* [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718)
@ 2016-05-18 16:36 Leo Famulari
2016-05-18 16:36 ` [PATCH 1/1] gnu: expat: Fix CVE-2016-0718 Leo Famulari
2016-05-18 17:37 ` [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Leo Famulari
0 siblings, 2 replies; 5+ messages in thread
From: Leo Famulari @ 2016-05-18 16:36 UTC (permalink / raw)
To: guix-devel
I've attached my attempt at fixing CVE-2016-0718 in Expat [0]. The
grafted expat updates to 2.1.1 and applies the patch from [1].
The problem is that, when trying build something that depends on expat,
I seem to have to rebuild *many* things.
Any advice?
By the way, there are some other caveats with this change.
First, I don't yet know the relationship of the patch from oss-sec to
upstream. It's not in their git repo. It might be a squashed
representation of the branch 'cve-2016-0718-fix-2-2-1' that they merged
yesterday [2]. I changed the line endings from DOS to Unix.
Second, I updated the grafted expat to 2.1.1 since the patch did not
apply to 2.1.0. I don't know if 2.1.1 is binary compatible with 2.1.0,
so I don't know if it's even suitable for grafting.
[0]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718
[1]
http://seclists.org/oss-sec/2016/q2/360
[2]
https://sourceforge.net/p/expat/code_git/ci/be4b1c06daba1849b8ff5e00bae5caf47f6c39fd/
Leo Famulari (1):
gnu: expat: Fix CVE-2016-0718.
gnu/local.mk | 1 +
gnu/packages/patches/expat-CVE-2016-0718.patch | 755 +++++++++++++++++++++++++
gnu/packages/xml.scm | 25 +-
3 files changed, 779 insertions(+), 2 deletions(-)
create mode 100644 gnu/packages/patches/expat-CVE-2016-0718.patch
--
2.8.2
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 1/1] gnu: expat: Fix CVE-2016-0718.
2016-05-18 16:36 [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Leo Famulari
@ 2016-05-18 16:36 ` Leo Famulari
2016-05-18 17:37 ` [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Leo Famulari
1 sibling, 0 replies; 5+ messages in thread
From: Leo Famulari @ 2016-05-18 16:36 UTC (permalink / raw)
To: guix-devel
* gnu/packages/xml.scm (expat)[replacement]: New field.
(expat/fixed): New variable.
[source]: Update to 2.1.1.
* gnu/packages/patches/expat-CVE-2016-0718.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
---
gnu/local.mk | 1 +
gnu/packages/patches/expat-CVE-2016-0718.patch | 755 +++++++++++++++++++++++++
gnu/packages/xml.scm | 25 +-
3 files changed, 779 insertions(+), 2 deletions(-)
create mode 100644 gnu/packages/patches/expat-CVE-2016-0718.patch
diff --git a/gnu/local.mk b/gnu/local.mk
index 0e461b3..b9c171f 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -472,6 +472,7 @@ dist_patch_DATA = \
gnu/packages/patches/eudev-rules-directory.patch \
gnu/packages/patches/evilwm-lost-focus-bug.patch \
gnu/packages/patches/expat-CVE-2015-1283.patch \
+ gnu/packages/patches/expat-CVE-2016-0718.patch \
gnu/packages/patches/fastcap-mulGlobal.patch \
gnu/packages/patches/fastcap-mulSetup.patch \
gnu/packages/patches/fasthenry-spAllocate.patch \
diff --git a/gnu/packages/patches/expat-CVE-2016-0718.patch b/gnu/packages/patches/expat-CVE-2016-0718.patch
new file mode 100644
index 0000000..20ab975
--- /dev/null
+++ b/gnu/packages/patches/expat-CVE-2016-0718.patch
@@ -0,0 +1,755 @@
+From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian () pipping org>
+Date: Mon, 2 May 2016 00:02:44 +0200
+Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1)
+
+* Out of bounds memory access when doing text conversion on malformed input
+* Integer overflow related to memory allocation
+
+Reported by Gustavo Grieco
+
+Patch credits go to
+* Christian Heimes
+* Karl Waclawek
+* Gustavo Grieco
+* Sebastian Pipping
+* Pascal Cuoq
+---
+ expat/lib/xmlparse.c | 34 +++++++++-----
+ expat/lib/xmltok.c | 115 +++++++++++++++++++++++++++++++++++-------------
+ expat/lib/xmltok.h | 10 ++++-
+ expat/lib/xmltok_impl.c | 62 +++++++++++++-------------
+ 4 files changed, 146 insertions(+), 75 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index e308c79..13e080d 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -2426,11 +2426,11 @@ doContent(XML_Parser parser,
+ for (;;) {
+ int bufSize;
+ int convLen;
+- XmlConvert(enc,
++ const enum XML_Convert_Result convert_res = XmlConvert(enc,
+ &fromPtr, rawNameEnd,
+ (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1);
+ convLen = (int)(toPtr - (XML_Char *)tag->buf);
+- if (fromPtr == rawNameEnd) {
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) {
+ tag->name.strLen = convLen;
+ break;
+ }
+@@ -2651,11 +2651,11 @@ doContent(XML_Parser parser,
+ if (MUST_CONVERT(enc, s)) {
+ for (;;) {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = s;
+ charDataHandler(handlerArg, dataBuf,
+ (int)(dataPtr - (ICHAR *)dataBuf));
+- if (s == next)
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+@@ -3261,11 +3261,11 @@ doCdataSection(XML_Parser parser,
+ if (MUST_CONVERT(enc, s)) {
+ for (;;) {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = next;
+ charDataHandler(handlerArg, dataBuf,
+ (int)(dataPtr - (ICHAR *)dataBuf));
+- if (s == next)
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+@@ -5342,6 +5342,7 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+ const char *s, const char *end)
+ {
+ if (MUST_CONVERT(enc, s)) {
++ enum XML_Convert_Result convert_res;
+ const char **eventPP;
+ const char **eventEndPP;
+ if (enc == encoding) {
+@@ -5354,11 +5355,11 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+ }
+ do {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
++ convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = s;
+ defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf));
+ *eventPP = s;
+- } while (s != end);
++ } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
+ }
+ else
+ defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s));
+@@ -6163,8 +6164,8 @@ poolAppend(STRING_POOL *pool, const ENCODING *enc,
+ if (!pool->ptr && !poolGrow(pool))
+ return NULL;
+ for (;;) {
+- XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
+- if (ptr == end)
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ if (!poolGrow(pool))
+ return NULL;
+@@ -6248,8 +6249,13 @@ poolGrow(STRING_POOL *pool)
+ }
+ }
+ if (pool->blocks && pool->start == pool->blocks->s) {
+- int blockSize = (int)(pool->end - pool->start)*2;
+- BLOCK *temp = (BLOCK *)
++ BLOCK *temp;
++ int blockSize = (int)((unsigned)(pool->end - pool->start)*2U);
++
++ if (blockSize < 0)
++ return XML_FALSE;
++
++ temp = (BLOCK *)
+ pool->mem->realloc_fcn(pool->blocks,
+ (offsetof(BLOCK, s)
+ + blockSize * sizeof(XML_Char)));
+@@ -6264,6 +6270,10 @@ poolGrow(STRING_POOL *pool)
+ else {
+ BLOCK *tem;
+ int blockSize = (int)(pool->end - pool->start);
++
++ if (blockSize < 0)
++ return XML_FALSE;
++
+ if (blockSize < INIT_BLOCK_SIZE)
+ blockSize = INIT_BLOCK_SIZE;
+ else
+diff --git a/expat/lib/xmltok.c b/expat/lib/xmltok.c
+index bf09dfc..cb98ce1 100644
+--- a/expat/lib/xmltok.c
++++ b/expat/lib/xmltok.c
+@@ -318,39 +318,55 @@ enum { /* UTF8_cvalN is value of masked first byte of N byte sequence */
+ UTF8_cval4 = 0xf0
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+ {
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+ char *to;
+ const char *from;
+ if (fromLim - *fromP > toLim - *toP) {
+ /* Avoid copying partial characters. */
++ res = XML_CONVERT_OUTPUT_EXHAUSTED;
+ for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--)
+ if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
+ break;
+ }
+- for (to = *toP, from = *fromP; from != fromLim; from++, to++)
++ for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++)
+ *to = *from;
+ *fromP = from;
+ *toP = to;
++
++ if ((to == toLim) && (from < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return res;
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+ unsigned short *to = *toP;
+ const char *from = *fromP;
+- while (from != fromLim && to != toLim) {
++ while (from < fromLim && to < toLim) {
+ switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
+ case BT_LEAD2:
++ if (fromLim - from < 2) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ break;
++ }
+ *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
+ from += 2;
+ break;
+ case BT_LEAD3:
++ if (fromLim - from < 3) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ break;
++ }
+ *to++ = (unsigned short)(((from[0] & 0xf) << 12)
+ | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f));
+ from += 3;
+@@ -358,8 +374,14 @@ utf8_toUtf16(const ENCODING *enc,
+ case BT_LEAD4:
+ {
+ unsigned long n;
+- if (to + 1 == toLim)
++ if (toLim - to < 2) {
++ res = XML_CONVERT_OUTPUT_EXHAUSTED;
+ goto after;
++ }
++ if (fromLim - from < 4) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ goto after;
++ }
+ n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12)
+ | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f);
+ n -= 0x10000;
+@@ -377,6 +399,7 @@ utf8_toUtf16(const ENCODING *enc,
+ after:
+ *fromP = from;
+ *toP = to;
++ return res;
+ }
+
+ #ifdef XML_NS
+@@ -425,7 +448,7 @@ static const struct normal_encoding internal_utf8_encoding = {
+ STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_)
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+@@ -433,30 +456,35 @@ latin1_toUtf8(const ENCODING *enc,
+ for (;;) {
+ unsigned char c;
+ if (*fromP == fromLim)
+- break;
++ return XML_CONVERT_COMPLETED;
+ c = (unsigned char)**fromP;
+ if (c & 0x80) {
+ if (toLim - *toP < 2)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ *(*toP)++ = (char)((c >> 6) | UTF8_cval2);
+ *(*toP)++ = (char)((c & 0x3f) | 0x80);
+ (*fromP)++;
+ }
+ else {
+ if (*toP == toLim)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ *(*toP)++ = *(*fromP)++;
+ }
+ }
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
+- while (*fromP != fromLim && *toP != toLim)
++ while (*fromP < fromLim && *toP < toLim)
+ *(*toP)++ = (unsigned char)*(*fromP)++;
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ #ifdef XML_NS
+@@ -483,13 +511,18 @@ static const struct normal_encoding latin1_encoding = {
+ STANDARD_VTABLE(sb_)
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ ascii_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+ {
+- while (*fromP != fromLim && *toP != toLim)
++ while (*fromP < fromLim && *toP < toLim)
+ *(*toP)++ = *(*fromP)++;
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ #ifdef XML_NS
+@@ -536,13 +569,14 @@ unicode_byte_type(char hi, char lo)
+ }
+
+ #define DEFINE_UTF16_TO_UTF8(E) \
+-static void PTRCALL \
++static enum XML_Convert_Result PTRCALL \
+ E ## toUtf8(const ENCODING *enc, \
+ const char **fromP, const char *fromLim, \
+ char **toP, const char *toLim) \
+ { \
+- const char *from; \
+- for (from = *fromP; from != fromLim; from += 2) { \
++ const char *from = *fromP; \
++ fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \
++ for (; from < fromLim; from += 2) { \
+ int plane; \
+ unsigned char lo2; \
+ unsigned char lo = GET_LO(from); \
+@@ -552,7 +586,7 @@ E ## toUtf8(const ENCODING *enc, \
+ if (lo < 0x80) { \
+ if (*toP == toLim) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ *(*toP)++ = lo; \
+ break; \
+@@ -562,7 +596,7 @@ E ## toUtf8(const ENCODING *enc, \
+ case 0x4: case 0x5: case 0x6: case 0x7: \
+ if (toLim - *toP < 2) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ *(*toP)++ = ((lo >> 6) | (hi << 2) | UTF8_cval2); \
+ *(*toP)++ = ((lo & 0x3f) | 0x80); \
+@@ -570,7 +604,7 @@ E ## toUtf8(const ENCODING *enc, \
+ default: \
+ if (toLim - *toP < 3) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \
+ *(*toP)++ = ((hi >> 4) | UTF8_cval3); \
+@@ -580,7 +614,11 @@ E ## toUtf8(const ENCODING *enc, \
+ case 0xD8: case 0xD9: case 0xDA: case 0xDB: \
+ if (toLim - *toP < 4) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
++ } \
++ if (fromLim - from < 4) { \
++ *fromP = from; \
++ return XML_CONVERT_INPUT_INCOMPLETE; \
+ } \
+ plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \
+ *(*toP)++ = ((plane >> 2) | UTF8_cval4); \
+@@ -596,20 +634,32 @@ E ## toUtf8(const ENCODING *enc, \
+ } \
+ } \
+ *fromP = from; \
++ if (from < fromLim) \
++ return XML_CONVERT_INPUT_INCOMPLETE; \
++ else \
++ return XML_CONVERT_COMPLETED; \
+ }
+
+ #define DEFINE_UTF16_TO_UTF16(E) \
+-static void PTRCALL \
++static enum XML_Convert_Result PTRCALL \
+ E ## toUtf16(const ENCODING *enc, \
+ const char **fromP, const char *fromLim, \
+ unsigned short **toP, const unsigned short *toLim) \
+ { \
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \
++ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \
+ /* Avoid copying first half only of surrogate */ \
+ if (fromLim - *fromP > ((toLim - *toP) << 1) \
+- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
++ && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \
+ fromLim -= 2; \
+- for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \
++ res = XML_CONVERT_INPUT_INCOMPLETE; \
++ } \
++ for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \
+ *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
++ if ((*toP == toLim) && (*fromP < fromLim)) \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
++ else \
++ return res; \
+ }
+
+ #define SET2(ptr, ch) \
+@@ -1288,7 +1338,7 @@ unknown_isInvalid(const ENCODING *enc, const char *p)
+ return (c & ~0xFFFF) || checkCharRefNumber(c) < 0;
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+@@ -1299,21 +1349,21 @@ unknown_toUtf8(const ENCODING *enc,
+ const char *utf8;
+ int n;
+ if (*fromP == fromLim)
+- break;
++ return XML_CONVERT_COMPLETED;
+ utf8 = uenc->utf8[(unsigned char)**fromP];
+ n = *utf8++;
+ if (n == 0) {
+ int c = uenc->convert(uenc->userData, *fromP);
+ n = XmlUtf8Encode(c, buf);
+ if (n > toLim - *toP)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ utf8 = buf;
+ *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP]
+ - (BT_LEAD2 - 2));
+ }
+ else {
+ if (n > toLim - *toP)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ (*fromP)++;
+ }
+ do {
+@@ -1322,13 +1372,13 @@ unknown_toUtf8(const ENCODING *enc,
+ }
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
+ const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
+- while (*fromP != fromLim && *toP != toLim) {
++ while (*fromP < fromLim && *toP < toLim) {
+ unsigned short c = uenc->utf16[(unsigned char)**fromP];
+ if (c == 0) {
+ c = (unsigned short)
+@@ -1340,6 +1390,11 @@ unknown_toUtf16(const ENCODING *enc,
+ (*fromP)++;
+ *(*toP)++ = c;
+ }
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ ENCODING *
+@@ -1503,7 +1558,7 @@ initScan(const ENCODING * const *encodingTable,
+ {
+ const ENCODING **encPtr;
+
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ encPtr = enc->encPtr;
+ if (ptr + 1 == end) {
+diff --git a/expat/lib/xmltok.h b/expat/lib/xmltok.h
+index ca867aa..752007e 100644
+--- a/expat/lib/xmltok.h
++++ b/expat/lib/xmltok.h
+@@ -130,6 +130,12 @@ typedef int (PTRCALL *SCANNER)(const ENCODING *,
+ const char *,
+ const char **);
+
++enum XML_Convert_Result {
++ XML_CONVERT_COMPLETED = 0,
++ XML_CONVERT_INPUT_INCOMPLETE = 1,
++ XML_CONVERT_OUTPUT_EXHAUSTED = 2 /* and therefore potentially input remaining as well */
++};
++
+ struct encoding {
+ SCANNER scanners[XML_N_STATES];
+ SCANNER literalScanners[XML_N_LITERAL_TYPES];
+@@ -158,12 +164,12 @@ struct encoding {
+ const char *ptr,
+ const char *end,
+ const char **badPtr);
+- void (PTRCALL *utf8Convert)(const ENCODING *enc,
++ enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc,
+ const char **fromP,
+ const char *fromLim,
+ char **toP,
+ const char *toLim);
+- void (PTRCALL *utf16Convert)(const ENCODING *enc,
++ enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc,
+ const char **fromP,
+ const char *fromLim,
+ unsigned short **toP,
+diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c
+index 9c2895b..6c5a3ba 100644
+--- a/expat/lib/xmltok_impl.c
++++ b/expat/lib/xmltok_impl.c
+@@ -93,13 +93,13 @@ static int PTRCALL
+ PREFIX(scanComment)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_MINUS:
+@@ -147,7 +147,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_PERCNT:
+ if (ptr + MINBPC(enc) == end)
+@@ -233,7 +233,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_S: case BT_CR: case BT_LF:
+@@ -242,7 +242,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+ return XML_TOK_INVALID;
+ }
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_QUEST:
+@@ -305,7 +305,7 @@ static int PTRCALL
+ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -348,7 +348,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+ ptr += MINBPC(enc);
+ break;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: \
+@@ -391,11 +391,11 @@ PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_S: case BT_CR: case BT_LF:
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_S: case BT_CR: case BT_LF:
+ break;
+@@ -432,7 +432,7 @@ static int PTRCALL
+ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -441,7 +441,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -464,7 +464,7 @@ static int PTRCALL
+ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ if (CHAR_MATCHES(enc, ptr, ASCII_x))
+ return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
+ switch (BYTE_TYPE(enc, ptr)) {
+@@ -474,7 +474,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ break;
+@@ -506,7 +506,7 @@ PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_SEMI:
+@@ -529,7 +529,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
+ #ifdef XML_NS
+ int hadColon = 0;
+ #endif
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -716,7 +716,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+ hadColon = 0;
+ #endif
+ /* we have a start-tag */
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -740,7 +740,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+ case BT_S: case BT_CR: case BT_LF:
+ {
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
+ case BT_GT:
+@@ -785,7 +785,7 @@ static int PTRCALL
+ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -832,7 +832,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+ ptr += MINBPC(enc);
+ break;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: \
+@@ -895,7 +895,7 @@ PREFIX(scanPercent)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_SEMI:
+@@ -921,7 +921,7 @@ PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_CR: case BT_LF: case BT_S:
+@@ -941,7 +941,7 @@ PREFIX(scanLit)(int open, const ENCODING *enc,
+ const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+- while (ptr != end) {
++ while (ptr < end) {
+ int t = BYTE_TYPE(enc, ptr);
+ switch (t) {
+ INVALID_CASES(ptr, nextTokPtr)
+@@ -973,7 +973,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+ int tok;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -1141,7 +1141,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_GT: case BT_RPAR: case BT_COMMA:
+@@ -1204,10 +1204,10 @@ PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+ const char *start;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ start = ptr;
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: ptr += n; break;
+@@ -1262,10 +1262,10 @@ PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+ const char *start;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ start = ptr;
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: ptr += n; break;
+@@ -1326,7 +1326,7 @@ PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr,
+ end = ptr + n;
+ }
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_LT:
+@@ -1373,7 +1373,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
+ {
+ ptr += MINBPC(enc);
+ end -= MINBPC(enc);
+- for (; ptr != end; ptr += MINBPC(enc)) {
++ for (; ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -1760,7 +1760,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
+ case BT_CR:
+ pos->lineNumber++;
+ ptr += MINBPC(enc);
+- if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF)
++ if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF)
+ ptr += MINBPC(enc);
+ pos->columnNumber = (XML_Size)-1;
+ break;
+--
+2.8.2
+
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index e1f111e..f2b6a28 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -44,6 +44,7 @@
(define-public expat
(package
(name "expat")
+ (replacement expat/fixed)
(version "2.1.0")
(source (origin
(method url-fetch)
@@ -51,8 +52,7 @@
version "/expat-" version ".tar.gz"))
(sha256
(base32
- "11pblz61zyxh68s5pdcbhc30ha1b2vfjd83aiwfg4vc15x3hadw2"))
- (patches (search-patches "expat-CVE-2015-1283.patch"))))
+ "11pblz61zyxh68s5pdcbhc30ha1b2vfjd83aiwfg4vc15x3hadw2"))))
(build-system gnu-build-system)
(home-page "http://www.libexpat.org/")
(synopsis "Stream-oriented XML parser library written in C")
@@ -62,6 +62,27 @@ stream-oriented parser in which an application registers handlers for
things the parser might find in the XML document (like start tags).")
(license license:expat)))
+(define expat/fixed
+ (package
+ (inherit expat)
+ (replacement #f)
+ (source
+ (let (
+ (version "2.1.1"))
+ (origin
+ (method url-fetch)
+ (uri (string-append "mirror://sourceforge/expat/expat/"
+ version "/expat-" version ".tar.bz2"))
+ ;; Remove dead patch.
+
+ ;; What is the relationship of this patch (from oss-sec) to
+ ;; upstream?
+ (patches (search-patches "expat-CVE-2016-0718.patch"))
+ (patch-flags '("-p2"))
+ (sha256
+ (base32
+ "0ryyjgvy7jq0qb7a9mhc1giy3bzn56aiwrs8dpydqngplbjq9xdg")))))))
+
(define-public libxml2
(package
(name "libxml2")
--
2.8.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718)
2016-05-18 16:36 [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Leo Famulari
2016-05-18 16:36 ` [PATCH 1/1] gnu: expat: Fix CVE-2016-0718 Leo Famulari
@ 2016-05-18 17:37 ` Leo Famulari
2016-05-19 12:19 ` Ludovic Courtès
1 sibling, 1 reply; 5+ messages in thread
From: Leo Famulari @ 2016-05-18 17:37 UTC (permalink / raw)
To: guix-devel
[-- Attachment #1: Type: text/plain, Size: 1048 bytes --]
On Wed, May 18, 2016 at 12:36:50PM -0400, Leo Famulari wrote:
> I've attached my attempt at fixing CVE-2016-0718 in Expat [0]. The
> grafted expat updates to 2.1.1 and applies the patch from [1].
>
> The problem is that, when trying build something that depends on expat,
> I seem to have to rebuild *many* things.
Of course this would happen, since I had removed the CVE-2015-1283 patch
from expat package definition. D'oh.
I've attached an updated patch that seems to work as expected.
This patch uses the CVE-2016-0718 patch from Debian [0], which has the
same diffs but does not require use of (patch-flags).
It also includes an update to the patch for CVE-2015-1283 [1], which
apparently relied on undefined behavior.
Finally, it does not upgrade to 2.1.1. This patch series does apply to
2.1.0.
Your feedback is requested!
[0] Found here while their VCS appears to be offline...
https://packages.debian.org/source/stable/expat
[1] Some mention of it here. Copied from the tarball in [0]
https://www.debian.org/security/2016/dsa-3582
[-- Attachment #2: 0001-gnu-expat-Fix-CVE-2016-0718.-Improve-fix-for-CVE-201.patch --]
[-- Type: text/x-diff, Size: 30661 bytes --]
From f580dfb884e3ca18c89994e7f39d46d6fe230f69 Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Wed, 18 May 2016 13:26:17 -0400
Subject: [PATCH] gnu: expat: Fix CVE-2016-0718. Improve fix for CVE-2015-1283.
* gnu/packages/patches/expat-CVE-2015-1283-refix.patch,
gnu/packages/patches/expat-CVE-2016-0718.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/xml.scm (expat)[replacement]: New field.
(expat/fixed): New variable.
[source]: Use new patches.
---
gnu/local.mk | 2 +
.../patches/expat-CVE-2015-1283-refix.patch | 38 ++
gnu/packages/patches/expat-CVE-2016-0718.patch | 757 +++++++++++++++++++++
gnu/packages/xml.scm | 10 +
4 files changed, 807 insertions(+)
create mode 100644 gnu/packages/patches/expat-CVE-2015-1283-refix.patch
create mode 100644 gnu/packages/patches/expat-CVE-2016-0718.patch
diff --git a/gnu/local.mk b/gnu/local.mk
index 0e461b3..79c7dd5 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -472,6 +472,8 @@ dist_patch_DATA = \
gnu/packages/patches/eudev-rules-directory.patch \
gnu/packages/patches/evilwm-lost-focus-bug.patch \
gnu/packages/patches/expat-CVE-2015-1283.patch \
+ gnu/packages/patches/expat-CVE-2015-1283-refix.patch \
+ gnu/packages/patches/expat-CVE-2016-0718.patch \
gnu/packages/patches/fastcap-mulGlobal.patch \
gnu/packages/patches/fastcap-mulSetup.patch \
gnu/packages/patches/fasthenry-spAllocate.patch \
diff --git a/gnu/packages/patches/expat-CVE-2015-1283-refix.patch b/gnu/packages/patches/expat-CVE-2015-1283-refix.patch
new file mode 100644
index 0000000..df31407
--- /dev/null
+++ b/gnu/packages/patches/expat-CVE-2015-1283-refix.patch
@@ -0,0 +1,38 @@
+Copied from Debian
+
+From 29a11774d8ebbafe8418b4a5ffb4cc1160b194a1 Mon Sep 17 00:00:00 2001
+From: Pascal Cuoq <cuoq@trust-in-soft.com>
+Date: Sun, 15 May 2016 09:05:46 +0200
+Subject: [PATCH] Avoid relying on undefined behavior in CVE-2015-1283 fix.
+
+---
+ expat/lib/xmlparse.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 13e080d..cdb12ef 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1695,7 +1695,8 @@ XML_GetBuffer(XML_Parser parser, int len
+ }
+
+ if (len > bufferLim - bufferEnd) {
+- int neededSize = len + (int)(bufferEnd - bufferPtr);
++ /* Do not invoke signed arithmetic overflow: */
++ int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
+ /* BEGIN MOZILLA CHANGE (sanity check neededSize) */
+ if (neededSize < 0) {
+ errorCode = XML_ERROR_NO_MEMORY;
+@@ -1729,7 +1730,8 @@ XML_GetBuffer(XML_Parser parser, int len
+ if (bufferSize == 0)
+ bufferSize = INIT_BUFFER_SIZE;
+ do {
+- bufferSize *= 2;
++ /* Do not invoke signed arithmetic overflow: */
++ bufferSize = (int) (2U * (unsigned) bufferSize);
+ /* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */
+ } while (bufferSize < neededSize && bufferSize > 0);
+ /* END MOZILLA CHANGE */
+--
+2.8.2
+
diff --git a/gnu/packages/patches/expat-CVE-2016-0718.patch b/gnu/packages/patches/expat-CVE-2016-0718.patch
new file mode 100644
index 0000000..b9c23d8
--- /dev/null
+++ b/gnu/packages/patches/expat-CVE-2016-0718.patch
@@ -0,0 +1,757 @@
+Copied from Debian
+
+From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Mon, 2 May 2016 00:02:44 +0200
+Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1)
+
+* Out of bounds memory access when doing text conversion on malformed input
+* Integer overflow related to memory allocation
+
+Reported by Gustavo Grieco
+
+Patch credits go to
+* Christian Heimes
+* Karl Waclawek
+* Gustavo Grieco
+* Sebastian Pipping
+* Pascal Cuoq
+---
+ expat/lib/xmlparse.c | 34 +++++++++-----
+ expat/lib/xmltok.c | 115 +++++++++++++++++++++++++++++++++++-------------
+ expat/lib/xmltok.h | 10 ++++-
+ expat/lib/xmltok_impl.c | 62 +++++++++++++-------------
+ 4 files changed, 146 insertions(+), 75 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index e308c79..13e080d 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2436,11 +2436,11 @@ doContent(XML_Parser parser,
+ for (;;) {
+ int bufSize;
+ int convLen;
+- XmlConvert(enc,
++ const enum XML_Convert_Result convert_res = XmlConvert(enc,
+ &fromPtr, rawNameEnd,
+ (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1);
+ convLen = (int)(toPtr - (XML_Char *)tag->buf);
+- if (fromPtr == rawNameEnd) {
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) {
+ tag->name.strLen = convLen;
+ break;
+ }
+@@ -2661,11 +2661,11 @@ doContent(XML_Parser parser,
+ if (MUST_CONVERT(enc, s)) {
+ for (;;) {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = s;
+ charDataHandler(handlerArg, dataBuf,
+ (int)(dataPtr - (ICHAR *)dataBuf));
+- if (s == next)
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+@@ -3269,11 +3269,11 @@ doCdataSection(XML_Parser parser,
+ if (MUST_CONVERT(enc, s)) {
+ for (;;) {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = next;
+ charDataHandler(handlerArg, dataBuf,
+ (int)(dataPtr - (ICHAR *)dataBuf));
+- if (s == next)
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+@@ -5350,6 +5350,7 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+ const char *s, const char *end)
+ {
+ if (MUST_CONVERT(enc, s)) {
++ enum XML_Convert_Result convert_res;
+ const char **eventPP;
+ const char **eventEndPP;
+ if (enc == encoding) {
+@@ -5362,11 +5363,11 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+ }
+ do {
+ ICHAR *dataPtr = (ICHAR *)dataBuf;
+- XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
++ convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
+ *eventEndPP = s;
+ defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf));
+ *eventPP = s;
+- } while (s != end);
++ } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
+ }
+ else
+ defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s));
+@@ -6169,8 +6170,8 @@ poolAppend(STRING_POOL *pool, const ENCODING *enc,
+ if (!pool->ptr && !poolGrow(pool))
+ return NULL;
+ for (;;) {
+- XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
+- if (ptr == end)
++ const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
++ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ if (!poolGrow(pool))
+ return NULL;
+@@ -6254,8 +6255,13 @@ poolGrow(STRING_POOL *pool)
+ }
+ }
+ if (pool->blocks && pool->start == pool->blocks->s) {
+- int blockSize = (int)(pool->end - pool->start)*2;
+- BLOCK *temp = (BLOCK *)
++ BLOCK *temp;
++ int blockSize = (int)((unsigned)(pool->end - pool->start)*2U);
++
++ if (blockSize < 0)
++ return XML_FALSE;
++
++ temp = (BLOCK *)
+ pool->mem->realloc_fcn(pool->blocks,
+ (offsetof(BLOCK, s)
+ + blockSize * sizeof(XML_Char)));
+@@ -6270,6 +6276,10 @@ poolGrow(STRING_POOL *pool)
+ else {
+ BLOCK *tem;
+ int blockSize = (int)(pool->end - pool->start);
++
++ if (blockSize < 0)
++ return XML_FALSE;
++
+ if (blockSize < INIT_BLOCK_SIZE)
+ blockSize = INIT_BLOCK_SIZE;
+ else
+diff --git a/lib/xmltok.c b/lib/xmltok.c
+index bf09dfc..cb98ce1 100644
+--- a/lib/xmltok.c
++++ b/lib/xmltok.c
+@@ -318,39 +318,55 @@ enum { /* UTF8_cvalN is value of masked first byte of N byte sequence */
+ UTF8_cval4 = 0xf0
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+ {
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+ char *to;
+ const char *from;
+ if (fromLim - *fromP > toLim - *toP) {
+ /* Avoid copying partial characters. */
++ res = XML_CONVERT_OUTPUT_EXHAUSTED;
+ for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--)
+ if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
+ break;
+ }
+- for (to = *toP, from = *fromP; from != fromLim; from++, to++)
++ for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++)
+ *to = *from;
+ *fromP = from;
+ *toP = to;
++
++ if ((to == toLim) && (from < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return res;
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+ unsigned short *to = *toP;
+ const char *from = *fromP;
+- while (from != fromLim && to != toLim) {
++ while (from < fromLim && to < toLim) {
+ switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
+ case BT_LEAD2:
++ if (fromLim - from < 2) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ break;
++ }
+ *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
+ from += 2;
+ break;
+ case BT_LEAD3:
++ if (fromLim - from < 3) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ break;
++ }
+ *to++ = (unsigned short)(((from[0] & 0xf) << 12)
+ | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f));
+ from += 3;
+@@ -358,8 +374,14 @@ utf8_toUtf16(const ENCODING *enc,
+ case BT_LEAD4:
+ {
+ unsigned long n;
+- if (to + 1 == toLim)
++ if (toLim - to < 2) {
++ res = XML_CONVERT_OUTPUT_EXHAUSTED;
+ goto after;
++ }
++ if (fromLim - from < 4) {
++ res = XML_CONVERT_INPUT_INCOMPLETE;
++ goto after;
++ }
+ n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12)
+ | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f);
+ n -= 0x10000;
+@@ -377,6 +399,7 @@ utf8_toUtf16(const ENCODING *enc,
+ after:
+ *fromP = from;
+ *toP = to;
++ return res;
+ }
+
+ #ifdef XML_NS
+@@ -425,7 +448,7 @@ static const struct normal_encoding internal_utf8_encoding = {
+ STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_)
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+@@ -433,30 +456,35 @@ latin1_toUtf8(const ENCODING *enc,
+ for (;;) {
+ unsigned char c;
+ if (*fromP == fromLim)
+- break;
++ return XML_CONVERT_COMPLETED;
+ c = (unsigned char)**fromP;
+ if (c & 0x80) {
+ if (toLim - *toP < 2)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ *(*toP)++ = (char)((c >> 6) | UTF8_cval2);
+ *(*toP)++ = (char)((c & 0x3f) | 0x80);
+ (*fromP)++;
+ }
+ else {
+ if (*toP == toLim)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ *(*toP)++ = *(*fromP)++;
+ }
+ }
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
+- while (*fromP != fromLim && *toP != toLim)
++ while (*fromP < fromLim && *toP < toLim)
+ *(*toP)++ = (unsigned char)*(*fromP)++;
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ #ifdef XML_NS
+@@ -483,13 +511,18 @@ static const struct normal_encoding latin1_encoding = {
+ STANDARD_VTABLE(sb_)
+ };
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ ascii_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+ {
+- while (*fromP != fromLim && *toP != toLim)
++ while (*fromP < fromLim && *toP < toLim)
+ *(*toP)++ = *(*fromP)++;
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ #ifdef XML_NS
+@@ -536,13 +569,14 @@ unicode_byte_type(char hi, char lo)
+ }
+
+ #define DEFINE_UTF16_TO_UTF8(E) \
+-static void PTRCALL \
++static enum XML_Convert_Result PTRCALL \
+ E ## toUtf8(const ENCODING *enc, \
+ const char **fromP, const char *fromLim, \
+ char **toP, const char *toLim) \
+ { \
+- const char *from; \
+- for (from = *fromP; from != fromLim; from += 2) { \
++ const char *from = *fromP; \
++ fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \
++ for (; from < fromLim; from += 2) { \
+ int plane; \
+ unsigned char lo2; \
+ unsigned char lo = GET_LO(from); \
+@@ -552,7 +586,7 @@ E ## toUtf8(const ENCODING *enc, \
+ if (lo < 0x80) { \
+ if (*toP == toLim) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ *(*toP)++ = lo; \
+ break; \
+@@ -562,7 +596,7 @@ E ## toUtf8(const ENCODING *enc, \
+ case 0x4: case 0x5: case 0x6: case 0x7: \
+ if (toLim - *toP < 2) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ *(*toP)++ = ((lo >> 6) | (hi << 2) | UTF8_cval2); \
+ *(*toP)++ = ((lo & 0x3f) | 0x80); \
+@@ -570,7 +604,7 @@ E ## toUtf8(const ENCODING *enc, \
+ default: \
+ if (toLim - *toP < 3) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
+ } \
+ /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \
+ *(*toP)++ = ((hi >> 4) | UTF8_cval3); \
+@@ -580,7 +614,11 @@ E ## toUtf8(const ENCODING *enc, \
+ case 0xD8: case 0xD9: case 0xDA: case 0xDB: \
+ if (toLim - *toP < 4) { \
+ *fromP = from; \
+- return; \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
++ } \
++ if (fromLim - from < 4) { \
++ *fromP = from; \
++ return XML_CONVERT_INPUT_INCOMPLETE; \
+ } \
+ plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \
+ *(*toP)++ = ((plane >> 2) | UTF8_cval4); \
+@@ -596,20 +634,32 @@ E ## toUtf8(const ENCODING *enc, \
+ } \
+ } \
+ *fromP = from; \
++ if (from < fromLim) \
++ return XML_CONVERT_INPUT_INCOMPLETE; \
++ else \
++ return XML_CONVERT_COMPLETED; \
+ }
+
+ #define DEFINE_UTF16_TO_UTF16(E) \
+-static void PTRCALL \
++static enum XML_Convert_Result PTRCALL \
+ E ## toUtf16(const ENCODING *enc, \
+ const char **fromP, const char *fromLim, \
+ unsigned short **toP, const unsigned short *toLim) \
+ { \
++ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \
++ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \
+ /* Avoid copying first half only of surrogate */ \
+ if (fromLim - *fromP > ((toLim - *toP) << 1) \
+- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
++ && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \
+ fromLim -= 2; \
+- for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \
++ res = XML_CONVERT_INPUT_INCOMPLETE; \
++ } \
++ for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \
+ *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
++ if ((*toP == toLim) && (*fromP < fromLim)) \
++ return XML_CONVERT_OUTPUT_EXHAUSTED; \
++ else \
++ return res; \
+ }
+
+ #define SET2(ptr, ch) \
+@@ -1288,7 +1338,7 @@ unknown_isInvalid(const ENCODING *enc, const char *p)
+ return (c & ~0xFFFF) || checkCharRefNumber(c) < 0;
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf8(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ char **toP, const char *toLim)
+@@ -1299,21 +1349,21 @@ unknown_toUtf8(const ENCODING *enc,
+ const char *utf8;
+ int n;
+ if (*fromP == fromLim)
+- break;
++ return XML_CONVERT_COMPLETED;
+ utf8 = uenc->utf8[(unsigned char)**fromP];
+ n = *utf8++;
+ if (n == 0) {
+ int c = uenc->convert(uenc->userData, *fromP);
+ n = XmlUtf8Encode(c, buf);
+ if (n > toLim - *toP)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ utf8 = buf;
+ *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP]
+ - (BT_LEAD2 - 2));
+ }
+ else {
+ if (n > toLim - *toP)
+- break;
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
+ (*fromP)++;
+ }
+ do {
+@@ -1322,13 +1372,13 @@ unknown_toUtf8(const ENCODING *enc,
+ }
+ }
+
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf16(const ENCODING *enc,
+ const char **fromP, const char *fromLim,
+ unsigned short **toP, const unsigned short *toLim)
+ {
+ const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
+- while (*fromP != fromLim && *toP != toLim) {
++ while (*fromP < fromLim && *toP < toLim) {
+ unsigned short c = uenc->utf16[(unsigned char)**fromP];
+ if (c == 0) {
+ c = (unsigned short)
+@@ -1340,6 +1390,11 @@ unknown_toUtf16(const ENCODING *enc,
+ (*fromP)++;
+ *(*toP)++ = c;
+ }
++
++ if ((*toP == toLim) && (*fromP < fromLim))
++ return XML_CONVERT_OUTPUT_EXHAUSTED;
++ else
++ return XML_CONVERT_COMPLETED;
+ }
+
+ ENCODING *
+@@ -1503,7 +1558,7 @@ initScan(const ENCODING * const *encodingTable,
+ {
+ const ENCODING **encPtr;
+
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ encPtr = enc->encPtr;
+ if (ptr + 1 == end) {
+diff --git a/lib/xmltok.h b/lib/xmltok.h
+index ca867aa..752007e 100644
+--- a/lib/xmltok.h
++++ b/lib/xmltok.h
+@@ -130,6 +130,12 @@ typedef int (PTRCALL *SCANNER)(const ENCODING *,
+ const char *,
+ const char **);
+
++enum XML_Convert_Result {
++ XML_CONVERT_COMPLETED = 0,
++ XML_CONVERT_INPUT_INCOMPLETE = 1,
++ XML_CONVERT_OUTPUT_EXHAUSTED = 2 /* and therefore potentially input remaining as well */
++};
++
+ struct encoding {
+ SCANNER scanners[XML_N_STATES];
+ SCANNER literalScanners[XML_N_LITERAL_TYPES];
+@@ -158,12 +164,12 @@ struct encoding {
+ const char *ptr,
+ const char *end,
+ const char **badPtr);
+- void (PTRCALL *utf8Convert)(const ENCODING *enc,
++ enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc,
+ const char **fromP,
+ const char *fromLim,
+ char **toP,
+ const char *toLim);
+- void (PTRCALL *utf16Convert)(const ENCODING *enc,
++ enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc,
+ const char **fromP,
+ const char *fromLim,
+ unsigned short **toP,
+diff --git a/lib/xmltok_impl.c b/lib/xmltok_impl.c
+index 9c2895b..6c5a3ba 100644
+--- a/lib/xmltok_impl.c
++++ b/lib/xmltok_impl.c
+@@ -93,13 +93,13 @@ static int PTRCALL
+ PREFIX(scanComment)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_MINUS:
+@@ -147,7 +147,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_PERCNT:
+ if (ptr + MINBPC(enc) == end)
+@@ -233,7 +233,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_S: case BT_CR: case BT_LF:
+@@ -242,7 +242,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+ return XML_TOK_INVALID;
+ }
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_QUEST:
+@@ -305,7 +305,7 @@ static int PTRCALL
+ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -348,7 +348,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+ ptr += MINBPC(enc);
+ break;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: \
+@@ -391,11 +391,11 @@ PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_S: case BT_CR: case BT_LF:
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_S: case BT_CR: case BT_LF:
+ break;
+@@ -432,7 +432,7 @@ static int PTRCALL
+ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -441,7 +441,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -464,7 +464,7 @@ static int PTRCALL
+ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+- if (ptr != end) {
++ if (ptr < end) {
+ if (CHAR_MATCHES(enc, ptr, ASCII_x))
+ return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
+ switch (BYTE_TYPE(enc, ptr)) {
+@@ -474,7 +474,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++ for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ break;
+@@ -506,7 +506,7 @@ PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_SEMI:
+@@ -529,7 +529,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
+ #ifdef XML_NS
+ int hadColon = 0;
+ #endif
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -716,7 +716,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+ hadColon = 0;
+ #endif
+ /* we have a start-tag */
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -740,7 +740,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+ case BT_S: case BT_CR: case BT_LF:
+ {
+ ptr += MINBPC(enc);
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
+ case BT_GT:
+@@ -785,7 +785,7 @@ static int PTRCALL
+ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -832,7 +832,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+ ptr += MINBPC(enc);
+ break;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: \
+@@ -895,7 +895,7 @@ PREFIX(scanPercent)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_SEMI:
+@@ -921,7 +921,7 @@ PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_CR: case BT_LF: case BT_S:
+@@ -941,7 +941,7 @@ PREFIX(scanLit)(int open, const ENCODING *enc,
+ const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+- while (ptr != end) {
++ while (ptr < end) {
+ int t = BYTE_TYPE(enc, ptr);
+ switch (t) {
+ INVALID_CASES(ptr, nextTokPtr)
+@@ -973,7 +973,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+ const char **nextTokPtr)
+ {
+ int tok;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ if (MINBPC(enc) > 1) {
+ size_t n = end - ptr;
+@@ -1141,7 +1141,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+ *nextTokPtr = ptr;
+ return XML_TOK_INVALID;
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ case BT_GT: case BT_RPAR: case BT_COMMA:
+@@ -1204,10 +1204,10 @@ PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+ const char *start;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ start = ptr;
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: ptr += n; break;
+@@ -1262,10 +1262,10 @@ PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr,
+ const char *end, const char **nextTokPtr)
+ {
+ const char *start;
+- if (ptr == end)
++ if (ptr >= end)
+ return XML_TOK_NONE;
+ start = ptr;
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+ case BT_LEAD ## n: ptr += n; break;
+@@ -1326,7 +1326,7 @@ PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr,
+ end = ptr + n;
+ }
+ }
+- while (ptr != end) {
++ while (ptr < end) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ INVALID_CASES(ptr, nextTokPtr)
+ case BT_LT:
+@@ -1373,7 +1373,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
+ {
+ ptr += MINBPC(enc);
+ end -= MINBPC(enc);
+- for (; ptr != end; ptr += MINBPC(enc)) {
++ for (; ptr < end; ptr += MINBPC(enc)) {
+ switch (BYTE_TYPE(enc, ptr)) {
+ case BT_DIGIT:
+ case BT_HEX:
+@@ -1760,7 +1760,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
+ case BT_CR:
+ pos->lineNumber++;
+ ptr += MINBPC(enc);
+- if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF)
++ if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF)
+ ptr += MINBPC(enc);
+ pos->columnNumber = (XML_Size)-1;
+ break;
+--
+2.8.2
+
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index e1f111e..066853f 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -44,6 +44,7 @@
(define-public expat
(package
(name "expat")
+ (replacement expat/fixed)
(version "2.1.0")
(source (origin
(method url-fetch)
@@ -62,6 +63,15 @@ stream-oriented parser in which an application registers handlers for
things the parser might find in the XML document (like start tags).")
(license license:expat)))
+(define expat/fixed
+ (package
+ (inherit expat)
+ (source (origin
+ (inherit (package-source expat))
+ (patches (search-patches "expat-CVE-2015-1283.patch"
+ "expat-CVE-2015-1283-refix.patch"
+ "expat-CVE-2016-0718.patch"))))))
+
(define-public libxml2
(package
(name "libxml2")
--
2.8.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718)
2016-05-18 17:37 ` [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Leo Famulari
@ 2016-05-19 12:19 ` Ludovic Courtès
2016-05-19 14:36 ` Leo Famulari
0 siblings, 1 reply; 5+ messages in thread
From: Ludovic Courtès @ 2016-05-19 12:19 UTC (permalink / raw)
To: Leo Famulari; +Cc: guix-devel
Hi!
Leo Famulari <leo@famulari.name> skribis:
> On Wed, May 18, 2016 at 12:36:50PM -0400, Leo Famulari wrote:
>> I've attached my attempt at fixing CVE-2016-0718 in Expat [0]. The
>> grafted expat updates to 2.1.1 and applies the patch from [1].
>>
>> The problem is that, when trying build something that depends on expat,
>> I seem to have to rebuild *many* things.
>
> Of course this would happen, since I had removed the CVE-2015-1283 patch
> from expat package definition. D'oh.
>
> I've attached an updated patch that seems to work as expected.
>
> This patch uses the CVE-2016-0718 patch from Debian [0], which has the
> same diffs but does not require use of (patch-flags).
>
> It also includes an update to the patch for CVE-2015-1283 [1], which
> apparently relied on undefined behavior.
>
> Finally, it does not upgrade to 2.1.1. This patch series does apply to
> 2.1.0.
This variant LGTM.
> --- /dev/null
> +++ b/gnu/packages/patches/expat-CVE-2016-0718.patch
> @@ -0,0 +1,757 @@
> +Copied from Debian
Could you add a URL here, for reference?
> +++ b/gnu/packages/patches/expat-CVE-2016-0718.patch
> @@ -0,0 +1,757 @@
> +Copied from Debian
Same here.
Thank you!
Ludo’.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718)
2016-05-19 12:19 ` Ludovic Courtès
@ 2016-05-19 14:36 ` Leo Famulari
0 siblings, 0 replies; 5+ messages in thread
From: Leo Famulari @ 2016-05-19 14:36 UTC (permalink / raw)
To: Ludovic Courtès; +Cc: guix-devel
On Thu, May 19, 2016 at 02:19:59PM +0200, Ludovic Courtès wrote:
>
> This variant LGTM.
I added links to the patch sources and pushed as 119b83989.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-05-19 14:36 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-05-18 16:36 [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Leo Famulari
2016-05-18 16:36 ` [PATCH 1/1] gnu: expat: Fix CVE-2016-0718 Leo Famulari
2016-05-18 17:37 ` [PATCH 0/1] Help wanted grafting Expat (CVE-2016-0718) Leo Famulari
2016-05-19 12:19 ` Ludovic Courtès
2016-05-19 14:36 ` Leo Famulari
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).