7008726 Problem with library/libxml
authorKevin Crowe <Kevin.Crowe@oracle.com>
Thu, 14 Jun 2012 06:17:08 -0700
changeset 868 bb69a554cd60
parent 867 181d993d52cf
child 869 ab908b713ec5
7008726 Problem with library/libxml 7171310 Problem with library/libxml 7150804 Problem with library/libxml
components/libxml2/patches/17.CVE-2010-4008.patch
components/libxml2/patches/18.CVE-2011-3102.patch
components/libxml2/patches/19.CVE-2012-0841.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/libxml2/patches/17.CVE-2010-4008.patch	Thu Jun 14 06:17:08 2012 -0700
@@ -0,0 +1,143 @@
+There are 2 patches in a row to the same section of code here, they are copied/pasted
+directly from:
+http://git.gnome.org/browse/libxml2/patch/?id=91d19754d46acd4a639a8b9e31f50f31c78f8c9c
+http://git.gnome.org/browse/libxml2/patch/?id=ea90b894146030c214a7df6d8375310174f134b9
+--------------------------------------------------------------------------------------
+From 91d19754d46acd4a639a8b9e31f50f31c78f8c9c Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <[email protected]>
+Date: Fri, 15 Oct 2010 12:30:52 +0000
+Subject: Fix the semantic of XPath axis for namespace/attribute context nodes
+
+The processing of namespace and attributes nodes was not compliant
+to the XPath-1.0 specification
+---
+diff --git a/xpath.c b/xpath.c
+index b24ca69..8b77af3 100644
+--- a/xpath.c
++++ b/xpath.c
[email protected]@ -8106,8 +8106,16 @@ xmlXPathNextPrecedingSibling(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
+ xmlNodePtr
+ xmlXPathNextFollowing(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
+     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
+-    if (cur != NULL && cur->children != NULL)
+-        return cur->children ;
++    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
++	(ctxt->context->node->type == XML_NAMESPACE_DECL))
++	return(NULL);
++    if (cur != NULL) {
++        if ((cur->type == XML_ATTRIBUTE_NODE) ||
++            (cur->type == XML_NAMESPACE_DECL))
++            return(NULL);
++        if (cur->children != NULL)
++            return cur->children ;
++    }
+     if (cur == NULL) cur = ctxt->context->node;
+     if (cur == NULL) return(NULL) ; /* ERROR */
+     if (cur->next != NULL) return(cur->next) ;
[email protected]@ -8162,6 +8170,9 @@ xmlNodePtr
+ xmlXPathNextPreceding(xmlXPathParserContextPtr ctxt, xmlNodePtr cur)
+ {
+     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
++    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
++	(ctxt->context->node->type == XML_NAMESPACE_DECL))
++	return(NULL);
+     if (cur == NULL)
+         cur = ctxt->context->node;
+     if (cur == NULL)
[email protected]@ -8203,12 +8214,13 @@ xmlXPathNextPrecedingInternal(xmlXPathParserContextPtr ctxt,
+                               xmlNodePtr cur)
+ {
+     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
++    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
++	(ctxt->context->node->type == XML_NAMESPACE_DECL))
++	return(NULL);
+     if (cur == NULL) {
+         cur = ctxt->context->node;
+         if (cur == NULL)
+             return (NULL);
+-	if (cur->type == XML_NAMESPACE_DECL)
+-	    cur = (xmlNodePtr)((xmlNsPtr)cur)->next;
+         ctxt->ancestor = cur->parent;
+     }
+     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
+--
+cgit v0.9.0.2
+
+From ea90b894146030c214a7df6d8375310174f134b9 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <[email protected]>
+Date: Fri, 22 Oct 2010 13:50:50 +0000
+Subject: Fix a change of semantic on XPath preceding and following axis
+
+This was introduced in the prevous fix, while preceding-sibling and
+following sibling axis are empty for attributes and namespaces,
+preceding and following axis should still work based on the parent
+element. However the parent element is not available for a namespace
+node, so we keep the axis empty in that case.
+---
+diff --git a/xpath.c b/xpath.c
+index 9d47618..3352a5e 100644
+--- a/xpath.c
++++ b/xpath.c
[email protected]@ -8106,17 +8106,17 @@ xmlXPathNextPrecedingSibling(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
+ xmlNodePtr
+ xmlXPathNextFollowing(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
+     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
+-    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
+-	(ctxt->context->node->type == XML_NAMESPACE_DECL))
+-	return(NULL);
+-    if (cur != NULL) {
+-        if ((cur->type == XML_ATTRIBUTE_NODE) ||
+-            (cur->type == XML_NAMESPACE_DECL))
++    if ((cur != NULL) && (cur->type  != XML_ATTRIBUTE_NODE) &&
++        (cur->type != XML_NAMESPACE_DECL) && (cur->children != NULL))
++        return(cur->children);
++
++    if (cur == NULL) {
++        cur = ctxt->context->node;
++        if (cur->type == XML_NAMESPACE_DECL)
+             return(NULL);
+-        if (cur->children != NULL)
+-            return cur->children ;
++        if (cur->type == XML_ATTRIBUTE_NODE)
++            cur = cur->parent;
+     }
+-    if (cur == NULL) cur = ctxt->context->node;
+     if (cur == NULL) return(NULL) ; /* ERROR */
+     if (cur->next != NULL) return(cur->next) ;
+     do {
[email protected]@ -8170,11 +8170,13 @@ xmlNodePtr
+ xmlXPathNextPreceding(xmlXPathParserContextPtr ctxt, xmlNodePtr cur)
+ {
+     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
+-    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
+-	(ctxt->context->node->type == XML_NAMESPACE_DECL))
+-	return(NULL);
+-    if (cur == NULL)
++    if (cur == NULL) {
+         cur = ctxt->context->node;
++        if (cur->type == XML_NAMESPACE_DECL)
++            return(NULL);
++        if (cur->type == XML_ATTRIBUTE_NODE)
++            return(cur->parent);
++    }
+     if (cur == NULL)
+ 	return (NULL);
+     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
[email protected]@ -8214,13 +8216,12 @@ xmlXPathNextPrecedingInternal(xmlXPathParserContextPtr ctxt,
+                               xmlNodePtr cur)
+ {
+     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
+-    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
+-	(ctxt->context->node->type == XML_NAMESPACE_DECL))
+-	return(NULL);
+     if (cur == NULL) {
+         cur = ctxt->context->node;
+         if (cur == NULL)
+             return (NULL);
++        if (cur->type == XML_NAMESPACE_DECL)
++            return (NULL);
+         ctxt->ancestor = cur->parent;
+     }
+     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
+--
+cgit v0.9.0.2
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/libxml2/patches/18.CVE-2011-3102.patch	Thu Jun 14 06:17:08 2012 -0700
@@ -0,0 +1,42 @@
+This patch copied/pasted from this link:
+http://git.gnome.org/browse/libxml2/patch/?id=d8e1faeaa99c7a7c07af01c1c72de352eb590a3e
+----------------------------------------------------------------------
+From d8e1faeaa99c7a7c07af01c1c72de352eb590a3e Mon Sep 17 00:00:00 2001
+From: Jüri Aedla <[email protected]>
+Date: Mon, 07 May 2012 07:06:56 +0000
+Subject: Fix an off by one pointer access
+
+getting out of the range of memory allocated for xpointer decoding
+---
+diff --git a/xpointer.c b/xpointer.c
+index 37afa3a..0b463dd 100644
+--- a/xpointer.c
++++ b/xpointer.c
[email protected]@ -1007,21 +1007,14 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) {
+ 		NEXT;
+ 		break;
+ 	    }
+-	    *cur++ = CUR;
+ 	} else if (CUR == '(') {
+ 	    level++;
+-	    *cur++ = CUR;
+ 	} else if (CUR == '^') {
+-	    NEXT;
+-	    if ((CUR == ')') || (CUR == '(') || (CUR == '^')) {
+-		*cur++ = CUR;
+-	    } else {
+-		*cur++ = '^';
+-		*cur++ = CUR;
+-	    }
+-	} else {
+-	    *cur++ = CUR;
++            if ((NXT(1) == ')') || (NXT(1) == '(') || (NXT(1) == '^')) {
++                NEXT;
++            }
+ 	}
++        *cur++ = CUR;
+ 	NEXT;
+     }
+     *cur = 0;
+--
+cgit v0.9.0.2
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/libxml2/patches/19.CVE-2012-0841.patch	Thu Jun 14 06:17:08 2012 -0700
@@ -0,0 +1,294 @@
+This patch copied/pasted from this link:
+http://git.gnome.org/browse/libxml2/patch/?id=8973d58b7498fa5100a876815476b81fd1a2412a
+----------------------------------------------------------------------
+From 8973d58b7498fa5100a876815476b81fd1a2412a Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <[email protected]>
+Date: Sat, 04 Feb 2012 11:07:44 +0000
+Subject: Add hash randomization to hash and dict structures
+
+Following http://www.ocert.org/advisories/ocert-2011-003.html
+it seems that having hash randomization might be a good idea
+when using XML with untrusted data
+* configure.in: lookup for rand, srand and time
+* dict.c: add randomization to dictionaries hash tables
+* hash.c: add randomization to normal hash tables
+---
+diff --git a/configure.in b/configure.in
+index fa80375..828b66a 100644
+--- a/configure.in
++++ b/configure.in
[email protected]@ -512,6 +512,7 @@ AC_CHECK_FUNCS(strdup strndup strerror)
+ AC_CHECK_FUNCS(finite isnand fp_class class fpclass)
+ AC_CHECK_FUNCS(strftime localtime gettimeofday ftime)
+ AC_CHECK_FUNCS(stat _stat signal)
++AC_CHECK_FUNCS(rand srand time)
+ 
+ dnl Checking the standard string functions availability
+ AC_CHECK_FUNCS(printf sprintf fprintf snprintf vfprintf vsprintf vsnprintf sscanf,,
+diff --git a/dict.c b/dict.c
+index 3eff231..ae4966b 100644
+--- a/dict.c
++++ b/dict.c
[email protected]@ -2,7 +2,7 @@
+  * dict.c: dictionary of reusable strings, just used to avoid allocation
+  *         and freeing operations.
+  *
+- * Copyright (C) 2003 Daniel Veillard.
++ * Copyright (C) 2003-2012 Daniel Veillard.
+  *
+  * Permission to use, copy, modify, and distribute this software for any
+  * purpose with or without fee is hereby granted, provided that the above
[email protected]@ -19,6 +19,28 @@
+ #define IN_LIBXML
+ #include "libxml.h"
+ 
++#ifdef HAVE_STDLIB_H
++#include <stdlib.h>
++#endif
++#ifdef HAVE_TIME_H
++#include <time.h>
++#endif
++
++/*
++ * Following http://www.ocert.org/advisories/ocert-2011-003.html
++ * it seems that having hash randomization might be a good idea
++ * when using XML with untrusted data
++ * Note1: that it works correctly only if compiled with WITH_BIG_KEY
++ *  which is the default.
++ * Note2: the fast function used for a small dict won't protect very
++ *  well but since the attack is based on growing a very big hash
++ *  list we will use the BigKey algo as soon as the hash size grows
++ *  over MIN_DICT_SIZE so this actually works
++ */
++#if defined(HAVE_RAND) && defined(HAVE_SRAND) && defined(HAVE_TIME)
++#define DICT_RANDOMIZATION
++#endif
++
+ #include <string.h>
+ #ifdef HAVE_STDINT_H
+ #include <stdint.h>
[email protected]@ -44,23 +66,23 @@ typedef unsigned __int32 uint32_t;
+ #define WITH_BIG_KEY
+ 
+ #ifdef WITH_BIG_KEY
+-#define xmlDictComputeKey(dict, name, len)			\
+-    (((dict)->size == MIN_DICT_SIZE) ?				\
+-     xmlDictComputeFastKey(name, len) :				\
+-     xmlDictComputeBigKey(name, len))
+-
+-#define xmlDictComputeQKey(dict, prefix, plen, name, len)	\
+-    (((prefix) == NULL) ?					\
+-      (xmlDictComputeKey(dict, name, len)) :			\
+-      (((dict)->size == MIN_DICT_SIZE) ?			\
+-       xmlDictComputeFastQKey(prefix, plen, name, len) :	\
+-       xmlDictComputeBigQKey(prefix, plen, name, len)))
++#define xmlDictComputeKey(dict, name, len)                              \
++    (((dict)->size == MIN_DICT_SIZE) ?                                  \
++     xmlDictComputeFastKey(name, len, (dict)->seed) :                   \
++     xmlDictComputeBigKey(name, len, (dict)->seed))
++
++#define xmlDictComputeQKey(dict, prefix, plen, name, len)               \
++    (((prefix) == NULL) ?                                               \
++      (xmlDictComputeKey(dict, name, len)) :                             \
++      (((dict)->size == MIN_DICT_SIZE) ?                                \
++       xmlDictComputeFastQKey(prefix, plen, name, len, (dict)->seed) :	\
++       xmlDictComputeBigQKey(prefix, plen, name, len, (dict)->seed)))
+ 
+ #else /* !WITH_BIG_KEY */
+-#define xmlDictComputeKey(dict, name, len)			\
+-        xmlDictComputeFastKey(name, len)
+-#define xmlDictComputeQKey(dict, prefix, plen, name, len)	\
+-        xmlDictComputeFastQKey(prefix, plen, name, len)
++#define xmlDictComputeKey(dict, name, len)                              \
++        xmlDictComputeFastKey(name, len, (dict)->seed)
++#define xmlDictComputeQKey(dict, prefix, plen, name, len)               \
++        xmlDictComputeFastQKey(prefix, plen, name, len, (dict)->seed)
+ #endif /* WITH_BIG_KEY */
+ 
+ /*
[email protected]@ -98,6 +120,8 @@ struct _xmlDict {
+     xmlDictStringsPtr strings;
+ 
+     struct _xmlDict *subdict;
++    /* used for randomization */
++    int seed;
+ };
+ 
+ /*
[email protected]@ -125,6 +149,9 @@ static int xmlInitializeDict(void) {
+     if ((xmlDictMutex = xmlNewRMutex()) == NULL)
+         return(0);
+ 
++#ifdef DICT_RANDOMIZATION
++    srand(time(NULL));
++#endif
+     xmlDictInitialized = 1;
+     return(1);
+ }
[email protected]@ -277,13 +304,13 @@ found_pool:
+  */
+ 
+ static uint32_t
+-xmlDictComputeBigKey(const xmlChar* data, int namelen) {
++xmlDictComputeBigKey(const xmlChar* data, int namelen, int seed) {
+     uint32_t hash;
+     int i;
+ 
+     if (namelen <= 0 || data == NULL) return(0);
+ 
+-    hash = 0;
++    hash = seed;
+ 
+     for (i = 0;i < namelen; i++) {
+         hash += data[i];
[email protected]@ -310,12 +337,12 @@ xmlDictComputeBigKey(const xmlChar* data, int namelen) {
+  */
+ static unsigned long
+ xmlDictComputeBigQKey(const xmlChar *prefix, int plen,
+-                      const xmlChar *name, int len)
++                      const xmlChar *name, int len, int seed)
+ {
+     uint32_t hash;
+     int i;
+ 
+-    hash = 0;
++    hash = seed;
+ 
+     for (i = 0;i < plen; i++) {
+         hash += prefix[i];
[email protected]@ -346,8 +373,8 @@ xmlDictComputeBigQKey(const xmlChar *prefix, int plen,
+  * for low hash table fill.
+  */
+ static unsigned long
+-xmlDictComputeFastKey(const xmlChar *name, int namelen) {
+-    unsigned long value = 0L;
++xmlDictComputeFastKey(const xmlChar *name, int namelen, int seed) {
++    unsigned long value = seed;
+ 
+     if (name == NULL) return(0);
+     value = *name;
[email protected]@ -381,9 +408,9 @@ xmlDictComputeFastKey(const xmlChar *name, int namelen) {
+  */
+ static unsigned long
+ xmlDictComputeFastQKey(const xmlChar *prefix, int plen,
+-                       const xmlChar *name, int len)
++                       const xmlChar *name, int len, int seed)
+ {
+-    unsigned long value = 0L;
++    unsigned long value = (unsigned long) seed;
+ 
+     if (plen == 0)
+ 	value += 30 * (unsigned long) ':';
[email protected]@ -460,6 +487,11 @@ xmlDictCreate(void) {
+ 	dict->subdict = NULL;
+         if (dict->dict) {
+ 	    memset(dict->dict, 0, MIN_DICT_SIZE * sizeof(xmlDictEntry));
++#ifdef DICT_RANDOMIZATION
++            dict->seed = rand();
++#else
++            dict->seed = 0;
++#endif
+ 	    return(dict);
+         }
+         xmlFree(dict);
[email protected]@ -486,6 +518,7 @@ xmlDictCreateSub(xmlDictPtr sub) {
+ #ifdef DICT_DEBUG_PATTERNS
+         fprintf(stderr, "R");
+ #endif
++        dict->seed = sub->seed;
+         dict->subdict = sub;
+ 	xmlDictReference(dict->subdict);
+     }
+diff --git a/hash.c b/hash.c
+index b78bc2d..fe1424f 100644
+--- a/hash.c
++++ b/hash.c
[email protected]@ -3,7 +3,7 @@
+  *
+  * Reference: Your favorite introductory book on algorithms
+  *
+- * Copyright (C) 2000 Bjorn Reese and Daniel Veillard.
++ * Copyright (C) 2000,2012 Bjorn Reese and Daniel Veillard.
+  *
+  * Permission to use, copy, modify, and distribute this software for any
+  * purpose with or without fee is hereby granted, provided that the above
[email protected]@ -21,6 +21,22 @@
+ #include "libxml.h"
+ 
+ #include <string.h>
++#ifdef HAVE_STDLIB_H
++#include <stdlib.h>
++#endif
++#ifdef HAVE_TIME_H
++#include <time.h>
++#endif
++
++/*
++ * Following http://www.ocert.org/advisories/ocert-2011-003.html
++ * it seems that having hash randomization might be a good idea
++ * when using XML with untrusted data
++ */
++#if defined(HAVE_RAND) && defined(HAVE_SRAND) && defined(HAVE_TIME)
++#define HASH_RANDOMIZATION
++#endif
++
+ #include <libxml/parser.h>
+ #include <libxml/hash.h>
+ #include <libxml/xmlmemory.h>
[email protected]@ -31,6 +47,10 @@
+ 
+ /* #define DEBUG_GROW */
+ 
++#ifdef HASH_RANDOMIZATION
++static int hash_initialized = 0;
++#endif
++
+ /*
+  * A single entry in the hash table
+  */
[email protected]@ -53,6 +73,9 @@ struct _xmlHashTable {
+     int size;
+     int nbElems;
+     xmlDictPtr dict;
++#ifdef HASH_RANDOMIZATION
++    int random_seed;
++#endif
+ };
+ 
+ /*
[email protected]@ -65,6 +88,9 @@ xmlHashComputeKey(xmlHashTablePtr table, const xmlChar *name,
+     unsigned long value = 0L;
+     char ch;
+     
++#ifdef HASH_RANDOMIZATION
++    value = table->random_seed;
++#endif
+     if (name != NULL) {
+ 	value += 30 * (*name);
+ 	while ((ch = *name++) != 0) {
[email protected]@ -92,6 +118,9 @@ xmlHashComputeQKey(xmlHashTablePtr table,
+     unsigned long value = 0L;
+     char ch;
+     
++#ifdef HASH_RANDOMIZATION
++    value = table->random_seed;
++#endif
+     if (prefix != NULL)
+ 	value += 30 * (*prefix);
+     else
[email protected]@ -156,6 +185,13 @@ xmlHashCreate(int size) {
+         table->table = xmlMalloc(size * sizeof(xmlHashEntry));
+         if (table->table) {
+   	    memset(table->table, 0, size * sizeof(xmlHashEntry));
++#ifdef HASH_RANDOMIZATION
++            if (!hash_initialized) {
++                srand(time(NULL));
++                hash_initialized = 1;
++            }
++            table->random_seed = rand();
++#endif
+   	    return(table);
+         }
+         xmlFree(table);
+--
+cgit v0.9.0.2