external/redland/UnpackedTarball_raptor.mk | 1 +
external/redland/raptor/raptor-fix-oob.patch.1 | 14 ++++++++++++++
2 files changed, 15 insertions(+)
New commits:
commit f3e4a3a4b491daedd0d7e2d2bab2da30e36c345f
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Nov 23 14:33:06 2020 +0000
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Mon Nov 23 20:58:30 2020 +0100
CVE-2020-25713 raptor2: malformed input file can lead to a segfault
due to an out of bounds array access in
raptor_xml_writer_start_element_common
See:
https://bugs.mageia.org/show_bug.cgi?id=27605
https://www.openwall.com/lists/oss-security/2020/11/13/1
Change-Id: Ida4783a61412ffce868eacf81310da338d3e2df1
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/106423
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/external/redland/UnpackedTarball_raptor.mk
b/external/redland/UnpackedTarball_raptor.mk
index 2e0ef98fa2b5..3a4d7f17a471 100644
--- a/external/redland/UnpackedTarball_raptor.mk
+++ b/external/redland/UnpackedTarball_raptor.mk
@@ -28,6 +28,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,raptor,\
$(if $(SYSTEM_LIBXML),,external/redland/raptor/rpath.patch) \
external/redland/raptor/xml2-config.patch \
external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1
\
+ external/redland/raptor/raptor-fix-oob.patch.1\
external/redland/raptor/libtool.patch \
external/redland/raptor/libxml-override.patch \
))
diff --git a/external/redland/raptor/raptor-fix-oob.patch.1
b/external/redland/raptor/raptor-fix-oob.patch.1
new file mode 100644
index 000000000000..04106dc9a70e
--- /dev/null
+++ b/external/redland/raptor/raptor-fix-oob.patch.1
@@ -0,0 +1,14 @@
+diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c
+index 56993dc3..163f34d5 100644
+--- a/src/raptor_xml_writer.c
++++ b/src/raptor_xml_writer.c
+@@ -216,6 +216,9 @@ raptor_xml_writer_start_element_common(raptor_xml_writer*
xml_writer,
+
+ if(nstack && element->attributes) {
+ for(i = 0; i < element->attribute_count; i++) {
++ if (nspace_declarations_count > element->attribute_count)
++ goto error;
++
+ /* qname */
+ if(element->attributes[i]->nspace) {
+ /* Check if we need a namespace declaration attribute */
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
