ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

redland: disable all raptor parsers except for "rdfxml"

Browse Source 
It's the only one the unordf component invokes.

CVE-2024-57823 CVE-2024-57822 affect the "ntriples" and "turtle"
parsers.

However it appears that the function raptor_uri_normalize_path() could
also be called from raptor_libxml_* functions?  Somewhat unclear, let's
add the patch just in case.

Change-Id: Idd7ebbc29c63e84ca2434b06c26f7aca34bdcaa5
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/180272
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
This commit is contained in:
Michael Stahl
2025-01-15 13:13:59 +01:00
parent 7fe443e1f3
commit 2b50dc0e44
3 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
external/redland/ExternalProject_raptor.mk
Vendored
+1 -1
View File
@@ -37,7 +37,7 @@ $(call gb_ExternalProject_get_state_target,raptor,build):
CPPFLAGS="$(if $(SYSBASE),-I$(SYSBASE)/usr/include) $(gb_EMSCRIPTEN_CPPFLAGS)" \
ICU_LIBS='$(if $(filter-out MACOSX,$(OS)),$(ICU_LIBS))' \
$(gb_RUN_CONFIGURE) ./configure --disable-gtk-doc \
--enable-parsers="rdfxml ntriples turtle trig guess rss-tag-soup" \
--enable-parsers="rdfxml" \
--without-www \
--without-xslt-config \
$(gb_CONFIGURE_PLATFORMS) \
external/redland/UnpackedTarball_raptor.mk
Vendored
+1
View File
@@ -31,6 +31,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,raptor,\
external/redland/raptor/raptor-libxml2-11.patch.1 \
$(if $(SYSTEM_ICU),,external/redland/raptor/raptor-icu.patch) \
external/redland/raptor/disable-libxml-cleanup.patch.1 \
external/redland/raptor/CVE-2024-57823.patch.1 \
))
# vim: set noet sw=4 ts=4:
external/redland/raptor/CVE-2024-57823.patch.1
Vendored
+35
View File
@@ -0,0 +1,35 @@
--- raptor2-2.0.15/src/raptor_rfc2396.c.CVE-2024-57823 2014-07-26 23:07:37.000000000 +0200
+++ raptor2-2.0.15/src/raptor_rfc2396.c 2025-01-13 12:59:22.175568228 +0100
@@ -289,10 +289,8 @@ raptor_uri_normalize_path(unsigned char*
}
-#if defined(RAPTOR_DEBUG)
if(path_len != strlen((const char*)path_buffer))
RAPTOR_FATAL4("Path '%s' length %ld does not match calculated %ld.", (const char*)path_buffer, (long)strlen((const char*)path_buffer), (long)path_len);
-#endif
/* Remove all "<component>/../" path components */
@@ -327,10 +325,8 @@ raptor_uri_normalize_path(unsigned char*
if(!prev || !cur)
continue;
-#if defined(RAPTOR_DEBUG)
if(path_len != strlen((const char*)path_buffer))
RAPTOR_FATAL3("Path length %ld does not match calculated %ld.", (long)strlen((const char*)path_buffer), (long)path_len);
-#endif
/* If the current one is '..' */
if(s == (cur+2) && cur[0] == '.' && cur[1] == '.') {
@@ -393,10 +389,8 @@ raptor_uri_normalize_path(unsigned char*
}
-#if defined(RAPTOR_DEBUG)
if(path_len != strlen((const char*)path_buffer))
RAPTOR_FATAL3("Path length %ld does not match calculated %ld.", (long)strlen((const char*)path_buffer), (long)path_len);
-#endif
/* RFC3986 Appendix C.2 / 5.4.2 Abnormal Examples
* Remove leading /../ and /./