diff options
author | Jeremy Messenger <mezz@FreeBSD.org> | 2009-02-07 00:14:10 +0000 |
---|---|---|
committer | Jeremy Messenger <mezz@FreeBSD.org> | 2009-02-07 00:14:10 +0000 |
commit | 9ffc0270c40e07a7820ee4a6eb104ba3d5978c41 (patch) | |
tree | 0114492b33088226e5680db7fd6bc86b21344e60 /textproc/libxml2/files | |
parent | - Update to 2.12. (diff) |
Update to 2.7.3.
Notes
Notes:
svn path=/head/; revision=227744
Diffstat (limited to 'textproc/libxml2/files')
-rw-r--r-- | textproc/libxml2/files/patch-CVE-2008-4225 | 26 | ||||
-rw-r--r-- | textproc/libxml2/files/patch-CVE-2008-4226 | 38 |
2 files changed, 0 insertions, 64 deletions
diff --git a/textproc/libxml2/files/patch-CVE-2008-4225 b/textproc/libxml2/files/patch-CVE-2008-4225 deleted file mode 100644 index 0666795c6abc..000000000000 --- a/textproc/libxml2/files/patch-CVE-2008-4225 +++ /dev/null @@ -1,26 +0,0 @@ ---- tree.c.orig 2008-10-31 18:14:00.000000000 -0700 -+++ tree.c 2008-10-31 18:14:35.000000000 -0700 -@@ -14,7 +14,7 @@ - #include "libxml.h" - - #include <string.h> /* for memset() only ! */ -- -+#include <limits.h> - #ifdef HAVE_CTYPE_H - #include <ctype.h> - #endif -@@ -6996,7 +6996,13 @@ - case XML_BUFFER_ALLOC_DOUBLEIT: - /*take care of empty case*/ - newSize = (buf->size ? buf->size*2 : size + 10); -- while (size > newSize) newSize *= 2; -+ while (size > newSize) { -+ if (newSize > UINT_MAX / 2) { -+ xmlTreeErrMemory("growing buffer"); -+ return 0; -+ } -+ newSize *= 2; -+ } - break; - case XML_BUFFER_ALLOC_EXACT: - newSize = size+10; diff --git a/textproc/libxml2/files/patch-CVE-2008-4226 b/textproc/libxml2/files/patch-CVE-2008-4226 deleted file mode 100644 index 79e808b40c34..000000000000 --- a/textproc/libxml2/files/patch-CVE-2008-4226 +++ /dev/null @@ -1,38 +0,0 @@ ---- SAX2.c.orig 2008-01-25 08:10:04.000000000 -0500 -+++ SAX2.c 2008-11-07 05:07:34.000000000 -0500 -@@ -11,6 +11,7 @@ - #include "libxml.h" - #include <stdlib.h> - #include <string.h> -+#include <limits.h> - #include <libxml/xmlmemory.h> - #include <libxml/tree.h> - #include <libxml/parser.h> -@@ -26,6 +27,11 @@ - #include <libxml/HTMLtree.h> - #include <libxml/globals.h> - -+/* Define SIZE_T_MAX unless defined through <limits.h>. */ -+#ifndef SIZE_T_MAX -+# define SIZE_T_MAX ((size_t)-1) -+#endif /* !SIZE_T_MAX */ -+ - /* #define DEBUG_SAX2 */ - /* #define DEBUG_SAX2_TREE */ - -@@ -2445,9 +2451,14 @@ - (xmlDictOwns(ctxt->dict, lastChild->content))) { - lastChild->content = xmlStrdup(lastChild->content); - } -+ if ((size_t)ctxt->nodelen > SIZE_T_MAX - (size_t)len || -+ (size_t)ctxt->nodemem + (size_t)len > SIZE_T_MAX / 2) { -+ xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented"); -+ return; -+ } - if (ctxt->nodelen + len >= ctxt->nodemem) { - xmlChar *newbuf; -- int size; -+ size_t size; - - size = ctxt->nodemem + len; - size *= 2; |