92 lines
3.5 KiB
Diff
92 lines
3.5 KiB
Diff
From b4f018cc0bd225d7ce5388df6d47cced30eca522 Mon Sep 17 00:00:00 2001
|
|
From: tanjinghui1 <tanjinghui1.com>
|
|
Date: Mon, 14 Nov 2022 19:54:53 +0800
|
|
Subject: [PATCH] [Backport] libxml2:Fix dict corruption caused by entity
|
|
CVE: CVE-2022-40304
|
|
Reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b
|
|
---
|
|
entities.c | 57 ++++++++++++++++++---------------------------------------
|
|
1 file changed, 18 insertions(+), 39 deletions(-)
|
|
|
|
diff --git a/entities.c b/entities.c
|
|
index 1a8f86f..7df0051 100644
|
|
--- a/entities.c
|
|
+++ b/entities.c
|
|
@@ -112,36 +112,20 @@ xmlFreeEntity(xmlEntityPtr entity)
|
|
if ((entity->children) && (entity->owner == 1) &&
|
|
(entity == (xmlEntityPtr) entity->children->parent))
|
|
xmlFreeNodeList(entity->children);
|
|
- if (dict != NULL) {
|
|
- if ((entity->name != NULL) && (!xmlDictOwns(dict, entity->name)))
|
|
- xmlFree((char *) entity->name);
|
|
- if ((entity->ExternalID != NULL) &&
|
|
- (!xmlDictOwns(dict, entity->ExternalID)))
|
|
- xmlFree((char *) entity->ExternalID);
|
|
- if ((entity->SystemID != NULL) &&
|
|
- (!xmlDictOwns(dict, entity->SystemID)))
|
|
- xmlFree((char *) entity->SystemID);
|
|
- if ((entity->URI != NULL) && (!xmlDictOwns(dict, entity->URI)))
|
|
- xmlFree((char *) entity->URI);
|
|
- if ((entity->content != NULL)
|
|
- && (!xmlDictOwns(dict, entity->content)))
|
|
- xmlFree((char *) entity->content);
|
|
- if ((entity->orig != NULL) && (!xmlDictOwns(dict, entity->orig)))
|
|
- xmlFree((char *) entity->orig);
|
|
- } else {
|
|
- if (entity->name != NULL)
|
|
- xmlFree((char *) entity->name);
|
|
- if (entity->ExternalID != NULL)
|
|
- xmlFree((char *) entity->ExternalID);
|
|
- if (entity->SystemID != NULL)
|
|
- xmlFree((char *) entity->SystemID);
|
|
- if (entity->URI != NULL)
|
|
- xmlFree((char *) entity->URI);
|
|
- if (entity->content != NULL)
|
|
- xmlFree((char *) entity->content);
|
|
- if (entity->orig != NULL)
|
|
- xmlFree((char *) entity->orig);
|
|
- }
|
|
+ if ((entity->name != NULL) &&
|
|
+ ((dict == NULL) || (!xmlDictOwns(dict, entity->name))))
|
|
+ xmlFree((char *) entity->name);
|
|
+ if (entity->ExternalID != NULL)
|
|
+ xmlFree((char *) entity->ExternalID);
|
|
+ if (entity->SystemID != NULL)
|
|
+ xmlFree((char *) entity->SystemID);
|
|
+ if (entity->URI != NULL)
|
|
+ xmlFree((char *) entity->URI);
|
|
+ if (entity->content != NULL)
|
|
+ xmlFree((char *) entity->content);
|
|
+ if (entity->orig != NULL)
|
|
+ xmlFree((char *) entity->orig);
|
|
+
|
|
xmlFree(entity);
|
|
}
|
|
|
|
@@ -177,18 +161,13 @@ xmlCreateEntity(xmlDictPtr dict, const xmlChar *name, int type,
|
|
ret->SystemID = xmlStrdup(SystemID);
|
|
} else {
|
|
ret->name = xmlDictLookup(dict, name, -1);
|
|
- if (ExternalID != NULL)
|
|
- ret->ExternalID = xmlDictLookup(dict, ExternalID, -1);
|
|
- if (SystemID != NULL)
|
|
- ret->SystemID = xmlDictLookup(dict, SystemID, -1);
|
|
+ ret->ExternalID = xmlStrdup(ExternalID);
|
|
+ ret->SystemID = xmlStrdup(SystemID);
|
|
+
|
|
}
|
|
if (content != NULL) {
|
|
ret->length = xmlStrlen(content);
|
|
- if ((dict != NULL) && (ret->length < 5))
|
|
- ret->content = (xmlChar *)
|
|
- xmlDictLookup(dict, content, ret->length);
|
|
- else
|
|
- ret->content = xmlStrndup(content, ret->length);
|
|
+ ret->content = xmlStrndup(content, ret->length);
|
|
} else {
|
|
ret->length = 0;
|
|
ret->content = NULL;
|
|
--
|
|
2.1.4
|
|
|