[gentoo-commits] gentoo-x86 commit in dev-libs/libxml2/files: libxml2-2.7.8-allocation-error-copying-entities.patch

[Alexandre Rostovtsev (tetromino)]

tetromino    12/01/10 20:29:13

  Added:               
                        libxml2-2.7.8-allocation-error-copying-entities.patch
  Log:
  Fix heap-based overflow in parsing long entity references (CVE-2011-3919, bug #398361, thanks to Agostino Sarubbo for reporting).
  
  (Portage version: 2.2.0_alpha84/cvs/Linux x86_64)

Revision  Changes    Path
1.1                  dev-libs/libxml2/files/libxml2-2.7.8-allocation-error-copying-entities.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libxml2/files/libxml2-2.7.8-allocation-error-copying-entities.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libxml2/files/libxml2-2.7.8-allocation-error-copying-entities.patch?rev=1.1&content-type=text/plain

Index: libxml2-2.7.8-allocation-error-copying-entities.patch
===================================================================
From 5bd3c061823a8499b27422aee04ea20aae24f03e Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@××××××.com>
Date: Fri, 16 Dec 2011 10:53:35 +0000
Subject: Fix an allocation error when copying entities

---
diff --git a/parser.c b/parser.c
index 4e5dcb9..c55e41d 100644
--- a/parser.c
+++ b/parser.c
@@ -2709,7 +2709,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
 
 		buffer[nbchars++] = '&';
 		if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) {
-		    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
+		    growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE);
 		}
 		for (;i > 0;i--)
 		    buffer[nbchars++] = *cur++;
--
cgit v0.9.0.2