Re: addressing CVE-2018-1311/XERCESC-2188

2020-03-09 Thread Sylvain Beucler
Hi, On 06/03/2020 07:52, Hugo Lefeuvre wrote: >> FYI it seems none of your messages made it to the Xerces c-dev mailing list: >> https://mail-archives.apache.org/mod_mbox/xerces-c-dev/202001.mbox/browser >> >> Are you still working on a patch? > > unfortunately, I did not manage to find time for m

Re: addressing CVE-2018-1311/XERCESC-2188

2020-03-05 Thread Hugo Lefeuvre
Hi Sylvain, > FYI it seems none of your messages made it to the Xerces c-dev mailing list: > https://mail-archives.apache.org/mod_mbox/xerces-c-dev/202001.mbox/browser > > Are you still working on a patch? unfortunately, I did not manage to find time for my LTS duties in february and I doubt tha

Re: addressing CVE-2018-1311/XERCESC-2188

2020-03-03 Thread Sylvain Beucler
FYI it seems none of your messages made it to the Xerces c-dev mailing list: https://mail-archives.apache.org/mod_mbox/xerces-c-dev/202001.mbox/browser Are you still working on a patch? - Sylvain On 30/01/2020 09:16, Ola Lundqvist wrote: > Hi > > Yes you answered my questions. Please go ahead to

Re: addressing CVE-2018-1311/XERCESC-2188

2020-01-30 Thread Ola Lundqvist
Hi Yes you answered my questions. Please go ahead to prepare a patch. / Ola Den tors 30 jan. 2020 09:09Hugo Lefeuvre skrev: > Hi Ola, > > > > A DTDEntityDecl object is allocated and pushed into the ReaderMgr > stack. > > > ReaderMgr does not own the stack's content, so objects neither get > fr

Re: addressing CVE-2018-1311/XERCESC-2188

2020-01-30 Thread Hugo Lefeuvre
Hi Ola, > > A DTDEntityDecl object is allocated and pushed into the ReaderMgr stack. > > ReaderMgr does not own the stack's content, so objects neither get freed on > > ReaderMgr::popReader(), nor on ReaderMgr::~ReaderMgr(). > > And it should not be freed by the code popping the object? I don't

Re: addressing CVE-2018-1311/XERCESC-2188

2020-01-29 Thread Ola Lundqvist
Hi I have some questions below. I think your approach looks sensible but I'm not sure I have understood the description correctly. See below. On Fri, 24 Jan 2020 at 17:37, Hugo Lefeuvre wrote: > [c-dev senders: please CC me, I did not subscribe to the mailing list] > > Hi, > > I had a look at