File Fix-CVE-2021-31229-bug-26-CVE-2019-20201-bug-16... of Package netcdf

Overview Repositories Revisions Requests Users Attributes Meta

File Fix-CVE-2021-31229-bug-26-CVE-2019-20201-bug-16-CVE-2019-20198-bug-20.patch of Package netcdf

From: Egbert Eich <eich@suse.com>
Date: Mon Oct 25 15:52:52 2021 +0200
Subject: Fix CVE-2021-31229 bug 26, CVE-2019-20201 bug 16, CVE-2019-20198 bug 20
Patch-mainline: Not yet
Git-commit: 1cb6d05b0a2e93d924c7db0cf0e69c6d4cf7e6a9
References:

This Fixes
 https://sourceforge.net/p/ezxml/bugs/26/
 https://sourceforge.net/p/ezxml/bugs/16/
 https://sourceforge.net/p/ezxml/bugs/20/

Signed-off-by: Egbert Eich <eich@suse.com>
---
 libdap4/ezxml.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/libdap4/ezxml.c b/libdap4/ezxml.c
index 804a833..68e03d5 100644
--- a/libdap4/ezxml.c
+++ b/libdap4/ezxml.c
@@ -318,6 +318,7 @@ short ezxml_internal_dtd(ezxml_root_t root, char *s, size_t len)
 {
     char q, *c, *t, *n = NULL, *v, **ent, **pe;
     int i, j;
+    size_t n_len, n_off;
     
     pe = memcpy(malloc(sizeof(EZXML_NIL)), EZXML_NIL, sizeof(EZXML_NIL));
 
@@ -328,7 +329,13 @@ short ezxml_internal_dtd(ezxml_root_t root, char *s, size_t len)
         else if (! strncmp(s, "<!ENTITY", 8)) { /* parse entity definitions*/
             c = s += strspn(s + 8, EZXML_WS) + 8; /* skip white space separator*/
             n = s + strspn(s, EZXML_WS "%"); /* find name*/
-            *(s = n + strcspn(n, EZXML_WS)) = ';'; /* append ; to name*/
+            n_len = strlen(n);
+            n_off = strcspn(n, EZXML_WS);
+            if(n_off >= n_len) {
+                ezxml_err(root, NULL, "write past buffer (<!ENTITY)");
+                break;
+            }
+            *(s = n + n_off) = ';'; // append ; to name
 
             v = s + strspn(s + 1, EZXML_WS) + 1; /* find value*/
             if ((q = *(v++)) != '"' && q != '\'') { /* skip externals*/

Places

File Fix-CVE-2021-31229-bug-26-CVE-2019-20201-bug-16-CVE-2019-20198-bug-20.patch of Package netcdf

Places