* [meta][dunfell][PATCH] libxml2: Add fix for CVE-2016-3709
@ 2022-08-24 11:53 pawan
2022-08-28 2:54 ` [OE-core] " Robert Joslyn
0 siblings, 1 reply; 4+ messages in thread
From: pawan @ 2022-08-24 11:53 UTC (permalink / raw)
To: openembedded-core, badganchipv; +Cc: ranjitsinh.rathod
From: Pawan Badganchi <badganchipv@gmail.com>
Add below patch to fix CVE-2016-3709
CVE-2016-3709.patch
Link: https://github.com/GNOME/libxml2/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f
Signed-off-by: Pawan Badganchi<badganchipv@gmail.com>
---
.../libxml/libxml2/CVE-2016-3709.patch | 89 +++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 2 +-
2 files changed, 90 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch
new file mode 100644
index 0000000000..5301d05323
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch
@@ -0,0 +1,89 @@
+From c1ba6f54d32b707ca6d91cb3257ce9de82876b6f Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sat, 15 Aug 2020 18:32:29 +0200
+Subject: [PATCH] Revert "Do not URI escape in server side includes"
+
+This reverts commit 960f0e275616cadc29671a218d7fb9b69eb35588.
+
+This commit introduced
+
+- an infinite loop, found by OSS-Fuzz, which could be easily fixed.
+- an algorithm with quadratic runtime
+- a security issue, see
+ https://bugzilla.gnome.org/show_bug.cgi?id=769760
+
+A better approach is to add an option not to escape URLs at all
+which libxml2 should have possibly done in the first place.
+
+CVE: CVE-2016-3709
+Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f]
+Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
+---
+ HTMLtree.c | 49 +++++++++++--------------------------------------
+ 1 file changed, 11 insertions(+), 38 deletions(-)
+
+diff --git a/HTMLtree.c b/HTMLtree.c
+index 8d236bb35..cdb7f86a6 100644
+--- a/HTMLtree.c
++++ b/HTMLtree.c
+@@ -706,49 +706,22 @@ htmlAttrDumpOutput(xmlOutputBufferPtr buf, xmlDocPtr doc, xmlAttrPtr cur,
+ (!xmlStrcasecmp(cur->name, BAD_CAST "src")) ||
+ ((!xmlStrcasecmp(cur->name, BAD_CAST "name")) &&
+ (!xmlStrcasecmp(cur->parent->name, BAD_CAST "a"))))) {
++ xmlChar *escaped;
+ xmlChar *tmp = value;
+- /* xmlURIEscapeStr() escapes '"' so it can be safely used. */
+- xmlBufCCat(buf->buffer, "\"");
+
+ while (IS_BLANK_CH(*tmp)) tmp++;
+
+- /* URI Escape everything, except server side includes. */
+- for ( ; ; ) {
+- xmlChar *escaped;
+- xmlChar endChar;
+- xmlChar *end = NULL;
+- xmlChar *start = (xmlChar *)xmlStrstr(tmp, BAD_CAST "<!--");
+- if (start != NULL) {
+- end = (xmlChar *)xmlStrstr(tmp, BAD_CAST "-->");
+- if (end != NULL) {
+- *start = '\0';
+- }
+- }
+-
+- /* Escape the whole string, or until start (set to '\0'). */
+- escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+");
+- if (escaped != NULL) {
+- xmlBufCat(buf->buffer, escaped);
+- xmlFree(escaped);
+- } else {
+- xmlBufCat(buf->buffer, tmp);
+- }
+-
+- if (end == NULL) { /* Everything has been written. */
+- break;
+- }
+-
+- /* Do not escape anything within server side includes. */
+- *start = '<'; /* Restore the first character of "<!--". */
+- end += 3; /* strlen("-->") */
+- endChar = *end;
+- *end = '\0';
+- xmlBufCat(buf->buffer, start);
+- *end = endChar;
+- tmp = end;
++ /*
++ * the < and > have already been escaped at the entity level
++ * And doing so here breaks server side includes
++ */
++ escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+<>");
++ if (escaped != NULL) {
++ xmlBufWriteQuotedString(buf->buffer, escaped);
++ xmlFree(escaped);
++ } else {
++ xmlBufWriteQuotedString(buf->buffer, value);
+ }
+-
+- xmlBufCCat(buf->buffer, "\"");
+ } else {
+ xmlBufWriteQuotedString(buf->buffer, value);
+ }
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb
index d1c1f0884f..adeef5bda2 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb
@@ -32,7 +32,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar.gz;subdir=${BP};name=te
file://CVE-2022-23308-fix-regression.patch \
file://CVE-2022-29824-dependent.patch \
file://CVE-2022-29824.patch \
- file://0001-Port-gentest.py-to-Python-3.patch \
+ file://CVE-2016-3709.patch \
"
SRC_URI[archive.sha256sum] = "593b7b751dd18c2d6abcd0c4bcb29efc203d0b4373a6df98e3a455ea74ae2813"
--
2.37.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [OE-core] [meta][dunfell][PATCH] libxml2: Add fix for CVE-2016-3709
2022-08-24 11:53 [meta][dunfell][PATCH] libxml2: Add fix for CVE-2016-3709 pawan
@ 2022-08-28 2:54 ` Robert Joslyn
2022-08-28 9:44 ` Pawan
2022-08-28 9:47 ` Pawan
0 siblings, 2 replies; 4+ messages in thread
From: Robert Joslyn @ 2022-08-28 2:54 UTC (permalink / raw)
To: Pawan Badganchi; +Cc: openembedded-core, ranjitsinh.rathod
> On Aug 24, 2022, at 4:53 AM, Pawan Badganchi <badganchipv@gmail.com> wrote:
>
> From: Pawan Badganchi <badganchipv@gmail.com>
>
> Add below patch to fix CVE-2016-3709
>
> CVE-2016-3709.patch
> Link: https://github.com/GNOME/libxml2/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f
>
> Signed-off-by: Pawan Badganchi<badganchipv@gmail.com>
> ---
> .../libxml/libxml2/CVE-2016-3709.patch | 89 +++++++++++++++++++
> meta/recipes-core/libxml/libxml2_2.9.10.bb | 2 +-
> 2 files changed, 90 insertions(+), 1 deletion(-)
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch
>
> diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch
> new file mode 100644
> index 0000000000..5301d05323
> --- /dev/null
> +++ b/meta/recipes-core/libxml/libxml2/CVE-2016-3709.patch
> @@ -0,0 +1,89 @@
> +From c1ba6f54d32b707ca6d91cb3257ce9de82876b6f Mon Sep 17 00:00:00 2001
> +From: Nick Wellnhofer <wellnhofer@aevum.de>
> +Date: Sat, 15 Aug 2020 18:32:29 +0200
> +Subject: [PATCH] Revert "Do not URI escape in server side includes"
> +
> +This reverts commit 960f0e275616cadc29671a218d7fb9b69eb35588.
> +
> +This commit introduced
> +
> +- an infinite loop, found by OSS-Fuzz, which could be easily fixed.
> +- an algorithm with quadratic runtime
> +- a security issue, see
> + https://bugzilla.gnome.org/show_bug.cgi?id=769760
> +
> +A better approach is to add an option not to escape URLs at all
> +which libxml2 should have possibly done in the first place.
> +
> +CVE: CVE-2016-3709
> +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f]
> +Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
> +---
> + HTMLtree.c | 49 +++++++++++--------------------------------------
> + 1 file changed, 11 insertions(+), 38 deletions(-)
> +
> +diff --git a/HTMLtree.c b/HTMLtree.c
> +index 8d236bb35..cdb7f86a6 100644
> +--- a/HTMLtree.c
> ++++ b/HTMLtree.c
> +@@ -706,49 +706,22 @@ htmlAttrDumpOutput(xmlOutputBufferPtr buf, xmlDocPtr doc, xmlAttrPtr cur,
> + (!xmlStrcasecmp(cur->name, BAD_CAST "src")) ||
> + ((!xmlStrcasecmp(cur->name, BAD_CAST "name")) &&
> + (!xmlStrcasecmp(cur->parent->name, BAD_CAST "a"))))) {
> ++ xmlChar *escaped;
> + xmlChar *tmp = value;
> +- /* xmlURIEscapeStr() escapes '"' so it can be safely used. */
> +- xmlBufCCat(buf->buffer, "\"");
> +
> + while (IS_BLANK_CH(*tmp)) tmp++;
> +
> +- /* URI Escape everything, except server side includes. */
> +- for ( ; ; ) {
> +- xmlChar *escaped;
> +- xmlChar endChar;
> +- xmlChar *end = NULL;
> +- xmlChar *start = (xmlChar *)xmlStrstr(tmp, BAD_CAST "<!--");
> +- if (start != NULL) {
> +- end = (xmlChar *)xmlStrstr(tmp, BAD_CAST "-->");
> +- if (end != NULL) {
> +- *start = '\0';
> +- }
> +- }
> +-
> +- /* Escape the whole string, or until start (set to '\0'). */
> +- escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+");
> +- if (escaped != NULL) {
> +- xmlBufCat(buf->buffer, escaped);
> +- xmlFree(escaped);
> +- } else {
> +- xmlBufCat(buf->buffer, tmp);
> +- }
> +-
> +- if (end == NULL) { /* Everything has been written. */
> +- break;
> +- }
> +-
> +- /* Do not escape anything within server side includes. */
> +- *start = '<'; /* Restore the first character of "<!--". */
> +- end += 3; /* strlen("-->") */
> +- endChar = *end;
> +- *end = '\0';
> +- xmlBufCat(buf->buffer, start);
> +- *end = endChar;
> +- tmp = end;
> ++ /*
> ++ * the < and > have already been escaped at the entity level
> ++ * And doing so here breaks server side includes
> ++ */
> ++ escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+<>");
> ++ if (escaped != NULL) {
> ++ xmlBufWriteQuotedString(buf->buffer, escaped);
> ++ xmlFree(escaped);
> ++ } else {
> ++ xmlBufWriteQuotedString(buf->buffer, value);
> + }
> +-
> +- xmlBufCCat(buf->buffer, "\"");
> + } else {
> + xmlBufWriteQuotedString(buf->buffer, value);
> + }
> diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb
> index d1c1f0884f..adeef5bda2 100644
> --- a/meta/recipes-core/libxml/libxml2_2.9.10.bb
> +++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb
> @@ -32,7 +32,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar.gz;subdir=${BP};name=te
> file://CVE-2022-23308-fix-regression.patch \
> file://CVE-2022-29824-dependent.patch \
> file://CVE-2022-29824.patch \
> - file://0001-Port-gentest.py-to-Python-3.patch \
Did you intend to remove applying this patch? I assume not, but maybe there is something I’m not seeing. If you did intend to remove it, the patch file is still in the repo and the commit message doesn’t mention why it was removed.
Thanks,
Robert
> + file://CVE-2016-3709.patch \
> "
>
> SRC_URI[archive.sha256sum] = "593b7b751dd18c2d6abcd0c4bcb29efc203d0b4373a6df98e3a455ea74ae2813"
> --
> 2.37.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#169808): https://lists.openembedded.org/g/openembedded-core/message/169808
> Mute This Topic: https://lists.openembedded.org/mt/93224781/1348415
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [robert.joslyn@redrectangle.org]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [meta][dunfell][PATCH] libxml2: Add fix for CVE-2016-3709
2022-08-28 2:54 ` [OE-core] " Robert Joslyn
@ 2022-08-28 9:44 ` Pawan
2022-08-28 9:47 ` Pawan
1 sibling, 0 replies; 4+ messages in thread
From: Pawan @ 2022-08-28 9:44 UTC (permalink / raw)
To: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 179 bytes --]
Hello Robert,
I have created new patch and sent. Please add that to in dunfell branch.
This patch 0001-Port-gentest.py-to-Python-3.patch should not be removed. Sorry for that.
[-- Attachment #2: Type: text/html, Size: 236 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [meta][dunfell][PATCH] libxml2: Add fix for CVE-2016-3709
2022-08-28 2:54 ` [OE-core] " Robert Joslyn
2022-08-28 9:44 ` Pawan
@ 2022-08-28 9:47 ` Pawan
1 sibling, 0 replies; 4+ messages in thread
From: Pawan @ 2022-08-28 9:47 UTC (permalink / raw)
To: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 156 bytes --]
Hello Robert,
I have created new patch and sent. Please ignore this patch.
new patch: https://lists.openembedded.org/g/openembedded-core/message/169977
[-- Attachment #2: Type: text/html, Size: 168 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-08-28 9:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-08-24 11:53 [meta][dunfell][PATCH] libxml2: Add fix for CVE-2016-3709 pawan
2022-08-28 2:54 ` [OE-core] " Robert Joslyn
2022-08-28 9:44 ` Pawan
2022-08-28 9:47 ` Pawan
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.