From c0d98a1851247440df9b8d840b48e5e1682f7151 Mon Sep 17 00:00:00 2001 From: Zhiyi Weng Date: Mon, 1 Nov 2021 16:08:17 +0800 Subject: [PATCH] Fix CVE-2021-42260 (cherry picked from commit 9b314d6163e5448789190a2576df0daf87e5a0c3) --- ...always-advance-the-pointer-if-p-0xef.patch | 32 +++++++++++++++++++ tinyxml.spec | 8 +++-- 2 files changed, 38 insertions(+), 2 deletions(-) create mode 100644 0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch diff --git a/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch b/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch new file mode 100644 index 0000000..9652487 --- /dev/null +++ b/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch @@ -0,0 +1,32 @@ +From f7ca0035d17a663f55668e662b840afce7b86112 Mon Sep 17 00:00:00 2001 +From: Christian Voegl +Date: Wed, 27 Oct 2021 11:25:18 +0200 +Subject: [PATCH] In stamp always advance the pointer if *p= 0xef + +The current implementation only advanced if 0xef is followed +by two non-zero bytes. In case of malformed input (0xef should be +the start byte of a three byte character) this leads to an infinite +loop. (CVE-2021-42260) +--- + tinyxmlparser.cpp | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tinyxmlparser.cpp b/tinyxmlparser.cpp +index 81b7eae..8aa0dfa 100755 +--- a/tinyxmlparser.cpp ++++ b/tinyxmlparser.cpp +@@ -274,6 +274,12 @@ void TiXmlParsingData::Stamp( const char* now, TiXmlEncoding encoding ) + else + { p +=3; ++col; } // A normal character. + } ++ else ++ { ++ // TIXML_UTF_LEAD_0 (239) is the start character of a 3 byte sequence, so ++ // there is something wrong here. Just advance the pointer to evade infinite loops ++ ++p; ++ } + } + else + { +-- +2.33.0 diff --git a/tinyxml.spec b/tinyxml.spec index 1eb1730..7c6aa41 100644 --- a/tinyxml.spec +++ b/tinyxml.spec @@ -1,10 +1,11 @@ Name: tinyxml Version: 2.6.2 -Release: 20 +Release: 21 Summary: C++ XML parser License: zlib URL: http://www.grinninglizard.com/tinyxml/ Source0: http://downloads.sourceforge.net/tinyxml/tinyxml_2_6_2.tar.gz +Patch0: 0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch BuildRequires: gcc-c++ %description @@ -23,7 +24,7 @@ The devel package contains development files for tinyxml. It provides header files and libraries for tinyxml. %prep -%autosetup -n tinyxml +%autosetup -p1 -n tinyxml touch tinyxml.h %build @@ -63,6 +64,9 @@ mkdir -p %{buildroot}%{_libdir}/pkgconfig %{_libdir}/*.so %changelog +* Mon Nov 1 2021 Zhiyi Weng - 2.6.2-21 +- Fix CVE-2021-42260 + * Tue Oct 26 2021 chenchen - 2.6.2-20 - change the spec file name to be the same as the repo name -- Gitee