diff --git a/fix-CVE-2020-12825.patch b/backport-CVE-2020-12825-parser-limit-recursion-in-block-and-any-productions.patch similarity index 40% rename from fix-CVE-2020-12825.patch rename to backport-CVE-2020-12825-parser-limit-recursion-in-block-and-any-productions.patch index 135a21313720071b156decf57f2fce17ab29a9fe..23da10093d109f3464a9735ce78b84c570a34d45 100644 --- a/fix-CVE-2020-12825.patch +++ b/backport-CVE-2020-12825-parser-limit-recursion-in-block-and-any-productions.patch @@ -1,61 +1,125 @@ -From d436207c21d5ce6c5b8f631057b2cce2b37a5981 Mon Sep 17 00:00:00 2001 -From: pengyeqing -Date: Wed, 10 Jun 2020 08:10:32 -0400 -Subject: [PATCH] libcroco: fix CVE-2020-12825 +From 6eb257e5c731c691eb137fca94e916ca73941a5a Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro +Date: Fri, 31 Jul 2020 15:21:53 -0500 +Subject: [PATCH] parser: limit recursion in block and any productions -reason: fix CVE-2020-12825. +If we don't have any limits, we can recurse forever and overflow the +stack. -Signed-off-by: pengyeqing +Fixes #8 --- - src/cr-parser.c | 54 ++++++++++++++++++++++++++++++++++++++++--------- - 1 file changed, 44 insertions(+), 10 deletions(-) + src/cr-parser.c | 44 +++++++++++++++++++++++++++++--------------- + 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/src/cr-parser.c b/src/cr-parser.c -index 18c9a01..76f8397 100644 +index 18c9a01..f4a62e3 100644 --- a/src/cr-parser.c +++ b/src/cr-parser.c -@@ -344,7 +344,7 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); - +@@ -136,6 +136,8 @@ struct _CRParserPriv { + + #define CHARS_TAB_SIZE 12 + ++#define RECURSIVE_CALLERS_LIMIT 100 ++ + /** + * IS_NUM: + *@a_char: the char to test. +@@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); + static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); - + -static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); -+static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, unsigned int call_cnt); - - static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); - -@@ -784,7 +784,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) ++static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, ++ guint n_calls); + +-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); ++static enum CRStatus cr_parser_parse_block_core (CRParser * a_this, ++ guint n_calls); + + static enum CRStatus cr_parser_parse_value_core (CRParser * a_this); + +@@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) cr_parser_try_to_skip_spaces_and_comments (a_this); - + do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); } while (status == CR_OK); - + status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, -@@ -930,11 +930,11 @@ cr_parser_parse_selector_core (CRParser * a_this) - +@@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) + cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, + token); + token = NULL; +- status = cr_parser_parse_block_core (a_this); ++ status = cr_parser_parse_block_core (a_this, 0); + CHECK_PARSING_STATUS (status, + FALSE); + goto done; +@@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this) + RECORD_INITIAL_POS (a_this, &init_pos); - + - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); CHECK_PARSING_STATUS (status, FALSE); - + do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); - + } while (status == CR_OK); - -@@ -1002,7 +1002,7 @@ cr_parser_parse_block_core (CRParser * a_this) + +@@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this) + *in chapter 4.1 of the css2 spec. + *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*; + *@param a_this the current instance of #CRParser. ++ *@param n_calls used to limit recursion depth + *FIXME: code this function. + */ + static enum CRStatus +-cr_parser_parse_block_core (CRParser * a_this) ++cr_parser_parse_block_core (CRParser * a_this, ++ guint n_calls) + { + CRToken *token = NULL; + CRInputPos init_pos; +@@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this) + + g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR); + ++ if (n_calls > RECURSIVE_CALLERS_LIMIT) ++ return CR_ERROR; ++ + RECORD_INITIAL_POS (a_this, &init_pos); + + status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token); +@@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this) + } else if (token->type == CBO_TK) { + cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); + token = NULL; +- status = cr_parser_parse_block_core (a_this); ++ status = cr_parser_parse_block_core (a_this, n_calls + 1); + CHECK_PARSING_STATUS (status, FALSE); + goto parse_block_content; } else { cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, 0); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); CHECK_PARSING_STATUS (status, FALSE); goto parse_block_content; } -@@ -1123,7 +1123,7 @@ cr_parser_parse_value_core (CRParser * a_this) +@@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this) + status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, + token); + token = NULL; +- status = cr_parser_parse_block_core (a_this); ++ status = cr_parser_parse_block_core (a_this, 0); + CHECK_PARSING_STATUS (status, FALSE); + ref++; + goto continue_parsing; +@@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this) status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; @@ -64,88 +128,57 @@ index 18c9a01..76f8397 100644 if (status == CR_OK) { ref++; goto continue_parsing; -@@ -1154,6 +1154,33 @@ cr_parser_parse_value_core (CRParser * a_this) - return status; - } - -+#define DEFAULT_RECURSE_LAYERS_LIMIT 10000 -+static unsigned int recurse_layers_limit = DEFAULT_RECURSE_LAYERS_LIMIT; -+ -+/* finish the initial of recurse_layers_limit before main start. */ -+static void __attribute__ ((constructor)) init_recurse_layers_limit(void) -+{ -+ int value; -+ char *limit; -+ -+ limit = getenv("LIBCROCO_RECURSE_LAYERS_LIMIT"); -+ if ((limit == NULL) || (limit[0] == '\0')) { -+ recurse_layers_limit = DEFAULT_RECURSE_LAYERS_LIMIT; -+ return; -+ } -+ -+ /* the user confirm the input string */ -+ value = atoi(limit); -+ if (value > 0) -+ recurse_layers_limit = value; -+ else if (value == 0) -+ recurse_layers_limit = 0xffffffff; -+ else -+ recurse_layers_limit = DEFAULT_RECURSE_LAYERS_LIMIT; -+ -+ return; -+} -+ - /** - *Parses an "any" as defined by the css core grammar in the - *css2 spec in chapter 4.1. -@@ -1165,13 +1192,20 @@ cr_parser_parse_value_core (CRParser * a_this) +@@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this) + * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*; + * + *@param a_this the current instance of #CRParser. ++ *@param n_calls used to limit recursion depth *@return CR_OK upon successfull completion, an error code otherwise. */ static enum CRStatus -cr_parser_parse_any_core (CRParser * a_this) -+cr_parser_parse_any_core (CRParser * a_this, unsigned int call_cnt) ++cr_parser_parse_any_core (CRParser * a_this, ++ guint n_calls) { CRToken *token1 = NULL, *token2 = NULL; - CRInputPos init_pos; - enum CRStatus status = CR_ERROR; - -+ call_cnt += 1; -+ if (call_cnt > recurse_layers_limit) { -+ g_printerr ("recurse layers limit to %d to avoid stack overflow!\n" -+ "you can set limit by LIBCROCO_RECURSE_LAYERS_LIMIT.\n", recurse_layers_limit); -+ return CR_ERROR; -+ } -+ +@@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this) + g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); - + ++ if (n_calls > RECURSIVE_CALLERS_LIMIT) ++ return CR_ERROR; ++ RECORD_INITIAL_POS (a_this, &init_pos); -@@ -1212,7 +1246,7 @@ cr_parser_parse_any_core (CRParser * a_this) + + status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1); +@@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this) *We consider parameter as being an "any*" production. */ do { - status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, call_cnt); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); - + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); -@@ -1237,7 +1271,7 @@ cr_parser_parse_any_core (CRParser * a_this) +@@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this) } - + do { - status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, call_cnt); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); - + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); -@@ -1265,7 +1299,7 @@ cr_parser_parse_any_core (CRParser * a_this) +@@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this) } - + do { - status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, call_cnt); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); - + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); -- -2.18.1 +1.8.3.1 + diff --git a/libcroco.spec b/libcroco.spec index 4016bfffce340601d81d0939d2970b73f7f691c9..a0e5639e4975e62f744e5808708194fbb8328175 100644 --- a/libcroco.spec +++ b/libcroco.spec @@ -1,13 +1,13 @@ Name: libcroco Version: 0.6.13 -Release: 1 +Release: 2 Summary: A CSS parsing library License: LGPLv2 URL: https://github.com/GNOME/libcroco Source0: https://github.com/GNOME/libcroco/archive/%{name}-%{version}.tar.gz Patch0: CVE-2017-8834_CVE-2017-8871.patch -Patch1: fix-CVE-2020-12825.patch +Patch1: backport-CVE-2020-12825-parser-limit-recursion-in-block-and-any-productions.patch BuildRequires: git gcc glib2-devel libxml2-devel pkgconfig gtk-doc libtool @@ -64,6 +64,12 @@ make test %changelog +* Tue Jan 12 2021 zoulin - 0.6.13-2 +- Type:CVE +- CVE:CVE-2020-12825 +- SUG:NA +- DESC:Replace the patch of CVE-2020-12825 + * Sat Aug 1 2020 zhangguangzhi - 0.6.13-1 - Type:enhancement - ID:NA