File Fix-for-CVE-2021-26221-ezxml-bug-21.patch of Package netcdf.34857

Overview Repositories Revisions Requests Users Attributes Meta

File Fix-for-CVE-2021-26221-ezxml-bug-21.patch of Package netcdf.34857

From: Egbert Eich <eich@suse.com>
Date: Mon Oct 25 15:44:54 2021 +0200
Subject: Fix for CVE-2021-26221 / ezxml bug 21

Make sure malloc() succeeds.

This fixes
 https://sourceforge.net/p/ezxml/bugs/21/

Signed-off-by: Egbert Eich <eich@suse.com>
---
 netcdf-c-4.8.0/libdap4/ezxml.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/netcdf-c-4.8.0/libdap4/ezxml.c b/netcdf-c-4.8.0/libdap4/ezxml.c
index 144fa2d..6c535ff 100644
--- a/libdap4/ezxml.c
+++ b/libdap4/ezxml.c
@@ -482,6 +482,7 @@ ezxml_t ezxml_parse_str(char *s, size_t len)
     char q, e, *d, **attr, **a = NULL; /* initialize a to avoid compile warning*/
     int l, i, j;
 
+    if (!root) return NULL; // bug#21 / CVE-2021-26221
     root->m = s;
     if (! len) return ezxml_err(root, NULL, "root tag missing");
     root->u = ezxml_str2utf8(&s, &len); /* convert utf-16 to utf-8*/
@@ -803,8 +804,9 @@ ezxml_t ezxml_new(const char *name)
 {
     static const char *entities[] = { "lt;", "&#60;", "gt;", "&#62;", "quot;", "&#34;",
                            "apos;", "&#39;", "amp;", "&#38;", NULL };
-    ezxml_root_t root = (ezxml_root_t)memset(malloc(sizeof(struct ezxml_root)),
-                                             '\0', sizeof(struct ezxml_root));
+    ezxml_root_t root;
+    if (!(root  = malloc(sizeof(struct ezxml_root)))) return NULL;  // bug#21
+    root = (ezxml_root_t)memset(root, '\0', sizeof(struct ezxml_root));
     root->xml.name = (char *)name;
     root->cur = &root->xml;
     strcpy(root->err, root->xml.txt = "");

Places

File Fix-for-CVE-2021-26221-ezxml-bug-21.patch of Package netcdf.34857

Places