Package: libxml2 / 2.9.10+dfsg-6.7

Fix-user-after-free-with-xmllint-xinclude-dropdtd.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Thu, 22 Apr 2021 19:26:28 +0200
Subject: Fix user-after-free with `xmllint --xinclude --dropdtd`
Origin: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7
Bug: https://gitlab.gnome.org/GNOME/libxml2/-/issues/237
Bug-Debian: https://bugs.debian.org/987737
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-3518

The --dropdtd option can leave dangling pointers in entity reference
nodes. Make sure to skip these nodes when processing XIncludes.

This also avoids scanning entity declarations and even modifying
them inadvertently during XInclude processing.

Move from a block list to an allow list approach to avoid descending
into other node types that can't contain elements.

Fixes #237.
---
 xinclude.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/xinclude.c
+++ b/xinclude.c
@@ -2397,9 +2397,8 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr
     while ((cur != NULL) && (cur != tree->parent)) {
 	/* TODO: need to work on entities -> stack */
 	if ((cur->children != NULL) &&
-	    (cur->children->type != XML_ENTITY_DECL) &&
-	    (cur->children->type != XML_XINCLUDE_START) &&
-	    (cur->children->type != XML_XINCLUDE_END)) {
+	    ((cur->type == XML_DOCUMENT_NODE) ||
+	     (cur->type == XML_ELEMENT_NODE))) {
 	    cur = cur->children;
 	    if (xmlXIncludeTestNode(ctxt, cur))
 		xmlXIncludePreProcessNode(ctxt, cur);