From 4fefe8247331936729153ea86aaec1fd2453526a Mon Sep 17 00:00:00 2001 From: "@ran-zhao-yu" Date: Thu, 5 Sep 2024 17:25:53 +0800 Subject: [PATCH 1/5] =?UTF-8?q?=E8=93=9D=E9=BB=84=E5=90=8C=E6=AD=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: @ran-zhao-yu --- Fix-CVE-2023-45322-pre-patch.patch | 0 Fix-CVE-2023-45322.patch | 0 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 Fix-CVE-2023-45322-pre-patch.patch create mode 100644 Fix-CVE-2023-45322.patch diff --git a/Fix-CVE-2023-45322-pre-patch.patch b/Fix-CVE-2023-45322-pre-patch.patch new file mode 100644 index 0000000..e69de29 diff --git a/Fix-CVE-2023-45322.patch b/Fix-CVE-2023-45322.patch new file mode 100644 index 0000000..e69de29 -- Gitee From ae5f4a47e37d6953d4e5afc2fcc4b5ce9fd03c7f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=89=E5=8F=AC=E5=AE=87?= Date: Thu, 5 Sep 2024 09:29:16 +0000 Subject: [PATCH 2/5] update Fix-CVE-2023-45322-pre-patch.patch. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 冉召宇 --- Fix-CVE-2023-45322-pre-patch.patch | 74 ++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/Fix-CVE-2023-45322-pre-patch.patch b/Fix-CVE-2023-45322-pre-patch.patch index e69de29..44cb26b 100644 --- a/Fix-CVE-2023-45322-pre-patch.patch +++ b/Fix-CVE-2023-45322-pre-patch.patch @@ -0,0 +1,74 @@ +From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Wed, 23 Aug 2023 20:24:24 +0200 +Subject: [PATCH] tree: Fix copying of DTDs + +- Don't create multiple DTD nodes. +- Fix UAF if malloc fails. +- Skip DTD nodes if tree module is disabled. + +Fixes #583. +--- + tree.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/tree.c b/tree.c +index 6c8a875b9..02c1b5791 100644 +--- a/tree.c ++++ b/tree.c +@@ -4370,29 +4370,28 @@ xmlNodePtr + xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + xmlNodePtr ret = NULL; + xmlNodePtr p = NULL,q; ++ xmlDtdPtr newSubset = NULL; + + while (node != NULL) { +-#ifdef LIBXML_TREE_ENABLED + if (node->type == XML_DTD_NODE ) { +- if (doc == NULL) { ++#ifdef LIBXML_TREE_ENABLED ++ if ((doc == NULL) || (doc->intSubset != NULL)) { + node = node->next; + continue; + } +- if (doc->intSubset == NULL) { +- q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); +- if (q == NULL) goto error; +- q->doc = doc; +- q->parent = parent; +- doc->intSubset = (xmlDtdPtr) q; +- xmlAddChild(parent, q); +- } else { +- q = (xmlNodePtr) doc->intSubset; +- xmlAddChild(parent, q); +- } +- } else ++ q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); ++ if (q == NULL) goto error; ++ q->doc = doc; ++ q->parent = parent; ++ newSubset = (xmlDtdPtr) q; ++#else ++ node = node->next; ++ continue; + #endif /* LIBXML_TREE_ENABLED */ ++ } else { + q = xmlStaticCopyNode(node, doc, parent, 1); +- if (q == NULL) goto error; ++ if (q == NULL) goto error; ++ } + if (ret == NULL) { + q->prev = NULL; + ret = p = q; +@@ -4404,6 +4403,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + } + node = node->next; + } ++ if (newSubset != NULL) ++ doc->intSubset = newSubset; + return(ret); + error: + xmlFreeNodeList(ret); +-- +GitLab + -- Gitee From a92dc3badb41506a4cfc522d845a058930c3edf0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=89=E5=8F=AC=E5=AE=87?= Date: Thu, 5 Sep 2024 09:29:33 +0000 Subject: [PATCH 3/5] update Fix-CVE-2023-45322-pre-patch.patch. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 冉召宇 --- Fix-CVE-2023-45322-pre-patch.patch | 81 ++++++++++-------------------- 1 file changed, 26 insertions(+), 55 deletions(-) diff --git a/Fix-CVE-2023-45322-pre-patch.patch b/Fix-CVE-2023-45322-pre-patch.patch index 44cb26b..e80a8ea 100644 --- a/Fix-CVE-2023-45322-pre-patch.patch +++ b/Fix-CVE-2023-45322-pre-patch.patch @@ -1,74 +1,45 @@ -From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001 +From a22bd982bf10291deea8ba0c61bf75b898c604ce Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer -Date: Wed, 23 Aug 2023 20:24:24 +0200 -Subject: [PATCH] tree: Fix copying of DTDs +Date: Wed, 2 Nov 2022 15:44:42 +0100 +Subject: [PATCH] malloc-fail: Fix memory leak in xmlStaticCopyNodeList -- Don't create multiple DTD nodes. -- Fix UAF if malloc fails. -- Skip DTD nodes if tree module is disabled. - -Fixes #583. +Found with libFuzzer, see #344. --- - tree.c | 31 ++++++++++++++++--------------- - 1 file changed, 16 insertions(+), 15 deletions(-) + tree.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tree.c b/tree.c -index 6c8a875b9..02c1b5791 100644 +index 507869efe..647288ce3 100644 --- a/tree.c +++ b/tree.c -@@ -4370,29 +4370,28 @@ xmlNodePtr - xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { - xmlNodePtr ret = NULL; - xmlNodePtr p = NULL,q; -+ xmlDtdPtr newSubset = NULL; - - while (node != NULL) { --#ifdef LIBXML_TREE_ENABLED - if (node->type == XML_DTD_NODE ) { -- if (doc == NULL) { -+#ifdef LIBXML_TREE_ENABLED -+ if ((doc == NULL) || (doc->intSubset != NULL)) { - node = node->next; - continue; +@@ -4380,7 +4380,7 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { } -- if (doc->intSubset == NULL) { -- q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); -- if (q == NULL) goto error; -- q->doc = doc; -- q->parent = parent; -- doc->intSubset = (xmlDtdPtr) q; -- xmlAddChild(parent, q); -- } else { -- q = (xmlNodePtr) doc->intSubset; -- xmlAddChild(parent, q); -- } -- } else -+ q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); -+ if (q == NULL) goto error; -+ q->doc = doc; -+ q->parent = parent; -+ newSubset = (xmlDtdPtr) q; -+#else -+ node = node->next; -+ continue; + if (doc->intSubset == NULL) { + q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); +- if (q == NULL) return(NULL); ++ if (q == NULL) goto error; + q->doc = doc; + q->parent = parent; + doc->intSubset = (xmlDtdPtr) q; +@@ -4392,7 +4392,7 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + } else #endif /* LIBXML_TREE_ENABLED */ -+ } else { q = xmlStaticCopyNode(node, doc, parent, 1); -- if (q == NULL) goto error; -+ if (q == NULL) goto error; -+ } +- if (q == NULL) return(NULL); ++ if (q == NULL) goto error; if (ret == NULL) { q->prev = NULL; ret = p = q; -@@ -4404,6 +4403,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { - } +@@ -4405,6 +4405,9 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { node = node->next; } -+ if (newSubset != NULL) -+ doc->intSubset = newSubset; return(ret); - error: - xmlFreeNodeList(ret); ++error: ++ xmlFreeNodeList(ret); ++ return(NULL); + } + + /** -- GitLab -- Gitee From 85acfeb6f4f3508d0e814d22b6df0fb62b096faa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=89=E5=8F=AC=E5=AE=87?= Date: Thu, 5 Sep 2024 09:29:53 +0000 Subject: [PATCH 4/5] update Fix-CVE-2023-45322.patch. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 冉召宇 --- Fix-CVE-2023-45322.patch | 74 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/Fix-CVE-2023-45322.patch b/Fix-CVE-2023-45322.patch index e69de29..44cb26b 100644 --- a/Fix-CVE-2023-45322.patch +++ b/Fix-CVE-2023-45322.patch @@ -0,0 +1,74 @@ +From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Wed, 23 Aug 2023 20:24:24 +0200 +Subject: [PATCH] tree: Fix copying of DTDs + +- Don't create multiple DTD nodes. +- Fix UAF if malloc fails. +- Skip DTD nodes if tree module is disabled. + +Fixes #583. +--- + tree.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/tree.c b/tree.c +index 6c8a875b9..02c1b5791 100644 +--- a/tree.c ++++ b/tree.c +@@ -4370,29 +4370,28 @@ xmlNodePtr + xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + xmlNodePtr ret = NULL; + xmlNodePtr p = NULL,q; ++ xmlDtdPtr newSubset = NULL; + + while (node != NULL) { +-#ifdef LIBXML_TREE_ENABLED + if (node->type == XML_DTD_NODE ) { +- if (doc == NULL) { ++#ifdef LIBXML_TREE_ENABLED ++ if ((doc == NULL) || (doc->intSubset != NULL)) { + node = node->next; + continue; + } +- if (doc->intSubset == NULL) { +- q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); +- if (q == NULL) goto error; +- q->doc = doc; +- q->parent = parent; +- doc->intSubset = (xmlDtdPtr) q; +- xmlAddChild(parent, q); +- } else { +- q = (xmlNodePtr) doc->intSubset; +- xmlAddChild(parent, q); +- } +- } else ++ q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); ++ if (q == NULL) goto error; ++ q->doc = doc; ++ q->parent = parent; ++ newSubset = (xmlDtdPtr) q; ++#else ++ node = node->next; ++ continue; + #endif /* LIBXML_TREE_ENABLED */ ++ } else { + q = xmlStaticCopyNode(node, doc, parent, 1); +- if (q == NULL) goto error; ++ if (q == NULL) goto error; ++ } + if (ret == NULL) { + q->prev = NULL; + ret = p = q; +@@ -4404,6 +4403,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + } + node = node->next; + } ++ if (newSubset != NULL) ++ doc->intSubset = newSubset; + return(ret); + error: + xmlFreeNodeList(ret); +-- +GitLab + -- Gitee From c05cbc2d92d0c37f85d023908a116f61e074a37c Mon Sep 17 00:00:00 2001 From: "@ran-zhao-yu" Date: Thu, 12 Sep 2024 14:46:10 +0800 Subject: [PATCH 5/5] =?UTF-8?q?=E5=BC=80=E5=90=AFCFI=E4=BF=9D=E6=8A=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: @ran-zhao-yu --- BUILD.gn | 1 + 1 file changed, 1 insertion(+) diff --git a/BUILD.gn b/BUILD.gn index a01357c..974ffd0 100755 --- a/BUILD.gn +++ b/BUILD.gn @@ -146,6 +146,7 @@ group("xml2") { } ohos_shared_library("libxml2") { + branch_protector_ret = "pac_ret" output_values = get_target_outputs(":libxml2_install_action") sources = filter_exclude(output_values, [ -- Gitee