1 |
tetromino 12/01/10 20:29:13 |
2 |
|
3 |
Added: |
4 |
libxml2-2.7.8-allocation-error-copying-entities.patch |
5 |
Log: |
6 |
Fix heap-based overflow in parsing long entity references (CVE-2011-3919, bug #398361, thanks to Agostino Sarubbo for reporting). |
7 |
|
8 |
(Portage version: 2.2.0_alpha84/cvs/Linux x86_64) |
9 |
|
10 |
Revision Changes Path |
11 |
1.1 dev-libs/libxml2/files/libxml2-2.7.8-allocation-error-copying-entities.patch |
12 |
|
13 |
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libxml2/files/libxml2-2.7.8-allocation-error-copying-entities.patch?rev=1.1&view=markup |
14 |
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libxml2/files/libxml2-2.7.8-allocation-error-copying-entities.patch?rev=1.1&content-type=text/plain |
15 |
|
16 |
Index: libxml2-2.7.8-allocation-error-copying-entities.patch |
17 |
=================================================================== |
18 |
From 5bd3c061823a8499b27422aee04ea20aae24f03e Mon Sep 17 00:00:00 2001 |
19 |
From: Daniel Veillard <veillard@××××××.com> |
20 |
Date: Fri, 16 Dec 2011 10:53:35 +0000 |
21 |
Subject: Fix an allocation error when copying entities |
22 |
|
23 |
--- |
24 |
diff --git a/parser.c b/parser.c |
25 |
index 4e5dcb9..c55e41d 100644 |
26 |
--- a/parser.c |
27 |
+++ b/parser.c |
28 |
@@ -2709,7 +2709,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len, |
29 |
|
30 |
buffer[nbchars++] = '&'; |
31 |
if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) { |
32 |
- growBuffer(buffer, XML_PARSER_BUFFER_SIZE); |
33 |
+ growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE); |
34 |
} |
35 |
for (;i > 0;i--) |
36 |
buffer[nbchars++] = *cur++; |
37 |
-- |
38 |
cgit v0.9.0.2 |