From 5b1c2056e03b02247e82e45ac177117c2852d804 Mon Sep 17 00:00:00 2001 From: yang_zhuang_zhuang <1162011203@qq.com> Date: Mon, 7 Feb 2022 14:22:27 +0800 Subject: [PATCH] Fix CVE-2022-23852 CVE-2022-23990 --- ...revent-integer-overflow-in-XML_GetBu.patch | 29 ++++++++++ ...ger-overflow-in-XML_GetBuffer-CVE-20.patch | 58 +++++++++++++++++++ ...ger-overflow-in-doProlog-CVE-2022-23.patch | 45 ++++++++++++++ expat.spec | 11 +++- 4 files changed, 142 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2022-23852-lib-Detect-and-prevent-integer-overflow-in-XML_GetBu.patch create mode 100644 backport-CVE-2022-23852-tests-Cover-integer-overflow-in-XML_GetBuffer-CVE-20.patch create mode 100644 backport-CVE-2022-23990-lib-Prevent-integer-overflow-in-doProlog-CVE-2022-23.patch diff --git a/backport-CVE-2022-23852-lib-Detect-and-prevent-integer-overflow-in-XML_GetBu.patch b/backport-CVE-2022-23852-lib-Detect-and-prevent-integer-overflow-in-XML_GetBu.patch new file mode 100644 index 0000000..19a711b --- /dev/null +++ b/backport-CVE-2022-23852-lib-Detect-and-prevent-integer-overflow-in-XML_GetBu.patch @@ -0,0 +1,29 @@ +From 847a645152f5ebc10ac63b74b604d0c1a79fae40 Mon Sep 17 00:00:00 2001 +From: Samanta Navarro +Date: Sat, 22 Jan 2022 17:48:00 +0100 +Subject: [PATCH] lib: Detect and prevent integer overflow in + XML_GetBuffer (CVE-2022-23852) + +--- + lib/xmlparse.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index d54af68..5ce3140 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2067,6 +2067,11 @@ XML_GetBuffer(XML_Parser parser, int len) { + keep = (int)EXPAT_SAFE_PTR_DIFF(parser->m_bufferPtr, parser->m_buffer); + if (keep > XML_CONTEXT_BYTES) + keep = XML_CONTEXT_BYTES; ++ /* Detect and prevent integer overflow */ ++ if (keep > INT_MAX - neededSize) { ++ parser->m_errorCode = XML_ERROR_NO_MEMORY; ++ return NULL; ++ } + neededSize += keep; + #endif /* defined XML_CONTEXT_BYTES */ + if (neededSize +-- +1.8.3.1 + diff --git a/backport-CVE-2022-23852-tests-Cover-integer-overflow-in-XML_GetBuffer-CVE-20.patch b/backport-CVE-2022-23852-tests-Cover-integer-overflow-in-XML_GetBuffer-CVE-20.patch new file mode 100644 index 0000000..8fafb8f --- /dev/null +++ b/backport-CVE-2022-23852-tests-Cover-integer-overflow-in-XML_GetBuffer-CVE-20.patch @@ -0,0 +1,58 @@ +From acf956f14bf79a5e6383a969aaffec98bfbc2e44 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sun, 23 Jan 2022 18:17:04 +0100 +Subject: [PATCH] tests: Cover integer overflow in XML_GetBuffer + (CVE-2022-23852) + +--- + tests/runtests.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/tests/runtests.c b/tests/runtests.c +index e89e822..579dad1 100644 +--- a/tests/runtests.c ++++ b/tests/runtests.c +@@ -3847,6 +3847,30 @@ START_TEST(test_get_buffer_2) { + } + END_TEST + ++/* Test for signed integer overflow CVE-2022-23852 */ ++#if defined(XML_CONTEXT_BYTES) ++START_TEST(test_get_buffer_3_overflow) { ++ XML_Parser parser = XML_ParserCreate(NULL); ++ assert(parser != NULL); ++ ++ const char *const text = "\n"; ++ const int expectedKeepValue = (int)strlen(text); ++ ++ // After this call, variable "keep" in XML_GetBuffer will ++ // have value expectedKeepValue ++ if (XML_Parse(parser, text, (int)strlen(text), XML_FALSE /* isFinal */) ++ == XML_STATUS_ERROR) ++ xml_failure(parser); ++ ++ assert(expectedKeepValue > 0); ++ if (XML_GetBuffer(parser, INT_MAX - expectedKeepValue + 1) != NULL) ++ fail("enlarging buffer not failed"); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++#endif // defined(XML_CONTEXT_BYTES) ++ + /* Test position information macros */ + START_TEST(test_byte_info_at_end) { + const char *text = ""; +@@ -11731,6 +11755,9 @@ make_suite(void) { + tcase_add_test(tc_basic, test_empty_parse); + tcase_add_test(tc_basic, test_get_buffer_1); + tcase_add_test(tc_basic, test_get_buffer_2); ++#if defined(XML_CONTEXT_BYTES) ++ tcase_add_test(tc_basic, test_get_buffer_3_overflow); ++#endif + tcase_add_test(tc_basic, test_byte_info_at_end); + tcase_add_test(tc_basic, test_byte_info_at_error); + tcase_add_test(tc_basic, test_byte_info_at_cdata); +-- +1.8.3.1 + diff --git a/backport-CVE-2022-23990-lib-Prevent-integer-overflow-in-doProlog-CVE-2022-23.patch b/backport-CVE-2022-23990-lib-Prevent-integer-overflow-in-doProlog-CVE-2022-23.patch new file mode 100644 index 0000000..a1d79d1 --- /dev/null +++ b/backport-CVE-2022-23990-lib-Prevent-integer-overflow-in-doProlog-CVE-2022-23.patch @@ -0,0 +1,45 @@ +From ede41d1e186ed2aba88a06e84cac839b770af3a1 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Wed, 26 Jan 2022 02:36:43 +0100 +Subject: [PATCH] lib: Prevent integer overflow in doProlog + (CVE-2022-23990) + +The change from "int nameLen" to "size_t nameLen" +addresses the overflow on "nameLen++" in code +"for (; name[nameLen++];)" right above the second +change in the patch. +--- + lib/xmlparse.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 5ce3140..d1d1700 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5372,7 +5372,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (dtd->in_eldecl) { + ELEMENT_TYPE *el; + const XML_Char *name; +- int nameLen; ++ size_t nameLen; + const char *nxt + = (quant == XML_CQUANT_NONE ? next : next - enc->minBytesPerChar); + int myindex = nextScaffoldPart(parser); +@@ -5388,7 +5388,13 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + nameLen = 0; + for (; name[nameLen++];) + ; +- dtd->contentStringLen += nameLen; ++ ++ /* Detect and prevent integer overflow */ ++ if (nameLen > UINT_MAX - dtd->contentStringLen) { ++ return XML_ERROR_NO_MEMORY; ++ } ++ ++ dtd->contentStringLen += (unsigned)nameLen; + if (parser->m_elementDeclHandler) + handleDefault = XML_FALSE; + } +-- +1.8.3.1 + diff --git a/expat.spec b/expat.spec index bb9bd7c..e828224 100644 --- a/expat.spec +++ b/expat.spec @@ -1,7 +1,7 @@ %define Rversion %(echo %{version} | sed -e 's/\\./_/g' -e 's/^/R_/') Name: expat Version: 2.2.9 -Release: 3 +Release: 4 Summary: An XML parser library License: MIT URL: https://libexpat.github.io/ @@ -12,6 +12,9 @@ Patch0001: Don-t-add-to-NULL-in-iterator.patch Patch0002: backport-CVE-2021-45960.patch Patch0003: backport-CVE-2021-46143.patch Patch0004: backport-CVE-2022-22822-CVE-2022-22823-CVE-2022-22824-CVE-2022-22825-CVE-2022-22826-CVE-2022-22827.patch +Patch0005: backport-CVE-2022-23852-lib-Detect-and-prevent-integer-overflow-in-XML_GetBu.patch +Patch0006: backport-CVE-2022-23852-tests-Cover-integer-overflow-in-XML_GetBuffer-CVE-20.patch +Patch0007: backport-CVE-2022-23990-lib-Prevent-integer-overflow-in-doProlog-CVE-2022-23.patch BuildRequires: sed,autoconf,automake,gcc-c++,libtool,xmlto @@ -64,6 +67,12 @@ make check %{_mandir}/man1/* %changelog +* Mon Feb 7 2022 yangzhuangzhuang - 2.2.9-4 +- Type:CVE +- ID:CVE-2022-23852 CVE-2022-23990 +- SUG:NA +- DESC:Fix CVE-2022-23852CVE-2022-23990 + * Mon Jan 17 2022 wangjie - 2.2.9-3 - Type:CVE - ID:CVE-2021-45960 CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 -- Gitee