Skip to content
Snippets Groups Projects
Commit 610e1dca authored by Dustin Collins's avatar Dustin Collins
Browse files

Add patch for libxml2 CVE-2019-20388, CVE-2020-7595

parent 3e616069
No related branches found
No related tags found
1 merge request!26GitLab 13.9
......@@ -5,6 +5,12 @@
CVE-2019-15547
CVE-2019-15548
# libxml2/2.9.10
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5866
CVE-2019-20388
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5867
CVE-2020-7595
# libxslt/1.1.32
# https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5824
CVE-2019-11068
......@@ -38,4 +44,3 @@
CVE-2017-3736
# Entries from CVEIGNORE variable go below this line
---
title: Add patch for libxml2 CVE-2019-20388,CVE-2020-7595
merge_request:
author:
type: security
From 7ffcd44d7e6c46704f8af0321d9314cd26e0e18a Mon Sep 17 00:00:00 2001
From: Zhipeng Xie <xiezhipeng1@huawei.com>
Date: Tue, 20 Aug 2019 16:33:06 +0800
Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream
When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
vctxt->xsiAssemble to 0 again which cause the alloced schema
can not be freed anymore.
Found with libFuzzer.
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
---
xmlschemas.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/xmlschemas.c b/xmlschemas.c
index 301c8449..39d92182 100644
--- a/xmlschemas.c
+++ b/xmlschemas.c
@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) {
vctxt->nberrors = 0;
vctxt->depth = -1;
vctxt->skipDepth = -1;
- vctxt->xsiAssemble = 0;
vctxt->hasKeyrefs = 0;
#ifdef ENABLE_IDC_NODE_TABLES_TEST
vctxt->createIDCNodeTables = 1;
--
GitLab
From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001
From: Zhipeng Xie <xiezhipeng1@huawei.com>
Date: Thu, 12 Dec 2019 17:30:55 +0800
Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
return NULL which cause a infinite loop in xmlStringLenDecodeEntities
Found with libFuzzer.
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
---
parser.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/parser.c b/parser.c
index d1c31963..a34bb6cd 100644
--- a/parser.c
+++ b/parser.c
@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
else
c = 0;
while ((c != 0) && (c != end) && /* non input consuming loop */
- (c != end2) && (c != end3)) {
+ (c != end2) && (c != end3) &&
+ (ctxt->instate != XML_PARSER_EOF)) {
if (c == 0) break;
if ((c == '&') && (str[1] == '#')) {
--
GitLab
......@@ -39,6 +39,8 @@
env = with_standard_compiler_flags(with_embedded_path)
patch source: '50f06b3efb638efb0abd95dc62dca05ae67882c2.patch', env: env
patch source: 'CVE-2019-20388.patch', env: env
patch source: 'CVE-2020-7595.patch', env: env
configure_command = [
"--with-zlib=#{install_dir}/embedded",
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment