diff --git a/fix-CVE-2020-12825.patch b/fix-CVE-2020-12825.patch new file mode 100644 index 0000000000000000000000000000000000000000..135a21313720071b156decf57f2fce17ab29a9fe --- /dev/null +++ b/fix-CVE-2020-12825.patch @@ -0,0 +1,151 @@ +From d436207c21d5ce6c5b8f631057b2cce2b37a5981 Mon Sep 17 00:00:00 2001 +From: pengyeqing +Date: Wed, 10 Jun 2020 08:10:32 -0400 +Subject: [PATCH] libcroco: fix CVE-2020-12825 + +reason: fix CVE-2020-12825. + +Signed-off-by: pengyeqing +--- + src/cr-parser.c | 54 ++++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 44 insertions(+), 10 deletions(-) + +diff --git a/src/cr-parser.c b/src/cr-parser.c +index 18c9a01..76f8397 100644 +--- a/src/cr-parser.c ++++ b/src/cr-parser.c +@@ -344,7 +344,7 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); + + static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); + +-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); ++static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, unsigned int call_cnt); + + static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); + +@@ -784,7 +784,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) + cr_parser_try_to_skip_spaces_and_comments (a_this); + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + } while (status == CR_OK); + + status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, +@@ -930,11 +930,11 @@ cr_parser_parse_selector_core (CRParser * a_this) + + RECORD_INITIAL_POS (a_this, &init_pos); + +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + CHECK_PARSING_STATUS (status, FALSE); + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + + } while (status == CR_OK); + +@@ -1002,7 +1002,7 @@ cr_parser_parse_block_core (CRParser * a_this) + } else { + cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); + token = NULL; +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + CHECK_PARSING_STATUS (status, FALSE); + goto parse_block_content; + } +@@ -1123,7 +1123,7 @@ cr_parser_parse_value_core (CRParser * a_this) + status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, + token); + token = NULL; +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + if (status == CR_OK) { + ref++; + goto continue_parsing; +@@ -1154,6 +1154,33 @@ cr_parser_parse_value_core (CRParser * a_this) + return status; + } + ++#define DEFAULT_RECURSE_LAYERS_LIMIT 10000 ++static unsigned int recurse_layers_limit = DEFAULT_RECURSE_LAYERS_LIMIT; ++ ++/* finish the initial of recurse_layers_limit before main start. */ ++static void __attribute__ ((constructor)) init_recurse_layers_limit(void) ++{ ++ int value; ++ char *limit; ++ ++ limit = getenv("LIBCROCO_RECURSE_LAYERS_LIMIT"); ++ if ((limit == NULL) || (limit[0] == '\0')) { ++ recurse_layers_limit = DEFAULT_RECURSE_LAYERS_LIMIT; ++ return; ++ } ++ ++ /* the user confirm the input string */ ++ value = atoi(limit); ++ if (value > 0) ++ recurse_layers_limit = value; ++ else if (value == 0) ++ recurse_layers_limit = 0xffffffff; ++ else ++ recurse_layers_limit = DEFAULT_RECURSE_LAYERS_LIMIT; ++ ++ return; ++} ++ + /** + *Parses an "any" as defined by the css core grammar in the + *css2 spec in chapter 4.1. +@@ -1165,13 +1192,20 @@ cr_parser_parse_value_core (CRParser * a_this) + *@return CR_OK upon successfull completion, an error code otherwise. + */ + static enum CRStatus +-cr_parser_parse_any_core (CRParser * a_this) ++cr_parser_parse_any_core (CRParser * a_this, unsigned int call_cnt) + { + CRToken *token1 = NULL, + *token2 = NULL; + CRInputPos init_pos; + enum CRStatus status = CR_ERROR; + ++ call_cnt += 1; ++ if (call_cnt > recurse_layers_limit) { ++ g_printerr ("recurse layers limit to %d to avoid stack overflow!\n" ++ "you can set limit by LIBCROCO_RECURSE_LAYERS_LIMIT.\n", recurse_layers_limit); ++ return CR_ERROR; ++ } ++ + g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); + + RECORD_INITIAL_POS (a_this, &init_pos); +@@ -1212,7 +1246,7 @@ cr_parser_parse_any_core (CRParser * a_this) + *We consider parameter as being an "any*" production. + */ + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, call_cnt); + } while (status == CR_OK); + + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); +@@ -1237,7 +1271,7 @@ cr_parser_parse_any_core (CRParser * a_this) + } + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, call_cnt); + } while (status == CR_OK); + + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); +@@ -1265,7 +1299,7 @@ cr_parser_parse_any_core (CRParser * a_this) + } + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, call_cnt); + } while (status == CR_OK); + + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); +-- +2.18.1 diff --git a/libcroco.spec b/libcroco.spec index f0b746463693e98e78992a8c1b75745ba736eba0..1bf1d1ec580836f28400c0cb54dd53e2e72a9f85 100644 --- a/libcroco.spec +++ b/libcroco.spec @@ -1,14 +1,15 @@ Name: libcroco Version: 0.6.12 -Release: 13 +Release: 14 Summary: A CSS parsing library License: LGPLv2 URL: https://github.com/GNOME/libcroco Source0: https://github.com/GNOME/libcroco/archive/%{name}-%{version}.tar.gz -Patch6000: 0002-input-check-end-of-input-before-reading-a-byte.patch -Patch6001: 0004-tknzr-support-only-max-long-rgb-values.patch -Patch6002: CVE-2017-8834_CVE-2017-8871.patch +Patch0000: 0002-input-check-end-of-input-before-reading-a-byte.patch +Patch0001: 0004-tknzr-support-only-max-long-rgb-values.patch +Patch0002: CVE-2017-8834_CVE-2017-8871.patch +Patch0003: fix-CVE-2020-12825.patch BuildRequires: git gcc glib2-devel libxml2-devel pkgconfig gtk-doc libtool @@ -65,6 +66,12 @@ make test %changelog +* Sun Jun 28 2020 wangchen - 0.6.12-14 +- Type:cves +- ID:CVE-2020-12825 +- SUG:NA +- DESC:fix CVE-2020-12825 + * Mon Jan 20 2020 hanxinke - 0.6.12-13 - Type:enhancement - ID:NA