unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
blob f7abab069c334728a428b0178a1419501ae1a0c4 1318 bytes (raw)
name: gnu/packages/patches/expat-CVE-2015-1283-refix.patch 	 # note: path name is non-authoritative(*)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
Copied from Debian

From 29a11774d8ebbafe8418b4a5ffb4cc1160b194a1 Mon Sep 17 00:00:00 2001
From: Pascal Cuoq <cuoq@trust-in-soft.com>
Date: Sun, 15 May 2016 09:05:46 +0200
Subject: [PATCH] Avoid relying on undefined behavior in CVE-2015-1283 fix.

---
 expat/lib/xmlparse.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 13e080d..cdb12ef 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -1695,7 +1695,8 @@ XML_GetBuffer(XML_Parser parser, int len
   }
 
   if (len > bufferLim - bufferEnd) {
-    int neededSize = len + (int)(bufferEnd - bufferPtr);
+    /* Do not invoke signed arithmetic overflow: */
+    int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
 /* BEGIN MOZILLA CHANGE (sanity check neededSize) */
     if (neededSize < 0) {
       errorCode = XML_ERROR_NO_MEMORY;
@@ -1729,7 +1730,8 @@ XML_GetBuffer(XML_Parser parser, int len
       if (bufferSize == 0)
         bufferSize = INIT_BUFFER_SIZE;
       do {
-        bufferSize *= 2;
+        /* Do not invoke signed arithmetic overflow: */
+        bufferSize = (int) (2U * (unsigned) bufferSize);
 /* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */
       } while (bufferSize < neededSize && bufferSize > 0);
 /* END MOZILLA CHANGE */
-- 
2.8.2


debug log:

solving df31407 ...
found df31407 in https://yhetil.org/guix-devel/20160518173731.GA26295@jasmine/

applying [1/1] https://yhetil.org/guix-devel/20160518173731.GA26295@jasmine/
diff --git a/gnu/packages/patches/expat-CVE-2015-1283-refix.patch b/gnu/packages/patches/expat-CVE-2015-1283-refix.patch
new file mode 100644
index 0000000..df31407

1:24: trailing whitespace.
 
1:42: trailing whitespace.
-- 
Checking patch gnu/packages/patches/expat-CVE-2015-1283-refix.patch...
1:44: new blank line at EOF.
+
Applied patch gnu/packages/patches/expat-CVE-2015-1283-refix.patch cleanly.
warning: 3 lines add whitespace errors.

index at:
100644 f7abab069c334728a428b0178a1419501ae1a0c4	gnu/packages/patches/expat-CVE-2015-1283-refix.patch

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).