CVE-2020-25713 raptor2: malformed input file can lead to a segfault

due to an out of bounds array access in raptor_xml_writer_start_element_common See: https://bugs.mageia.org/show_bug.cgi?id=27605 https://www.openwall.com/lists/oss-security/2020/11/13/1 Change-Id: Ida4783a61412ffce868eacf81310da338d3e2df1 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/106423 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com>
2020-11-23 20:58:30 +01:00
parent 943c108071
commit f3e4a3a4b4
2 changed files with 15 additions and 0 deletions
@@ -28,6 +28,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,raptor,\
 	$(if $(SYSTEM_LIBXML),,external/redland/raptor/rpath.patch) \
 	external/redland/raptor/xml2-config.patch \
 	external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1 \
+	external/redland/raptor/raptor-fix-oob.patch.1\
 	external/redland/raptor/libtool.patch \
 	external/redland/raptor/libxml-override.patch \
 ))
@@ -0,0 +1,14 @@
+diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c
+index 56993dc3..163f34d5 100644
+--- a/src/raptor_xml_writer.c
+++ b/src/raptor_xml_writer.c
+@@ -216,6 +216,9 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer,
+ 
+   if(nstack && element->attributes) {
+     for(i = 0; i < element->attribute_count; i++) {
+      if (nspace_declarations_count > element->attribute_count)
+        goto error;
+
+       /* qname */
+       if(element->attributes[i]->nspace) {
+         /* Check if we need a namespace declaration attribute */