43 lines
2.7 KiB
Diff
43 lines
2.7 KiB
Diff
From 3f0a0cb644438d4d8e3294cd0b1245d0edb0c6c6 Mon Sep 17 00:00:00 2001
|
|
From: Sebastian Pipping <sebastian@pipping.org>
|
|
Date: Tue, 8 Feb 2022 04:32:20 +0100
|
|
Subject: [PATCH] lib: Add missing validation of encoding (CVE-2022-25235)
|
|
|
|
---
|
|
lib/xmltok_impl.c | 8 ++++++--
|
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/lib/xmltok_impl.c b/lib/xmltok_impl.c
|
|
index 0430591b4..64a3b2c15 100644
|
|
--- a/lib/xmltok_impl.c
|
|
+++ b/lib/xmltok_impl.c
|
|
@@ -69,7 +69,7 @@
|
|
case BT_LEAD##n: \
|
|
if (end - ptr < n) \
|
|
return XML_TOK_PARTIAL_CHAR; \
|
|
- if (! IS_NAME_CHAR(enc, ptr, n)) { \
|
|
+ if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NAME_CHAR(enc, ptr, n)) { \
|
|
*nextTokPtr = ptr; \
|
|
return XML_TOK_INVALID; \
|
|
} \
|
|
@@ -98,7 +98,7 @@
|
|
case BT_LEAD##n: \
|
|
if (end - ptr < n) \
|
|
return XML_TOK_PARTIAL_CHAR; \
|
|
- if (! IS_NMSTRT_CHAR(enc, ptr, n)) { \
|
|
+ if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NMSTRT_CHAR(enc, ptr, n)) { \
|
|
*nextTokPtr = ptr; \
|
|
return XML_TOK_INVALID; \
|
|
} \
|
|
@@ -1142,6 +1142,10 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
|
|
case BT_LEAD##n: \
|
|
if (end - ptr < n) \
|
|
return XML_TOK_PARTIAL_CHAR; \
|
|
+ if (IS_INVALID_CHAR(enc, ptr, n)) { \
|
|
+ *nextTokPtr = ptr; \
|
|
+ return XML_TOK_INVALID; \
|
|
+ } \
|
|
if (IS_NMSTRT_CHAR(enc, ptr, n)) { \
|
|
ptr += n; \
|
|
tok = XML_TOK_NAME; \
|