Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Backports:SLE-15-SP4:FactoryCandidates
libcroco
libcroco-CVE-2020-12825.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File libcroco-CVE-2020-12825.patch of Package libcroco
From 6eb257e5c731c691eb137fca94e916ca73941a5a Mon Sep 17 00:00:00 2001 From: Michael Catanzaro <mcatanzaro@gnome.org> Date: Fri, 31 Jul 2020 15:21:53 -0500 Subject: [PATCH] parser: limit recursion in block and any productions If we don't have any limits, we can recurse forever and overflow the stack. Fixes #8 --- src/cr-parser.c | 44 +++++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/src/cr-parser.c b/src/cr-parser.c index 18c9a01..f4a62e3 100644 --- a/src/cr-parser.c +++ b/src/cr-parser.c @@ -136,6 +136,8 @@ struct _CRParserPriv { #define CHARS_TAB_SIZE 12 +#define RECURSIVE_CALLERS_LIMIT 100 + /** * IS_NUM: *@a_char: the char to test. @@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); -static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); +static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, + guint n_calls); -static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); +static enum CRStatus cr_parser_parse_block_core (CRParser * a_this, + guint n_calls); static enum CRStatus cr_parser_parse_value_core (CRParser * a_this); @@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) cr_parser_try_to_skip_spaces_and_comments (a_this); do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); } while (status == CR_OK); status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, @@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_block_core (a_this); + status = cr_parser_parse_block_core (a_this, 0); CHECK_PARSING_STATUS (status, FALSE); goto done; @@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this) RECORD_INITIAL_POS (a_this, &init_pos); - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); CHECK_PARSING_STATUS (status, FALSE); do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); } while (status == CR_OK); @@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this) *in chapter 4.1 of the css2 spec. *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*; *@param a_this the current instance of #CRParser. + *@param n_calls used to limit recursion depth *FIXME: code this function. */ static enum CRStatus -cr_parser_parse_block_core (CRParser * a_this) +cr_parser_parse_block_core (CRParser * a_this, + guint n_calls) { CRToken *token = NULL; CRInputPos init_pos; @@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this) g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR); + if (n_calls > RECURSIVE_CALLERS_LIMIT) + return CR_ERROR; + RECORD_INITIAL_POS (a_this, &init_pos); status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token); @@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this) } else if (token->type == CBO_TK) { cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_block_core (a_this); + status = cr_parser_parse_block_core (a_this, n_calls + 1); CHECK_PARSING_STATUS (status, FALSE); goto parse_block_content; } else { cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); CHECK_PARSING_STATUS (status, FALSE); goto parse_block_content; } @@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this) status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_block_core (a_this); + status = cr_parser_parse_block_core (a_this, 0); CHECK_PARSING_STATUS (status, FALSE); ref++; goto continue_parsing; @@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this) status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); if (status == CR_OK) { ref++; goto continue_parsing; @@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this) * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*; * *@param a_this the current instance of #CRParser. + *@param n_calls used to limit recursion depth *@return CR_OK upon successfull completion, an error code otherwise. */ static enum CRStatus -cr_parser_parse_any_core (CRParser * a_this) +cr_parser_parse_any_core (CRParser * a_this, + guint n_calls) { CRToken *token1 = NULL, *token2 = NULL; @@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this) g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); + if (n_calls > RECURSIVE_CALLERS_LIMIT) + return CR_ERROR; + RECORD_INITIAL_POS (a_this, &init_pos); status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1); @@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this) *We consider parameter as being an "any*" production. */ do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); ENSURE_PARSING_COND (status == CR_PARSING_ERROR); @@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this) } do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); ENSURE_PARSING_COND (status == CR_PARSING_ERROR); @@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this) } do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); ENSURE_PARSING_COND (status == CR_PARSING_ERROR); -- GitLab
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
