diff options
| -rw-r--r-- | textproc/mxml/Makefile | 7 | ||||
| -rw-r--r-- | textproc/mxml/distinfo | 6 | ||||
| -rw-r--r-- | textproc/mxml/files/patch-mxml-file.c | 105 |
3 files changed, 112 insertions, 6 deletions
diff --git a/textproc/mxml/Makefile b/textproc/mxml/Makefile index 48b6e3a85c24..c982c84974fc 100644 --- a/textproc/mxml/Makefile +++ b/textproc/mxml/Makefile @@ -1,6 +1,5 @@ PORTNAME= mxml -DISTVERSION= 3.1 -PORTREVISION= 1 +DISTVERSION= 3.3.1 CATEGORIES= textproc MASTER_SITES= https://github.com/michaelrsweet/mxml/releases/download/v${DISTVERSION}/ @@ -11,13 +10,15 @@ WWW= http://www.minixml.org/ LICENSE= APACHE20 LICENSE_FILE= ${WRKSRC}/LICENSE -USES= desthack USE_LDCONFIG= yes +DESTDIRNAME= DSTROOT GNU_CONFIGURE= yes +GNU_CONFIGURE_MANPREFIX=${PREFIX}/share MAKE_ARGS= INSTALL_DATA="${INSTALL_DATA}" \ INSTALL_LIB="${INSTALL_LIB}" \ INSTALL_MAN="${INSTALL_MAN}" +TEST_TARGET= test OPTIONS_DEFINE= DOCS diff --git a/textproc/mxml/distinfo b/textproc/mxml/distinfo index cbd7a3011972..f6a8b32f719b 100644 --- a/textproc/mxml/distinfo +++ b/textproc/mxml/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1567960906 -SHA256 (mxml-3.1.tar.gz) = 1ac8d252f62f9dc2b2004518c70d2da313bdfcd92b8350e215f46064a34b52fc -SIZE (mxml-3.1.tar.gz) = 9268821 +TIMESTAMP = 1708794182 +SHA256 (mxml-3.3.1.tar.gz) = 0c663ed1fe393b5619f80101798202eea43534abd7c8aff389022fd8c1dacc32 +SIZE (mxml-3.3.1.tar.gz) = 1553469 diff --git a/textproc/mxml/files/patch-mxml-file.c b/textproc/mxml/files/patch-mxml-file.c new file mode 100644 index 000000000000..d4770ebffa60 --- /dev/null +++ b/textproc/mxml/files/patch-mxml-file.c @@ -0,0 +1,105 @@ +mxml-file.c: Fix a bounds check + +When writing XML data into a buffer a pointer is used to keep track of +the current position. When the end of the buffer is reached the writing +stops but the pointer continues to be incremented to determine how many +bytes would have been written had the buffer been large enough. The +problem is that the bounds check that stops the writing did not handle +the case where a large amount of data causes the pointer to wrap around +to 0. This can happen for example when the buffer is allocated on the +stack and the stack is close to the end of the address space. + +--- mxml-file.c.orig 2022-07-25 12:56:27 UTC ++++ mxml-file.c +@@ -50,6 +50,11 @@ typedef struct _mxml_fdbuf_s /**** File descriptor bu + buffer[8192]; /* Character buffer */ + } _mxml_fdbuf_t; + ++typedef struct _mxml_strbuf_s /**** String buffer ****/ ++{ ++ char *current; /* Current position in buffer */ ++ int remaining; /* Remaining size of buffer */ ++} _mxml_strbuf_t; + + /* + * Local functions... +@@ -352,41 +357,43 @@ mxmlSaveString(mxml_node_t *node, /* I - Node to wr + mxml_save_cb_t cb) /* I - Whitespace callback or @code MXML_NO_CALLBACK@ */ + { + int col; /* Final column */ +- char *ptr[2]; /* Pointers for putc_cb */ ++ _mxml_strbuf_t buf; /* State for putc_cb */ + _mxml_global_t *global = _mxml_global(); + /* Global data */ + ++ if (bufsize < 0) ++ return (-1); + + /* + * Write the node... + */ + +- ptr[0] = buffer; +- ptr[1] = buffer + bufsize; ++ buf.current = buffer; ++ buf.remaining = bufsize; + +- if ((col = mxml_write_node(node, ptr, cb, 0, mxml_string_putc, global)) < 0) ++ if ((col = mxml_write_node(node, &buf, cb, 0, mxml_string_putc, global)) < 0) + return (-1); + + if (col > 0) +- mxml_string_putc('\n', ptr); ++ mxml_string_putc('\n', &buf); + + /* + * Nul-terminate the buffer... + */ + +- if (ptr[0] >= ptr[1]) ++ if (buf.remaining == 0) + { +- if (bufsize > 0) ++ if (bufsize != 0) + buffer[bufsize - 1] = '\0'; + } + else +- ptr[0][0] = '\0'; ++ *buf.current = '\0'; + + /* + * Return the number of characters... + */ + +- return ((int)(ptr[0] - buffer)); ++ return ((int)(buf.current - buffer)); + } + + +@@ -2674,17 +2681,19 @@ mxml_string_putc(int ch, /* I - Character to write * + + static int /* O - 0 on success, -1 on failure */ + mxml_string_putc(int ch, /* I - Character to write */ +- void *p) /* I - Pointer to string pointers */ ++ void *p) /* I - String buffer */ + { +- char **pp; /* Pointer to string pointers */ ++ _mxml_strbuf_t *buf; /* String buffer */ + ++ buf = (_mxml_strbuf_t *)p; + +- pp = (char **)p; ++ if (buf->remaining != 0) ++ { ++ *buf->current = ch; ++ buf->remaining--; ++ } + +- if (pp[0] < pp[1]) +- pp[0][0] = ch; +- +- pp[0] ++; ++ buf->current++; + + return (0); + } |