(xmlNanoHTTPCtxtPtr ct
}
if (URL == NULL) return;
buf[index] = 0;
- while (*cur != 0) {
+ while ((*cur != 0) && (index < indexMax)) {
if ((cur[0] == ':') && (cur[1] == '/') && (cur[2] == '/')) {
buf[index] = 0;
ctxt->protocol = xmlMemStrdup(buf);
@@ -219,7 +220,7 @@ xmlNanoHTTPScanURL(xmlNanoHTTPCtxtPtr ct
else {
index = 0;
buf[index] = 0;
- while (*cur != 0)
+ while ((*cur != 0) && (index < indexMax))
buf[index++] = *cur++;
buf[index] = 0;
ctxt->path = xmlMemStrdup(buf);
@@ -241,6 +242,7 @@ xmlNanoHTTPScanProxy(const char *URL) {
const char *cur = URL;
char buf[4096];
int index = 0;
+ const int indexMax = 4096 - 1;
int port = 0;
if (proxy != NULL) {
@@ -258,7 +260,7 @@ xmlNanoHTTPScanProxy(const char *URL) {
#endif
if (URL == NULL) return;
buf[index] = 0;
- while (*cur != 0) {
+ while ((*cur != 0) && (index < indexMax)) {
if ((cur[0] == ':') && (cur[1] == '/') && (cur[2] == '/')) {
buf[index] = 0;
index = 0;