sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-07-18 01:39:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add fix for CVE-2020-25713 raptor2: malformed input file segfault

Browse source 
The sample file in the upstream bug report from the PR causes a
bus error in PORTREVISION 16, and returns an error (as I suppose
it should) now.

PR:		251102
Reported by:	pi
Obtained from:	upstream
This commit is contained in:
Adriaan de Groot 2021-02-20 16:23:19 +00:00
parent 6dd03553fd
commit 1a424bcd31
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=566164
2 changed files with 34 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
textproc/raptor2/Makefile
View file

@ -3,7 +3,7 @@
PORTNAME= raptor2
PORTVERSION= 2.0.15
PORTREVISION= 16
PORTREVISION= 17
CATEGORIES= textproc
MASTER_SITES= http://download.librdf.org/source/ \
SF/librdf/${PORTNAME}/${PORTVERSION}

33
textproc/raptor2/files/patch-CVE-2020-25713 Normal file
View file

@ -0,0 +1,33 @@
From a549457461874157c8c8e8e8a6e0eec06da4fbd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Tue, 24 Nov 2020 10:30:20 +0000
Subject: [PATCH] CVE-2020-25713 raptor2: malformed input file can lead to a
segfault
due to an out of bounds array access in
raptor_xml_writer_start_element_common
See:
https://bugs.mageia.org/show_bug.cgi?id=27605
https://www.openwall.com/lists/oss-security/2020/11/13/1
https://gerrit.libreoffice.org/c/core/+/106249
---
src/raptor_xml_writer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c
index 56993dc3..4426d38c 100644
--- src/raptor_xml_writer.c
+++ src/raptor_xml_writer.c
@@ -227,7 +227,7 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer,
/* check it wasn't an earlier declaration too */
for(j = 0; j < nspace_declarations_count; j++)
- if(nspace_declarations[j].nspace == element->attributes[j]->nspace) {
+ if(nspace_declarations[j].nspace == element->attributes[i]->nspace) {
declare_me = 0;
break;
}
--
2.28.0