diff options
author | Mart Raudsepp <leio@gentoo.org> | 2008-08-22 16:07:50 +0000 |
---|---|---|
committer | Mart Raudsepp <leio@gentoo.org> | 2008-08-22 16:07:50 +0000 |
commit | 9ce663c56dd39a1a3ebacce2224d3bc0f774599a (patch) | |
tree | 31d640ecde16785719b8e59efc248cdd1e3f3b43 /dev-libs/libxml2 | |
parent | Initial commit. Based on ebuild by Michael Stringer in bug #220042 (diff) | |
download | historical-9ce663c56dd39a1a3ebacce2224d3bc0f774599a.tar.gz historical-9ce663c56dd39a1a3ebacce2224d3bc0f774599a.tar.bz2 historical-9ce663c56dd39a1a3ebacce2224d3bc0f774599a.zip |
Security (denial of service) fix - possible recursive evaluation of entities in xmlStringLenDecodeEntities() allowing possible memory and CPU exhaustion (CVE-2008-3281)
Package-Manager: portage-2.2_rc8/cvs/Linux 2.6.26-gentoo x86_64
RepoMan-Options: --force
Diffstat (limited to 'dev-libs/libxml2')
-rw-r--r-- | dev-libs/libxml2/ChangeLog | 10 | ||||
-rw-r--r-- | dev-libs/libxml2/Manifest | 4 | ||||
-rw-r--r-- | dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch | 248 | ||||
-rw-r--r-- | dev-libs/libxml2/libxml2-2.6.32-r1.ebuild | 124 |
4 files changed, 384 insertions, 2 deletions
diff --git a/dev-libs/libxml2/ChangeLog b/dev-libs/libxml2/ChangeLog index d895ebcad49e..337b7672d217 100644 --- a/dev-libs/libxml2/ChangeLog +++ b/dev-libs/libxml2/ChangeLog @@ -1,6 +1,14 @@ # ChangeLog for dev-libs/libxml2 # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.217 2008/08/12 13:26:30 armin76 Exp $ +# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.218 2008/08/22 16:07:50 leio Exp $ + +*libxml2-2.6.32-r1 (22 Aug 2008) + + 22 Aug 2008; Mart Raudsepp <leio@gentoo.org> + +files/libxml2-2.6.32-CVE-2008-3281.patch, +libxml2-2.6.32-r1.ebuild: + Security (denial of service) fix - possible recursive evaluation of + entities in xmlStringLenDecodeEntities() allowing possible memory and CPU + exhaustion (CVE-2008-3281) 12 Aug 2008; Raúl Porcel <armin76@gentoo.org> libxml2-2.6.32.ebuild: alpha/ia64/sparc stable wrt #229709 diff --git a/dev-libs/libxml2/Manifest b/dev-libs/libxml2/Manifest index fef58156a481..d785f9adfc89 100644 --- a/dev-libs/libxml2/Manifest +++ b/dev-libs/libxml2/Manifest @@ -1,4 +1,5 @@ AUX libxml2-2.6.30-CVE-2007-6284.patch 1666 RMD160 5622efd6e110cd9775061c6cb9a581a695221620 SHA1 d7621f294418b2e0a0de4511ac44104a5c0d1004 SHA256 355a7f82b1233fcf08c0071ecb82c314117768863b47f308a95ba7ed5f0760ad +AUX libxml2-2.6.32-CVE-2008-3281.patch 8421 RMD160 509892d073b24176efee24ff63cbd18a58ddc576 SHA1 987f8a1d7a43b3299a9220a4a9f3fbb28c1800f7 SHA256 bdbed471f2c9811516c96b93d4161b1a997901813d6e950808e380d98a95e175 DIST libxml2-2.6.30.tar.gz 4726657 RMD160 8adcca2a60b4e90de898d9710a3a45069b73bbfe SHA1 519701df3a10770980e993336fe19ef7d95b5bba SHA256 877762a0f44785487d747ed7bd3db364ade75943e6d8e9c49fa6340c3833735e DIST libxml2-2.6.31.tar.gz 4734599 RMD160 de231ec47f14ace35c29cf59d650a5611fd6128a SHA1 97233a210425bad96b35e52aa3e0010ac11bbcc9 SHA256 3e7982341bbb1f11d5df344177955769e16b4d271f1f5c271740b3d1fad9bac6 DIST libxml2-2.6.32.tar.gz 4722227 RMD160 edb9c9a813ecb12eb214d1f75d927acb3814831c SHA1 1c465c0ef9d21bb4a7df02d4edfad7dfe1e263df SHA256 1b4428b879afcaae3c2013b21283baad040661fbd502e893e83adc3d15c85d53 @@ -7,6 +8,7 @@ DIST xsts-2004-01-14.tar.gz 2761085 RMD160 faff2d7826e47ae9968564bc83dab1b54c5e4 DIST xsts-2006-11-06.tar.gz 4349266 RMD160 a64caae64dd82c703a94fa63ce1291dc289df376 SHA1 fff51a184bdd310f5b177a87503df2288db83e40 SHA256 542db1d583061f3f713481aab6aa6cb382efec87716d74b94c4a0155981e2d09 EBUILD libxml2-2.6.30-r1.ebuild 3461 RMD160 fc6436cd78c1b7bc61257e3229558fec4ae73dd6 SHA1 e3ac2c25c402ce0be461984a74ed05f8d48ced92 SHA256 25b12e5b7b2af8f0d31b594400e9b6724fb3c9b8ef4561ef49170a61ef0dc55a EBUILD libxml2-2.6.31.ebuild 3562 RMD160 1cb59740978b853d99271ae84bc06a0bd00df765 SHA1 943b3c93b51a22d221432aeb2ffd34852956de96 SHA256 123910a495ec2e34ba4956c01c28f9a69e3aeaea6722b58615eec6b693122157 +EBUILD libxml2-2.6.32-r1.ebuild 3648 RMD160 49e30ea84043d8e0c1f01490d2aa64ef3ad90294 SHA1 565a2c4ac0ab0271dd8d54027ec07e5074125c27 SHA256 01480a9c171102b87c2738ce6b32eef1abbebfed5594b11267ee43a9e18627c8 EBUILD libxml2-2.6.32.ebuild 3563 RMD160 8e3199780fa6001662cc2b78e2b29c56448cb763 SHA1 7527a33cd80123829d1b9bb5fb7d7835a20227e8 SHA256 735b6279bb125d622b3e826f81d7da13b6fc23b85c3284e3ce30bd5922d081f1 -MISC ChangeLog 27618 RMD160 636cc22ff089e830e0ec84a418e7b7f051ed82dc SHA1 b2c316afd1aa5c1a499266cde3c7df76744210ce SHA256 bff5daa3c70fc52d18cdaaae721ec27bfde560916fb4d709f3729c4924fef88e +MISC ChangeLog 27944 RMD160 0075caad0c124ca8fe8fe6943194d777bd225ad4 SHA1 2d354675768f48e1d9a781c38b4ce053d82921e3 SHA256 1726c489dcad7418639ea3b4b312ef04e7cf77e0a2ee53f017b295b9ad51e40c MISC metadata.xml 158 RMD160 c0e2bae8e91bb6be8922bac5e4f597302e06587e SHA1 38f78e9790bcd4382b4a49aa226aa6dda1d3a3d7 SHA256 3a7dbca0fdc557de69783e0663e2d76ddab129ea8a19b2d0ef6d3e5d1b947ce1 diff --git a/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch b/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch new file mode 100644 index 000000000000..2375359edfc3 --- /dev/null +++ b/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch @@ -0,0 +1,248 @@ +Index: libxml2-2.6.32/include/libxml/parser.h +=================================================================== +--- libxml2-2.6.32.orig/include/libxml/parser.h ++++ libxml2-2.6.32/include/libxml/parser.h +@@ -297,6 +297,7 @@ struct _xmlParserCtxt { + */ + xmlError lastError; + xmlParserMode parseMode; /* the parser mode */ ++ unsigned long nbentities; /* number of entities references */ + }; + + /** +Index: libxml2-2.6.32/include/libxml/entities.h +=================================================================== +--- libxml2-2.6.32.orig/include/libxml/entities.h ++++ libxml2-2.6.32/include/libxml/entities.h +@@ -57,6 +57,7 @@ struct _xmlEntity { + const xmlChar *URI; /* the full URI as computed */ + int owner; /* does the entity own the childrens */ + int checked; /* was the entity content checked */ ++ unsigned long nbentities; /* the number of entities references */ + }; + + /* +Index: libxml2-2.6.32/entities.c +=================================================================== +--- libxml2-2.6.32.orig/entities.c ++++ libxml2-2.6.32/entities.c +@@ -31,35 +31,35 @@ static xmlEntity xmlEntityLt = { + NULL, NULL, NULL, NULL, NULL, NULL, + BAD_CAST "<", BAD_CAST "<", 1, + XML_INTERNAL_PREDEFINED_ENTITY, +- NULL, NULL, NULL, NULL, 0, 1 ++ NULL, NULL, NULL, NULL, 0, 1, 0 + }; + static xmlEntity xmlEntityGt = { + NULL, XML_ENTITY_DECL, BAD_CAST "gt", + NULL, NULL, NULL, NULL, NULL, NULL, + BAD_CAST ">", BAD_CAST ">", 1, + XML_INTERNAL_PREDEFINED_ENTITY, +- NULL, NULL, NULL, NULL, 0, 1 ++ NULL, NULL, NULL, NULL, 0, 1, 0 + }; + static xmlEntity xmlEntityAmp = { + NULL, XML_ENTITY_DECL, BAD_CAST "amp", + NULL, NULL, NULL, NULL, NULL, NULL, + BAD_CAST "&", BAD_CAST "&", 1, + XML_INTERNAL_PREDEFINED_ENTITY, +- NULL, NULL, NULL, NULL, 0, 1 ++ NULL, NULL, NULL, NULL, 0, 1, 0 + }; + static xmlEntity xmlEntityQuot = { + NULL, XML_ENTITY_DECL, BAD_CAST "quot", + NULL, NULL, NULL, NULL, NULL, NULL, + BAD_CAST "\"", BAD_CAST "\"", 1, + XML_INTERNAL_PREDEFINED_ENTITY, +- NULL, NULL, NULL, NULL, 0, 1 ++ NULL, NULL, NULL, NULL, 0, 1, 0 + }; + static xmlEntity xmlEntityApos = { + NULL, XML_ENTITY_DECL, BAD_CAST "apos", + NULL, NULL, NULL, NULL, NULL, NULL, + BAD_CAST "'", BAD_CAST "'", 1, + XML_INTERNAL_PREDEFINED_ENTITY, +- NULL, NULL, NULL, NULL, 0, 1 ++ NULL, NULL, NULL, NULL, 0, 1, 0 + }; + + /** +Index: libxml2-2.6.32/parserInternals.c +=================================================================== +--- libxml2-2.6.32.orig/parserInternals.c ++++ libxml2-2.6.32/parserInternals.c +@@ -1669,6 +1669,7 @@ xmlInitParserCtxt(xmlParserCtxtPtr ctxt) + ctxt->depth = 0; + ctxt->charset = XML_CHAR_ENCODING_UTF8; + ctxt->catalogs = NULL; ++ ctxt->nbentities = 0; + xmlInitNodeInfoSeq(&ctxt->node_seq); + return(0); + } +Index: libxml2-2.6.32/parser.c +=================================================================== +--- libxml2-2.6.32.orig/parser.c ++++ libxml2-2.6.32/parser.c +@@ -2344,7 +2344,7 @@ xmlStringLenDecodeEntities(xmlParserCtxt + return(NULL); + last = str + len; + +- if (ctxt->depth > 40) { ++ if ((ctxt->depth > 40) || (ctxt->nbentities >= 500000)) { + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); + return(NULL); + } +@@ -2382,6 +2382,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt + "String decoding Entity Reference: %.30s\n", + str); + ent = xmlParseStringEntityRef(ctxt, &str); ++ if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ++ goto int_error; ++ ctxt->nbentities++; ++ if (ent != NULL) ++ ctxt->nbentities += ent->nbentities; + if ((ent != NULL) && + (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) { + if (ent->content != NULL) { +@@ -2427,6 +2432,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt + xmlGenericError(xmlGenericErrorContext, + "String decoding PE Reference: %.30s\n", str); + ent = xmlParseStringPEReference(ctxt, &str); ++ if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ++ goto int_error; ++ ctxt->nbentities++; ++ if (ent != NULL) ++ ctxt->nbentities += ent->nbentities; + if (ent != NULL) { + if (ent->content == NULL) { + if (xmlLoadEntityContent(ctxt, ent) < 0) { +@@ -2466,6 +2476,7 @@ xmlStringLenDecodeEntities(xmlParserCtxt + + mem_error: + xmlErrMemory(ctxt, NULL); ++int_error: + if (rep != NULL) + xmlFree(rep); + if (buffer != NULL) +@@ -3280,6 +3291,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr + } + } else { + ent = xmlParseEntityRef(ctxt); ++ ctxt->nbentities++; ++ if (ent != NULL) ++ ctxt->nbentities += ent->nbentities; + if ((ent != NULL) && + (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) { + if (len > buf_size - 10) { +@@ -4566,6 +4580,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt + int isParameter = 0; + xmlChar *orig = NULL; + int skipped; ++ unsigned long oldnbent = ctxt->nbentities; + + /* GROW; done in the caller */ + if (CMP8(CUR_PTR, '<', '!', 'E', 'N', 'T', 'I', 'T', 'Y')) { +@@ -4783,6 +4798,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt + } + } + if (cur != NULL) { ++ cur->nbentities = ctxt->nbentities - oldnbent; + if (cur->orig != NULL) + xmlFree(orig); + else +@@ -6189,6 +6205,11 @@ xmlParseReference(xmlParserCtxtPtr ctxt) + if (ent == NULL) return; + if (!ctxt->wellFormed) + return; ++ ctxt->nbentities++; ++ if (ctxt->nbentities >= 500000) { ++ xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); ++ return; ++ } + was_checked = ent->checked; + if ((ent->name != NULL) && + (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY)) { +@@ -6249,6 +6270,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) + xmlFreeNodeList(list); + } + } else { ++ unsigned long oldnbent = ctxt->nbentities; + /* + * 4.3.2: An internal general parsed entity is well-formed + * if its replacement text matches the production labeled +@@ -6271,6 +6293,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) + ret = xmlParseBalancedChunkMemoryInternal(ctxt, + value, user_data, &list); + ctxt->depth--; ++ + } else if (ent->etype == + XML_EXTERNAL_GENERAL_PARSED_ENTITY) { + ctxt->depth++; +@@ -6283,6 +6306,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) + xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR, + "invalid entity type found\n", NULL); + } ++ ent->nbentities = ctxt->nbentities - oldnbent; + if (ret == XML_ERR_ENTITY_LOOP) { + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); + return; +@@ -6341,6 +6365,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) + } + ent->checked = 1; + } ++ ctxt->nbentities += ent->nbentities; + + if (ent->children == NULL) { + /* +@@ -11480,7 +11505,7 @@ xmlParseCtxtExternalEntity(xmlParserCtxt + + if (ctx == NULL) return(-1); + +- if (ctx->depth > 40) { ++ if ((ctx->depth > 40) || (ctx->nbentities >= 500000)) { + return(XML_ERR_ENTITY_LOOP); + } + +@@ -11681,7 +11706,8 @@ xmlParseExternalEntityPrivate(xmlDocPtr + xmlChar start[4]; + xmlCharEncoding enc; + +- if (depth > 40) { ++ if ((depth > 40) || ++ ((oldctxt != NULL) && (oldctxt->nbentities >= 500000))) { + return(XML_ERR_ENTITY_LOOP); + } + +@@ -11824,6 +11850,7 @@ xmlParseExternalEntityPrivate(xmlDocPtr + oldctxt->node_seq.maximum = ctxt->node_seq.maximum; + oldctxt->node_seq.length = ctxt->node_seq.length; + oldctxt->node_seq.buffer = ctxt->node_seq.buffer; ++ oldctxt->nbentities += ctxt->nbentities; + ctxt->node_seq.maximum = 0; + ctxt->node_seq.length = 0; + ctxt->node_seq.buffer = NULL; +@@ -11924,7 +11951,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP + int size; + xmlParserErrors ret = XML_ERR_OK; + +- if (oldctxt->depth > 40) { ++ if ((oldctxt->depth > 40) || (oldctxt->nbentities >= 500000)) { + return(XML_ERR_ENTITY_LOOP); + } + +@@ -12048,6 +12075,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP + ctxt->myDoc->last = last; + } + ++ oldctxt->nbentities += ctxt->nbentities; + ctxt->sax = oldsax; + ctxt->dict = NULL; + ctxt->attsDefault = NULL; +@@ -13363,6 +13391,7 @@ xmlCtxtReset(xmlParserCtxtPtr ctxt) + ctxt->depth = 0; + ctxt->charset = XML_CHAR_ENCODING_UTF8; + ctxt->catalogs = NULL; ++ ctxt->nbentities = 0; + xmlInitNodeInfoSeq(&ctxt->node_seq); + + if (ctxt->attsDefault != NULL) { diff --git a/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild b/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild new file mode 100644 index 000000000000..c98d465dbd0c --- /dev/null +++ b/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild @@ -0,0 +1,124 @@ +# Copyright 1999-2008 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild,v 1.1 2008/08/22 16:07:50 leio Exp $ + +inherit libtool flag-o-matic eutils + +DESCRIPTION="Version 2 of the library to manipulate XML files" +HOMEPAGE="http://www.xmlsoft.org/" + +LICENSE="MIT" +SLOT="2" +KEYWORDS="alpha amd64 ~arm hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc ~sparc-fbsd x86 ~x86-fbsd" +IUSE="bootstrap build debug doc examples ipv6 python readline test" + +XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite" +XSTS_NAME_1="xmlschema2002-01-16" +XSTS_NAME_2="xmlschema2004-01-14" +XSTS_TARBALL_1="xsts-2002-01-16.tar.gz" +XSTS_TARBALL_2="xsts-2004-01-14.tar.gz" + +SRC_URI="ftp://xmlsoft.org/${PN}/${P}.tar.gz + test? ( + ${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1} + ${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2} )" + +RDEPEND="sys-libs/zlib + python? ( dev-lang/python ) + readline? ( sys-libs/readline )" + +DEPEND="${RDEPEND} + hppa? ( >=sys-devel/binutils-2.15.92.0.2 )" + +src_unpack() { + unpack ${P}.tar.gz + cd "${S}" + + if use test; then + cp "${DISTDIR}/${XSTS_TARBALL_1}" \ + "${DISTDIR}/${XSTS_TARBALL_2}" \ + "${S}"/xstc/ \ + || die "Failed to install test tarballs" + fi + + # Fix infinite recursion, bug #234099 + epatch "${FILESDIR}/${P}-CVE-2008-3281.patch" + + epunt_cxx +} + +src_compile() { + # USE zlib support breaks gnome2 + # (libgnomeprint for instance fails to compile with + # fresh install, and existing) - <azarah@gentoo.org> (22 Dec 2002). + + # The meaning of the 'debug' USE flag does not apply to the --with-debug + # switch (enabling the libxml2 debug module). See bug #100898. + + # --with-mem-debug causes unusual segmentation faults (bug #105120). + + local myconf="--with-zlib \ + $(use_with debug run-debug) \ + $(use_with python) \ + $(use_with readline) \ + $(use_with readline history) \ + $(use_enable ipv6)" + + # Please do not remove, as else we get references to PORTAGE_TMPDIR + # in /usr/lib/python?.?/site-packages/libxml2mod.la among things. + elibtoolize + + # filter seemingly problematic CFLAGS (#26320) + filter-flags -fprefetch-loop-arrays -funroll-loops + + econf $myconf || die "Configuration failed" + + # Patching the Makefiles to respect get_libdir + # Fixes BUG #86766, please keep this. + # Danny van Dyk <kugelfang@gentoo.org> 2005/03/26 + for x in $(find "${S}" -name "Makefile") ; do + sed \ + -e "s|^\(PYTHON_SITE_PACKAGES\ =\ \/usr\/\).*\(\/python.*\)|\1$(get_libdir)\2|g" \ + -i ${x} \ + || die "sed failed" + done + + emake || die "Compilation failed" +} + +src_install() { + emake DESTDIR="${D}" install || die "Installation failed" + + dodoc AUTHORS ChangeLog Copyright NEWS README* TODO* + + if ! use doc; then + rm -rf "${D}"/usr/share/gtk-doc + rm -rf "${D}"/usr/share/doc/${P}/html + fi + + if ! use examples; then + rm -rf "${D}/usr/share/doc/${P}/examples" + rm -rf "${D}/usr/share/doc/${PN}-python-${PV}/examples" + fi +} + +pkg_postinst() { + # We don't want to do the xmlcatalog during stage1, as xmlcatalog will not + # be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887. + if [[ "${ROOT}" != "/" ]] + then + elog "Skipping XML catalog creation for stage building (bug #208887)." + else + # need an XML catalog, so no-one writes to a non-existent one + CATALOG="${ROOT}etc/xml/catalog" + + # we dont want to clobber an existing catalog though, + # only ensure that one is there + # <obz@gentoo.org> + if [ ! -e ${CATALOG} ]; then + [ -d "${ROOT}etc/xml" ] || mkdir -p "${ROOT}etc/xml" + /usr/bin/xmlcatalog --create > ${CATALOG} + einfo "Created XML catalog in ${CATALOG}" + fi + fi +} |