File expat-CVE-2022-23990.patch of Package expat.35528

Overview Repositories Revisions Requests Users Attributes Meta

File expat-CVE-2022-23990.patch of Package expat.35528

From ede41d1e186ed2aba88a06e84cac839b770af3a1 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Wed, 26 Jan 2022 02:36:43 +0100
Subject: [PATCH] lib: Prevent integer overflow in doProlog (CVE-2022-23990)

The change from "int nameLen" to "size_t nameLen"
addresses the overflow on "nameLen++" in code
"for (; name[nameLen++];)" right above the second
change in the patch.
---
 expat/lib/xmlparse.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Index: expat-2.1.0/lib/xmlparse.c
===================================================================
--- expat-2.1.0.orig/lib/xmlparse.c
+++ expat-2.1.0/lib/xmlparse.c
@@ -4824,7 +4824,7 @@ doProlog(XML_Parser parser,
       if (dtd->in_eldecl) {
         ELEMENT_TYPE *el;
         const XML_Char *name;
-        int nameLen;
+        size_t nameLen;
         const char *nxt = (quant == XML_CQUANT_NONE
                            ? next
                            : next - enc->minBytesPerChar);
@@ -4840,7 +4840,13 @@ doProlog(XML_Parser parser,
         dtd->scaffold[myindex].name = name;
         nameLen = 0;
         for (; name[nameLen++]; );
-        dtd->contentStringLen +=  nameLen;
+
+        /* Detect and prevent integer overflow */
+        if (nameLen > UINT_MAX - dtd->contentStringLen) {
+          return XML_ERROR_NO_MEMORY;
+        }
+
+        dtd->contentStringLen += (unsigned)nameLen;
         if (elementDeclHandler)
           handleDefault = XML_FALSE;
       }

Places

File expat-CVE-2022-23990.patch of Package expat.35528

Places