[prev in list] [next in list] [prev in thread] [next in thread]
List: openembedded-core
Subject: [OE-core] [PATCH][langdale] expat: backport the fix for CVE-2022-43680
From: "Ross Burton" <ross.burton () arm ! com>
Date: 2022-10-31 15:20:49
Message-ID: 20221031152049.156881-1-ross.burton () arm ! com
[Download RAW message or body]
Content-Transfer-Encoding: quoted-printable
Signed-off-by: Ross Burton <ross.burton@arm.com>
---
.../expat/expat/CVE-2022-43680.patch | 33 +++++++++++++++++++
meta/recipes-core/expat/expat_2.4.9.bb | 1 +
2 files changed, 34 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2022-43680.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2022-43680.patch \
b/meta/recipes-core/expat/expat/CVE-2022-43680.patch new file mode 100644
index 00000000000..76c55edc768
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2022-43680.patch
@@ -0,0 +1,33 @@
+CVE: CVE-2022-43680
+Upstream-Status: Backport [5290462a7ea1278a8d5c0d5b2860d4e244f997e4]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+From 5290462a7ea1278a8d5c0d5b2860d4e244f997e4 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 20 Sep 2022 02:44:34 +0200
+Subject: [PATCH] lib: Fix overeager DTD destruction in
+ XML_ExternalEntityParserCreate
+
+---
+ expat/lib/xmlparse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index aacd6e7fc..57bf103cc 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1068,6 +1068,14 @@ parserCreate(const XML_Char *encodingName,
+ parserInit(parser, encodingName);
+
+ if (encodingName && ! parser->m_protocolEncodingName) {
++ if (dtd) {
++ // We need to stop the upcoming call to XML_ParserFree from happily
++ // destroying parser->m_dtd because the DTD is shared with the parent
++ // parser and the only guard that keeps XML_ParserFree from destroying
++ // parser->m_dtd is parser->m_isParamEntity but it will be set to
++ // XML_TRUE only later in XML_ExternalEntityParserCreate (or not at all).
++ parser->m_dtd = NULL;
++ }
+ XML_ParserFree(parser);
+ return NULL;
+ }
diff --git a/meta/recipes-core/expat/expat_2.4.9.bb \
b/meta/recipes-core/expat/expat_2.4.9.bb index 9561edd84fc..bad1a96fdee 100644
--- a/meta/recipes-core/expat/expat_2.4.9.bb
+++ b/meta/recipes-core/expat/expat_2.4.9.bb
@@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = \
"file://COPYING;md5=7b3b078238d0901d3b339289117cb7fb" VERSION_TAG = \
"${@d.getVar('PV').replace('.', '_')}"
SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
+ file://CVE-2022-43680.patch \
file://run-ptest \
"
--
2.34.1
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#172321): https://lists.openembedded.org/g/openembedded-core/message/172321
Mute This Topic: https://lists.openembedded.org/mt/94687694/4454766
Group Owner: openembedded-core+owner@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [openembedded-core@marc.info]
-=-=-=-=-=-=-=-=-=-=-=-
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic