Security (denial of service) fix - possible recursive evaluation of entities in xmlStringLenDecodeEntities() allowing possible memory and CPU exhaustion (CVE-2008-3281)

Package-Manager: portage-2.2_rc8/cvs/Linux 2.6.26-gentoo x86_64
RepoMan-Options: --force

4 files changed, 384 insertions, 2 deletions

diff --git a/dev-libs/libxml2/ChangeLog b/dev-libs/libxml2/ChangeLog
index d895ebcad49e..337b7672d217 100644
--- a/dev-libs/libxml2/ChangeLog
+++ b/dev-libs/libxml2/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for dev-libs/libxml2
 # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.217 2008/08/12 13:26:30 armin76 Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.218 2008/08/22 16:07:50 leio Exp $
+
+*libxml2-2.6.32-r1 (22 Aug 2008)
+
+  22 Aug 2008; Mart Raudsepp <leio@gentoo.org>
+  +files/libxml2-2.6.32-CVE-2008-3281.patch, +libxml2-2.6.32-r1.ebuild:
+  Security (denial of service) fix - possible recursive evaluation of
+  entities in xmlStringLenDecodeEntities() allowing possible memory and CPU
+  exhaustion (CVE-2008-3281)
 
   12 Aug 2008; Raúl Porcel <armin76@gentoo.org> libxml2-2.6.32.ebuild:
   alpha/ia64/sparc stable wrt #229709
diff --git a/dev-libs/libxml2/Manifest b/dev-libs/libxml2/Manifest
index fef58156a481..d785f9adfc89 100644
--- a/dev-libs/libxml2/Manifest
+++ b/dev-libs/libxml2/Manifest
@@ -1,4 +1,5 @@
 AUX libxml2-2.6.30-CVE-2007-6284.patch 1666 RMD160 5622efd6e110cd9775061c6cb9a581a695221620 SHA1 d7621f294418b2e0a0de4511ac44104a5c0d1004 SHA256 355a7f82b1233fcf08c0071ecb82c314117768863b47f308a95ba7ed5f0760ad
+AUX libxml2-2.6.32-CVE-2008-3281.patch 8421 RMD160 509892d073b24176efee24ff63cbd18a58ddc576 SHA1 987f8a1d7a43b3299a9220a4a9f3fbb28c1800f7 SHA256 bdbed471f2c9811516c96b93d4161b1a997901813d6e950808e380d98a95e175
 DIST libxml2-2.6.30.tar.gz 4726657 RMD160 8adcca2a60b4e90de898d9710a3a45069b73bbfe SHA1 519701df3a10770980e993336fe19ef7d95b5bba SHA256 877762a0f44785487d747ed7bd3db364ade75943e6d8e9c49fa6340c3833735e
 DIST libxml2-2.6.31.tar.gz 4734599 RMD160 de231ec47f14ace35c29cf59d650a5611fd6128a SHA1 97233a210425bad96b35e52aa3e0010ac11bbcc9 SHA256 3e7982341bbb1f11d5df344177955769e16b4d271f1f5c271740b3d1fad9bac6
 DIST libxml2-2.6.32.tar.gz 4722227 RMD160 edb9c9a813ecb12eb214d1f75d927acb3814831c SHA1 1c465c0ef9d21bb4a7df02d4edfad7dfe1e263df SHA256 1b4428b879afcaae3c2013b21283baad040661fbd502e893e83adc3d15c85d53
@@ -7,6 +8,7 @@ DIST xsts-2004-01-14.tar.gz 2761085 RMD160 faff2d7826e47ae9968564bc83dab1b54c5e4
 DIST xsts-2006-11-06.tar.gz 4349266 RMD160 a64caae64dd82c703a94fa63ce1291dc289df376 SHA1 fff51a184bdd310f5b177a87503df2288db83e40 SHA256 542db1d583061f3f713481aab6aa6cb382efec87716d74b94c4a0155981e2d09
 EBUILD libxml2-2.6.30-r1.ebuild 3461 RMD160 fc6436cd78c1b7bc61257e3229558fec4ae73dd6 SHA1 e3ac2c25c402ce0be461984a74ed05f8d48ced92 SHA256 25b12e5b7b2af8f0d31b594400e9b6724fb3c9b8ef4561ef49170a61ef0dc55a
 EBUILD libxml2-2.6.31.ebuild 3562 RMD160 1cb59740978b853d99271ae84bc06a0bd00df765 SHA1 943b3c93b51a22d221432aeb2ffd34852956de96 SHA256 123910a495ec2e34ba4956c01c28f9a69e3aeaea6722b58615eec6b693122157
+EBUILD libxml2-2.6.32-r1.ebuild 3648 RMD160 49e30ea84043d8e0c1f01490d2aa64ef3ad90294 SHA1 565a2c4ac0ab0271dd8d54027ec07e5074125c27 SHA256 01480a9c171102b87c2738ce6b32eef1abbebfed5594b11267ee43a9e18627c8
 EBUILD libxml2-2.6.32.ebuild 3563 RMD160 8e3199780fa6001662cc2b78e2b29c56448cb763 SHA1 7527a33cd80123829d1b9bb5fb7d7835a20227e8 SHA256 735b6279bb125d622b3e826f81d7da13b6fc23b85c3284e3ce30bd5922d081f1
-MISC ChangeLog 27618 RMD160 636cc22ff089e830e0ec84a418e7b7f051ed82dc SHA1 b2c316afd1aa5c1a499266cde3c7df76744210ce SHA256 bff5daa3c70fc52d18cdaaae721ec27bfde560916fb4d709f3729c4924fef88e
+MISC ChangeLog 27944 RMD160 0075caad0c124ca8fe8fe6943194d777bd225ad4 SHA1 2d354675768f48e1d9a781c38b4ce053d82921e3 SHA256 1726c489dcad7418639ea3b4b312ef04e7cf77e0a2ee53f017b295b9ad51e40c
 MISC metadata.xml 158 RMD160 c0e2bae8e91bb6be8922bac5e4f597302e06587e SHA1 38f78e9790bcd4382b4a49aa226aa6dda1d3a3d7 SHA256 3a7dbca0fdc557de69783e0663e2d76ddab129ea8a19b2d0ef6d3e5d1b947ce1
diff --git a/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch b/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch
new file mode 100644
index 000000000000..2375359edfc3
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch
@@ -0,0 +1,248 @@
+Index: libxml2-2.6.32/include/libxml/parser.h
+===================================================================
+--- libxml2-2.6.32.orig/include/libxml/parser.h
++++ libxml2-2.6.32/include/libxml/parser.h
+@@ -297,6 +297,7 @@ struct _xmlParserCtxt {
+      */
+     xmlError          lastError;
+     xmlParserMode     parseMode;    /* the parser mode */
++    unsigned long    nbentities;    /* number of entities references */
+ };
+ 
+ /**
+Index: libxml2-2.6.32/include/libxml/entities.h
+===================================================================
+--- libxml2-2.6.32.orig/include/libxml/entities.h
++++ libxml2-2.6.32/include/libxml/entities.h
+@@ -57,6 +57,7 @@ struct _xmlEntity {
+     const xmlChar           *URI;	/* the full URI as computed */
+     int                    owner;	/* does the entity own the childrens */
+     int			 checked;	/* was the entity content checked */
++    unsigned long     nbentities;	/* the number of entities references */
+ };
+ 
+ /*
+Index: libxml2-2.6.32/entities.c
+===================================================================
+--- libxml2-2.6.32.orig/entities.c
++++ libxml2-2.6.32/entities.c
+@@ -31,35 +31,35 @@ static xmlEntity xmlEntityLt = {
+     NULL, NULL, NULL, NULL, NULL, NULL, 
+     BAD_CAST "<", BAD_CAST "<", 1,
+     XML_INTERNAL_PREDEFINED_ENTITY,
+-    NULL, NULL, NULL, NULL, 0, 1
++    NULL, NULL, NULL, NULL, 0, 1, 0
+ };
+ static xmlEntity xmlEntityGt = {
+     NULL, XML_ENTITY_DECL, BAD_CAST "gt",
+     NULL, NULL, NULL, NULL, NULL, NULL, 
+     BAD_CAST ">", BAD_CAST ">", 1,
+     XML_INTERNAL_PREDEFINED_ENTITY,
+-    NULL, NULL, NULL, NULL, 0, 1
++    NULL, NULL, NULL, NULL, 0, 1, 0
+ };
+ static xmlEntity xmlEntityAmp = {
+     NULL, XML_ENTITY_DECL, BAD_CAST "amp",
+     NULL, NULL, NULL, NULL, NULL, NULL, 
+     BAD_CAST "&", BAD_CAST "&", 1,
+     XML_INTERNAL_PREDEFINED_ENTITY,
+-    NULL, NULL, NULL, NULL, 0, 1
++    NULL, NULL, NULL, NULL, 0, 1, 0
+ };
+ static xmlEntity xmlEntityQuot = {
+     NULL, XML_ENTITY_DECL, BAD_CAST "quot",
+     NULL, NULL, NULL, NULL, NULL, NULL, 
+     BAD_CAST "\"", BAD_CAST "\"", 1,
+     XML_INTERNAL_PREDEFINED_ENTITY,
+-    NULL, NULL, NULL, NULL, 0, 1
++    NULL, NULL, NULL, NULL, 0, 1, 0
+ };
+ static xmlEntity xmlEntityApos = {
+     NULL, XML_ENTITY_DECL, BAD_CAST "apos",
+     NULL, NULL, NULL, NULL, NULL, NULL, 
+     BAD_CAST "'", BAD_CAST "'", 1,
+     XML_INTERNAL_PREDEFINED_ENTITY,
+-    NULL, NULL, NULL, NULL, 0, 1
++    NULL, NULL, NULL, NULL, 0, 1, 0
+ };
+ 
+ /**
+Index: libxml2-2.6.32/parserInternals.c
+===================================================================
+--- libxml2-2.6.32.orig/parserInternals.c
++++ libxml2-2.6.32/parserInternals.c
+@@ -1669,6 +1669,7 @@ xmlInitParserCtxt(xmlParserCtxtPtr ctxt)
+     ctxt->depth = 0;
+     ctxt->charset = XML_CHAR_ENCODING_UTF8;
+     ctxt->catalogs = NULL;
++    ctxt->nbentities = 0;
+     xmlInitNodeInfoSeq(&ctxt->node_seq);
+     return(0);
+ }
+Index: libxml2-2.6.32/parser.c
+===================================================================
+--- libxml2-2.6.32.orig/parser.c
++++ libxml2-2.6.32/parser.c
+@@ -2344,7 +2344,7 @@ xmlStringLenDecodeEntities(xmlParserCtxt
+ 	return(NULL);
+     last = str + len;
+ 
+-    if (ctxt->depth > 40) {
++    if ((ctxt->depth > 40) || (ctxt->nbentities >= 500000)) {
+ 	xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+ 	return(NULL);
+     }
+@@ -2382,6 +2382,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt
+ 			"String decoding Entity Reference: %.30s\n",
+ 			str);
+ 	    ent = xmlParseStringEntityRef(ctxt, &str);
++	    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
++	        goto int_error;
++	    ctxt->nbentities++;
++	    if (ent != NULL)
++	        ctxt->nbentities += ent->nbentities;
+ 	    if ((ent != NULL) &&
+ 		(ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
+ 		if (ent->content != NULL) {
+@@ -2427,6 +2432,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt
+ 		xmlGenericError(xmlGenericErrorContext,
+ 			"String decoding PE Reference: %.30s\n", str);
+ 	    ent = xmlParseStringPEReference(ctxt, &str);
++	    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
++	        goto int_error;
++	    ctxt->nbentities++;
++	    if (ent != NULL)
++	        ctxt->nbentities += ent->nbentities;
+ 	    if (ent != NULL) {
+                 if (ent->content == NULL) {
+ 		    if (xmlLoadEntityContent(ctxt, ent) < 0) {
+@@ -2466,6 +2476,7 @@ xmlStringLenDecodeEntities(xmlParserCtxt
+ 
+ mem_error:
+     xmlErrMemory(ctxt, NULL);
++int_error:
+     if (rep != NULL)
+         xmlFree(rep);
+     if (buffer != NULL)
+@@ -3280,6 +3291,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr
+ 		}
+ 	    } else {
+ 		ent = xmlParseEntityRef(ctxt);
++		ctxt->nbentities++;
++		if (ent != NULL)
++		    ctxt->nbentities += ent->nbentities;
+ 		if ((ent != NULL) &&
+ 		    (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
+ 		    if (len > buf_size - 10) {
+@@ -4566,6 +4580,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
+     int isParameter = 0;
+     xmlChar *orig = NULL;
+     int skipped;
++    unsigned long oldnbent = ctxt->nbentities;
+     
+     /* GROW; done in the caller */
+     if (CMP8(CUR_PTR, '<', '!', 'E', 'N', 'T', 'I', 'T', 'Y')) {
+@@ -4783,6 +4798,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
+ 		}
+ 	    }
+             if (cur != NULL) {
++	        cur->nbentities = ctxt->nbentities - oldnbent;
+ 	        if (cur->orig != NULL)
+ 		    xmlFree(orig);
+ 		else
+@@ -6189,6 +6205,11 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
+ 	if (ent == NULL) return;
+ 	if (!ctxt->wellFormed)
+ 	    return;
++	ctxt->nbentities++;
++	if (ctxt->nbentities >= 500000) {
++	    xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
++	    return;
++	}
+ 	was_checked = ent->checked;
+ 	if ((ent->name != NULL) && 
+ 	    (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY)) {
+@@ -6249,6 +6270,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
+ 			xmlFreeNodeList(list);
+ 		    }
+ 		} else {
++		    unsigned long oldnbent = ctxt->nbentities;
+ 		    /*
+ 		     * 4.3.2: An internal general parsed entity is well-formed
+ 		     * if its replacement text matches the production labeled
+@@ -6271,6 +6293,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
+ 			ret = xmlParseBalancedChunkMemoryInternal(ctxt,
+ 					   value, user_data, &list);
+ 			ctxt->depth--;
++
+ 		    } else if (ent->etype ==
+ 			       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
+ 			ctxt->depth++;
+@@ -6283,6 +6306,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
+ 			xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
+ 				     "invalid entity type found\n", NULL);
+ 		    }
++		    ent->nbentities = ctxt->nbentities - oldnbent;
+ 		    if (ret == XML_ERR_ENTITY_LOOP) {
+ 			xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+ 			return;
+@@ -6341,6 +6365,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
+ 		}
+ 		ent->checked = 1;
+ 	    }
++	    ctxt->nbentities += ent->nbentities;
+ 
+             if (ent->children == NULL) {
+ 		/*
+@@ -11480,7 +11505,7 @@ xmlParseCtxtExternalEntity(xmlParserCtxt
+ 
+     if (ctx == NULL) return(-1);
+ 
+-    if (ctx->depth > 40) {
++    if ((ctx->depth > 40) || (ctx->nbentities >= 500000)) {
+ 	return(XML_ERR_ENTITY_LOOP);
+     }
+ 
+@@ -11681,7 +11706,8 @@ xmlParseExternalEntityPrivate(xmlDocPtr 
+     xmlChar start[4];
+     xmlCharEncoding enc;
+ 
+-    if (depth > 40) {
++    if ((depth > 40) ||
++        ((oldctxt != NULL) && (oldctxt->nbentities >= 500000))) {
+ 	return(XML_ERR_ENTITY_LOOP);
+     }
+ 
+@@ -11824,6 +11850,7 @@ xmlParseExternalEntityPrivate(xmlDocPtr 
+     oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
+     oldctxt->node_seq.length = ctxt->node_seq.length;
+     oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
++    oldctxt->nbentities += ctxt->nbentities;
+     ctxt->node_seq.maximum = 0;
+     ctxt->node_seq.length = 0;
+     ctxt->node_seq.buffer = NULL;
+@@ -11924,7 +11951,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP
+     int size;
+     xmlParserErrors ret = XML_ERR_OK;
+ 
+-    if (oldctxt->depth > 40) {
++    if ((oldctxt->depth > 40) || (oldctxt->nbentities >= 500000)) {
+ 	return(XML_ERR_ENTITY_LOOP);
+     }
+ 
+@@ -12048,6 +12075,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP
+         ctxt->myDoc->last = last;
+     }
+ 	
++    oldctxt->nbentities += ctxt->nbentities;
+     ctxt->sax = oldsax;
+     ctxt->dict = NULL;
+     ctxt->attsDefault = NULL;
+@@ -13363,6 +13391,7 @@ xmlCtxtReset(xmlParserCtxtPtr ctxt)
+     ctxt->depth = 0;
+     ctxt->charset = XML_CHAR_ENCODING_UTF8;
+     ctxt->catalogs = NULL;
++    ctxt->nbentities = 0;
+     xmlInitNodeInfoSeq(&ctxt->node_seq);
+ 
+     if (ctxt->attsDefault != NULL) {
diff --git a/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild b/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild
new file mode 100644
index 000000000000..c98d465dbd0c
--- /dev/null
+++ b/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild
@@ -0,0 +1,124 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild,v 1.1 2008/08/22 16:07:50 leio Exp $
+
+inherit libtool flag-o-matic eutils
+
+DESCRIPTION="Version 2 of the library to manipulate XML files"
+HOMEPAGE="http://www.xmlsoft.org/"
+
+LICENSE="MIT"
+SLOT="2"
+KEYWORDS="alpha amd64 ~arm hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc ~sparc-fbsd x86 ~x86-fbsd"
+IUSE="bootstrap build debug doc examples ipv6 python readline test"
+
+XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
+XSTS_NAME_1="xmlschema2002-01-16"
+XSTS_NAME_2="xmlschema2004-01-14"
+XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
+XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
+
+SRC_URI="ftp://xmlsoft.org/${PN}/${P}.tar.gz
+	test? (
+		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
+		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2} )"
+
+RDEPEND="sys-libs/zlib
+	python?   ( dev-lang/python )
+	readline? ( sys-libs/readline )"
+
+DEPEND="${RDEPEND}
+	hppa? ( >=sys-devel/binutils-2.15.92.0.2 )"
+
+src_unpack() {
+	unpack ${P}.tar.gz
+	cd "${S}"
+
+	if use test; then
+		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
+			"${DISTDIR}/${XSTS_TARBALL_2}" \
+			"${S}"/xstc/ \
+			|| die "Failed to install test tarballs"
+	fi
+
+	# Fix infinite recursion, bug #234099
+	epatch "${FILESDIR}/${P}-CVE-2008-3281.patch"
+
+	epunt_cxx
+}
+
+src_compile() {
+	# USE zlib support breaks gnome2
+	# (libgnomeprint for instance fails to compile with
+	# fresh install, and existing) - <azarah@gentoo.org> (22 Dec 2002).
+
+	# The meaning of the 'debug' USE flag does not apply to the --with-debug
+	# switch (enabling the libxml2 debug module). See bug #100898.
+
+	# --with-mem-debug causes unusual segmentation faults (bug #105120).
+
+	local myconf="--with-zlib \
+		$(use_with debug run-debug)  \
+		$(use_with python)           \
+		$(use_with readline)         \
+		$(use_with readline history) \
+		$(use_enable ipv6)"
+
+	# Please do not remove, as else we get references to PORTAGE_TMPDIR
+	# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
+	elibtoolize
+
+	# filter seemingly problematic CFLAGS (#26320)
+	filter-flags -fprefetch-loop-arrays -funroll-loops
+
+	econf $myconf || die "Configuration failed"
+
+	# Patching the Makefiles to respect get_libdir
+	# Fixes BUG #86766, please keep this.
+	# Danny van Dyk <kugelfang@gentoo.org> 2005/03/26
+	for x in $(find "${S}" -name "Makefile") ; do
+		sed \
+			-e "s|^\(PYTHON_SITE_PACKAGES\ =\ \/usr\/\).*\(\/python.*\)|\1$(get_libdir)\2|g" \
+			-i ${x} \
+			|| die "sed failed"
+	done
+
+	emake || die "Compilation failed"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "Installation failed"
+
+	dodoc AUTHORS ChangeLog Copyright NEWS README* TODO*
+
+	if ! use doc; then
+		rm -rf "${D}"/usr/share/gtk-doc
+		rm -rf "${D}"/usr/share/doc/${P}/html
+	fi
+
+	if ! use examples; then
+		rm -rf "${D}/usr/share/doc/${P}/examples"
+		rm -rf "${D}/usr/share/doc/${PN}-python-${PV}/examples"
+	fi
+}
+
+pkg_postinst() {
+	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
+	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
+	if [[ "${ROOT}" != "/" ]]
+	then
+		elog "Skipping XML catalog creation for stage building (bug #208887)."
+	else
+		# need an XML catalog, so no-one writes to a non-existent one
+		CATALOG="${ROOT}etc/xml/catalog"
+
+		# we dont want to clobber an existing catalog though,
+		# only ensure that one is there
+		# <obz@gentoo.org>
+		if [ ! -e ${CATALOG} ]; then
+			[ -d "${ROOT}etc/xml" ] || mkdir -p "${ROOT}etc/xml"
+			/usr/bin/xmlcatalog --create > ${CATALOG}
+			einfo "Created XML catalog in ${CATALOG}"
+		fi
+	fi
+}