From 93d05cd472ba04254c75450685f8cf7e40a44000 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Mon, 31 Jan 2022 21:52:06 +0100 Subject: [PATCH] expat: 2.4.3 -> 2.4.4 --- .../libraries/expat/CVE-2022-23852-fix.patch | 26 --------- .../libraries/expat/CVE-2022-23852-test.patch | 55 ------------------- .../libraries/expat/CVE-2022-23990.patch | 41 -------------- pkgs/development/libraries/expat/default.nix | 11 +--- 4 files changed, 2 insertions(+), 131 deletions(-) delete mode 100644 pkgs/development/libraries/expat/CVE-2022-23852-fix.patch delete mode 100644 pkgs/development/libraries/expat/CVE-2022-23852-test.patch delete mode 100644 pkgs/development/libraries/expat/CVE-2022-23990.patch diff --git a/pkgs/development/libraries/expat/CVE-2022-23852-fix.patch b/pkgs/development/libraries/expat/CVE-2022-23852-fix.patch deleted file mode 100644 index fbbd080db4ed..000000000000 --- a/pkgs/development/libraries/expat/CVE-2022-23852-fix.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 847a645152f5ebc10ac63b74b604d0c1a79fae40 Mon Sep 17 00:00:00 2001 -From: Samanta Navarro -Date: Sat, 22 Jan 2022 17:48:00 +0100 -Subject: [PATCH] lib: Detect and prevent integer overflow in XML_GetBuffer - (CVE-2022-23852) - ---- - expat/lib/xmlparse.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c -index d54af683..5ce31402 100644 ---- a/expat/lib/xmlparse.c -+++ b/expat/lib/xmlparse.c -@@ -2067,6 +2067,11 @@ XML_GetBuffer(XML_Parser parser, int len) { - keep = (int)EXPAT_SAFE_PTR_DIFF(parser->m_bufferPtr, parser->m_buffer); - if (keep > XML_CONTEXT_BYTES) - keep = XML_CONTEXT_BYTES; -+ /* Detect and prevent integer overflow */ -+ if (keep > INT_MAX - neededSize) { -+ parser->m_errorCode = XML_ERROR_NO_MEMORY; -+ return NULL; -+ } - neededSize += keep; - #endif /* defined XML_CONTEXT_BYTES */ - if (neededSize diff --git a/pkgs/development/libraries/expat/CVE-2022-23852-test.patch b/pkgs/development/libraries/expat/CVE-2022-23852-test.patch deleted file mode 100644 index 3dca8f914a8f..000000000000 --- a/pkgs/development/libraries/expat/CVE-2022-23852-test.patch +++ /dev/null @@ -1,55 +0,0 @@ -From acf956f14bf79a5e6383a969aaffec98bfbc2e44 Mon Sep 17 00:00:00 2001 -From: Sebastian Pipping -Date: Sun, 23 Jan 2022 18:17:04 +0100 -Subject: [PATCH] tests: Cover integer overflow in XML_GetBuffer - (CVE-2022-23852) - ---- - expat/tests/runtests.c | 27 +++++++++++++++++++++++++++ - 1 file changed, 27 insertions(+) - -diff --git a/expat/tests/runtests.c b/expat/tests/runtests.c -index e89e8220..579dad1a 100644 ---- a/expat/tests/runtests.c -+++ b/expat/tests/runtests.c -@@ -3847,6 +3847,30 @@ START_TEST(test_get_buffer_2) { - } - END_TEST - -+/* Test for signed integer overflow CVE-2022-23852 */ -+#if defined(XML_CONTEXT_BYTES) -+START_TEST(test_get_buffer_3_overflow) { -+ XML_Parser parser = XML_ParserCreate(NULL); -+ assert(parser != NULL); -+ -+ const char *const text = "\n"; -+ const int expectedKeepValue = (int)strlen(text); -+ -+ // After this call, variable "keep" in XML_GetBuffer will -+ // have value expectedKeepValue -+ if (XML_Parse(parser, text, (int)strlen(text), XML_FALSE /* isFinal */) -+ == XML_STATUS_ERROR) -+ xml_failure(parser); -+ -+ assert(expectedKeepValue > 0); -+ if (XML_GetBuffer(parser, INT_MAX - expectedKeepValue + 1) != NULL) -+ fail("enlarging buffer not failed"); -+ -+ XML_ParserFree(parser); -+} -+END_TEST -+#endif // defined(XML_CONTEXT_BYTES) -+ - /* Test position information macros */ - START_TEST(test_byte_info_at_end) { - const char *text = ""; -@@ -11731,6 +11755,9 @@ make_suite(void) { - tcase_add_test(tc_basic, test_empty_parse); - tcase_add_test(tc_basic, test_get_buffer_1); - tcase_add_test(tc_basic, test_get_buffer_2); -+#if defined(XML_CONTEXT_BYTES) -+ tcase_add_test(tc_basic, test_get_buffer_3_overflow); -+#endif - tcase_add_test(tc_basic, test_byte_info_at_end); - tcase_add_test(tc_basic, test_byte_info_at_error); - tcase_add_test(tc_basic, test_byte_info_at_cdata); diff --git a/pkgs/development/libraries/expat/CVE-2022-23990.patch b/pkgs/development/libraries/expat/CVE-2022-23990.patch deleted file mode 100644 index 32d7c420b943..000000000000 --- a/pkgs/development/libraries/expat/CVE-2022-23990.patch +++ /dev/null @@ -1,41 +0,0 @@ -From ede41d1e186ed2aba88a06e84cac839b770af3a1 Mon Sep 17 00:00:00 2001 -From: Sebastian Pipping -Date: Wed, 26 Jan 2022 02:36:43 +0100 -Subject: [PATCH] lib: Prevent integer overflow in doProlog (CVE-2022-23990) - -The change from "int nameLen" to "size_t nameLen" -addresses the overflow on "nameLen++" in code -"for (; name[nameLen++];)" right above the second -change in the patch. ---- - expat/lib/xmlparse.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c -index 5ce31402..d1d17005 100644 ---- a/expat/lib/xmlparse.c -+++ b/expat/lib/xmlparse.c -@@ -5372,7 +5372,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, - if (dtd->in_eldecl) { - ELEMENT_TYPE *el; - const XML_Char *name; -- int nameLen; -+ size_t nameLen; - const char *nxt - = (quant == XML_CQUANT_NONE ? next : next - enc->minBytesPerChar); - int myindex = nextScaffoldPart(parser); -@@ -5388,7 +5388,13 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, - nameLen = 0; - for (; name[nameLen++];) - ; -- dtd->contentStringLen += nameLen; -+ -+ /* Detect and prevent integer overflow */ -+ if (nameLen > UINT_MAX - dtd->contentStringLen) { -+ return XML_ERROR_NO_MEMORY; -+ } -+ -+ dtd->contentStringLen += (unsigned)nameLen; - if (parser->m_elementDeclHandler) - handleDefault = XML_FALSE; - } diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix index 371126f4b0dc..322c6ecebbf6 100644 --- a/pkgs/development/libraries/expat/default.nix +++ b/pkgs/development/libraries/expat/default.nix @@ -7,20 +7,13 @@ stdenv.mkDerivation rec { pname = "expat"; - version = "2.4.3"; + version = "2.4.4"; src = fetchurl { url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz"; - sha256 = "sha256-sfnxsaXrsKyqiMn/eb+k4UWCO3iqUYXlxdhfBggkd4o="; + sha256 = "sha256-tdJdbjczUcLtGbVitHMtAdJYmsjI6eeWLY3xIHzDEbg="; }; - patches = [ - ./CVE-2022-23852-fix.patch - ./CVE-2022-23852-test.patch - ./CVE-2022-23990.patch - ]; - patchFlags = "-p2"; - outputs = [ "out" "dev" ]; # TODO: fix referrers outputBin = "dev";