From: Nick Wellnhofer Date: Sat, 3 Jun 2017 02:01:29 +0200 Subject: Fix buffer size checks in xmlSnprintfElementContent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Origin: https://git.gnome.org/browse/libxml2/commit/?id=932cc9896ab41475d4aa429c27d9afd175959d74 Bug: https://bugzilla.gnome.org/show_bug.cgi?id=781333 Bug-Debian: https://bugs.debian.org/863022 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-9047 Bug: https://bugzilla.gnome.org/show_bug.cgi?id=781701 Bug-Debian: https://bugs.debian.org/863021 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-9048 xmlSnprintfElementContent failed to correctly check the available buffer space in two locations. Fixes bug 781333 (CVE-2017-9047) and bug 781701 (CVE-2017-9048). Thanks to Marcel Böhme and Thuan Pham for the report. --- result/valid/781333.xml | 5 +++++ result/valid/781333.xml.err | 3 +++ result/valid/781333.xml.err.rdr | 6 ++++++ test/valid/781333.xml | 4 ++++ valid.c | 20 +++++++++++--------- 5 files changed, 29 insertions(+), 9 deletions(-) create mode 100644 result/valid/781333.xml create mode 100644 result/valid/781333.xml.err create mode 100644 result/valid/781333.xml.err.rdr create mode 100644 test/valid/781333.xml diff --git a/result/valid/781333.xml b/result/valid/781333.xml new file mode 100644 index 00000000..45dc451d --- /dev/null +++ b/result/valid/781333.xml @@ -0,0 +1,5 @@ + + +]> + diff --git a/result/valid/781333.xml.err b/result/valid/781333.xml.err new file mode 100644 index 00000000..b401b49a --- /dev/null +++ b/result/valid/781333.xml.err @@ -0,0 +1,3 @@ +./test/valid/781333.xml:4: element a: validity error : Element a content does not follow the DTD, expecting ( ..., got + + ^ diff --git a/result/valid/781333.xml.err.rdr b/result/valid/781333.xml.err.rdr new file mode 100644 index 00000000..5ff56992 --- /dev/null +++ b/result/valid/781333.xml.err.rdr @@ -0,0 +1,6 @@ +./test/valid/781333.xml:4: element a: validity error : Element a content does not follow the DTD, expecting ( ..., got + + ^ +./test/valid/781333.xml:5: element a: validity error : Element a content does not follow the DTD, Expecting more child + +^ diff --git a/test/valid/781333.xml b/test/valid/781333.xml new file mode 100644 index 00000000..b29e5a68 --- /dev/null +++ b/test/valid/781333.xml @@ -0,0 +1,4 @@ + +]> + diff --git a/valid.c b/valid.c index 19f84b82..9b2df56a 100644 --- a/valid.c +++ b/valid.c @@ -1262,22 +1262,23 @@ xmlSnprintfElementContent(char *buf, int size, xmlElementContentPtr content, int case XML_ELEMENT_CONTENT_PCDATA: strcat(buf, "#PCDATA"); break; - case XML_ELEMENT_CONTENT_ELEMENT: + case XML_ELEMENT_CONTENT_ELEMENT: { + int qnameLen = xmlStrlen(content->name); + + if (content->prefix != NULL) + qnameLen += xmlStrlen(content->prefix) + 1; + if (size - len < qnameLen + 10) { + strcat(buf, " ..."); + return; + } if (content->prefix != NULL) { - if (size - len < xmlStrlen(content->prefix) + 10) { - strcat(buf, " ..."); - return; - } strcat(buf, (char *) content->prefix); strcat(buf, ":"); } - if (size - len < xmlStrlen(content->name) + 10) { - strcat(buf, " ..."); - return; - } if (content->name != NULL) strcat(buf, (char *) content->name); break; + } case XML_ELEMENT_CONTENT_SEQ: if ((content->c1->type == XML_ELEMENT_CONTENT_OR) || (content->c1->type == XML_ELEMENT_CONTENT_SEQ)) @@ -1319,6 +1320,7 @@ xmlSnprintfElementContent(char *buf, int size, xmlElementContentPtr content, int xmlSnprintfElementContent(buf, size, content->c2, 0); break; } + if (size - strlen(buf) <= 2) return; if (englob) strcat(buf, ")"); switch (content->ocur) { -- 2.11.0