mirror of
https://git.yoctoproject.org/git/poky
synced 2026-01-04 16:10:04 +00:00
2156b7931e
Pick commit referencing this CVE from 2.13 branch. (From OE-Core rev: 061610dfca8a72b71e1baca3ad4aa2c9fb64449b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
104 lines
4.5 KiB
Diff
104 lines
4.5 KiB
Diff
From 5e9ec5c107d3f5b5179c3dbc19df43df041cd55b Mon Sep 17 00:00:00 2001
|
|
From: Michael Mann <mmann78@netscape.net>
|
|
Date: Fri, 20 Jun 2025 23:05:00 -0400
|
|
Subject: [PATCH] [CVE-2025-6170] Fix potential buffer overflows of interactive
|
|
shell
|
|
|
|
Fixes #941
|
|
|
|
CVE: CVE-2025-6170
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c107d3f5b5179c3dbc19df43df041cd55b]
|
|
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
|
---
|
|
debugXML.c | 15 ++++++++++-----
|
|
result/scripts/long_command | 8 ++++++++
|
|
test/scripts/long_command.script | 6 ++++++
|
|
test/scripts/long_command.xml | 1 +
|
|
4 files changed, 25 insertions(+), 5 deletions(-)
|
|
create mode 100644 result/scripts/long_command
|
|
create mode 100644 test/scripts/long_command.script
|
|
create mode 100644 test/scripts/long_command.xml
|
|
|
|
diff --git a/debugXML.c b/debugXML.c
|
|
index ed56b0f8..452b9573 100644
|
|
--- a/debugXML.c
|
|
+++ b/debugXML.c
|
|
@@ -1043,6 +1043,10 @@ xmlCtxtDumpOneNode(xmlDebugCtxtPtr ctxt, xmlNodePtr node)
|
|
xmlCtxtGenericNodeCheck(ctxt, node);
|
|
}
|
|
|
|
+#define MAX_PROMPT_SIZE 500
|
|
+#define MAX_ARG_SIZE 400
|
|
+#define MAX_COMMAND_SIZE 100
|
|
+
|
|
/**
|
|
* xmlCtxtDumpNode:
|
|
* @output: the FILE * for the output
|
|
@@ -2794,10 +2798,10 @@ void
|
|
xmlShell(xmlDocPtr doc, char *filename, xmlShellReadlineFunc input,
|
|
FILE * output)
|
|
{
|
|
- char prompt[500] = "/ > ";
|
|
+ char prompt[MAX_PROMPT_SIZE] = "/ > ";
|
|
char *cmdline = NULL, *cur;
|
|
- char command[100];
|
|
- char arg[400];
|
|
+ char command[MAX_COMMAND_SIZE];
|
|
+ char arg[MAX_ARG_SIZE];
|
|
int i;
|
|
xmlShellCtxtPtr ctxt;
|
|
xmlXPathObjectPtr list;
|
|
@@ -2855,7 +2859,8 @@ xmlShell(xmlDocPtr doc, char *filename, xmlShellReadlineFunc input,
|
|
cur++;
|
|
i = 0;
|
|
while ((*cur != ' ') && (*cur != '\t') &&
|
|
- (*cur != '\n') && (*cur != '\r')) {
|
|
+ (*cur != '\n') && (*cur != '\r') &&
|
|
+ (i < (MAX_COMMAND_SIZE - 1))) {
|
|
if (*cur == 0)
|
|
break;
|
|
command[i++] = *cur++;
|
|
@@ -2870,7 +2875,7 @@ xmlShell(xmlDocPtr doc, char *filename, xmlShellReadlineFunc input,
|
|
while ((*cur == ' ') || (*cur == '\t'))
|
|
cur++;
|
|
i = 0;
|
|
- while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
|
|
+ while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) {
|
|
if (*cur == 0)
|
|
break;
|
|
arg[i++] = *cur++;
|
|
diff --git a/result/scripts/long_command b/result/scripts/long_command
|
|
new file mode 100644
|
|
index 00000000..e6f00708
|
|
--- /dev/null
|
|
+++ b/result/scripts/long_command
|
|
@@ -0,0 +1,8 @@
|
|
+/ > b > b > Object is a Node Set :
|
|
+Set contains 1 nodes:
|
|
+1 ELEMENT a:c
|
|
+b > Unknown command This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_comm
|
|
+b > b > Unknown command ess_currents_of_time_and_existence
|
|
+b > <?xml version="1.0"?>
|
|
+<a xmlns:a="bar"><b xmlns:a="foo">Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_prof</b></a>
|
|
+b >
|
|
\ No newline at end of file
|
|
diff --git a/test/scripts/long_command.script b/test/scripts/long_command.script
|
|
new file mode 100644
|
|
index 00000000..00f6df09
|
|
--- /dev/null
|
|
+++ b/test/scripts/long_command.script
|
|
@@ -0,0 +1,6 @@
|
|
+cd a/b
|
|
+set <a:c/>
|
|
+xpath //*[namespace-uri()="foo"]
|
|
+This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_command_please_dont_crash foo
|
|
+set Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_profound_emotion_and_every_grand_aspiration_that_propels_our_species_ever_onward_through_the_relentless_currents_of_time_and_existence
|
|
+save -
|
|
diff --git a/test/scripts/long_command.xml b/test/scripts/long_command.xml
|
|
new file mode 100644
|
|
index 00000000..1ba44016
|
|
--- /dev/null
|
|
+++ b/test/scripts/long_command.xml
|
|
@@ -0,0 +1 @@
|
|
+<a xmlns:a="bar"><b xmlns:a="foo"/></a>
|