File libxml2-CVE-2021-3537.patch of Package libxml2

Overview Repositories Revisions Requests Users Attributes Meta

File libxml2-CVE-2021-3537.patch of Package libxml2 (Revision 1e4445c5da46ed2a88d34f75c60542bf)

Currently displaying revision 1e4445c5da46ed2a88d34f75c60542bf , Show latest

From babe75030c7f64a37826bb3342317134568bef61 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Sat, 1 May 2021 16:53:33 +0200
Subject: [PATCH] Propagate error in xmlParseElementChildrenContentDeclPriv

Check return value of recursive calls to
xmlParseElementChildrenContentDeclPriv and return immediately in case
of errors. Otherwise, struct xmlElementContent could contain unexpected
null pointers, leading to a null deref when post-validating documents
which aren't well-formed and parsed in recovery mode.

Fixes #243.
---
 parser.c | 7 +++++++
 1 file changed, 7 insertions(+)

Index: libxml2-2.9.10/parser.c
===================================================================
--- libxml2-2.9.10.orig/parser.c
+++ libxml2-2.9.10/parser.c
@@ -6195,6 +6195,8 @@ xmlParseElementChildrenContentDeclPriv(x
 	SKIP_BLANKS;
         cur = ret = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
                                                            depth + 1);
+        if (cur == NULL)
+            return(NULL);
 	SKIP_BLANKS;
 	GROW;
     } else {
@@ -6328,6 +6330,11 @@ xmlParseElementChildrenContentDeclPriv(x
 	    SKIP_BLANKS;
 	    last = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
                                                           depth + 1);
+            if (last == NULL) {
+		if (ret != NULL)
+		    xmlFreeDocElementContent(ctxt->myDoc, ret);
+		return(NULL);
+            }
 	    SKIP_BLANKS;
 	} else {
 	    elem = xmlParseName(ctxt);

Places

File libxml2-CVE-2021-3537.patch of Package libxml2 (Revision 1e4445c5da46ed2a88d34f75c60542bf)

Places