SLFO-pool/uriparser
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync from SUSE:SLFO:Main uriparser revision b4c99d6083cf8f8d2922fc8cb643320d

Browse Source
This commit is contained in:
Adrian Schröter 2024-06-07 18:41:28 +02:00
parent f572c585d2
commit cbbdc11e68
4 changed files with 81 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
CVE-2024-34402.patch Normal file
View File

@ -0,0 +1,42 @@
From 760ade2947415dbb100053cf793c2f96fe257386 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 28 Apr 2024 21:26:45 +0200
Subject: [PATCH] Protect against integer overflow in ComposeQueryEngine
Requires string input that is longer than INT_MAX to exploit.
---
src/UriQuery.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/src/UriQuery.c
+++ b/src/UriQuery.c
@@ -70,6 +70,7 @@
#include <limits.h>
+#include <stddef.h> /* size_t */
@@ -218,16 +219,16 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHA
const URI_CHAR * const key = queryList->key;
const URI_CHAR * const value = queryList->value;
const int worstCase = (normalizeBreaks == URI_TRUE ? 6 : 3);
- const int keyLen = (key == NULL) ? 0 : (int)URI_STRLEN(key);
+ const size_t keyLen = (key == NULL) ? 0 : URI_STRLEN(key);
int keyRequiredChars;
- const int valueLen = (value == NULL) ? 0 : (int)URI_STRLEN(value);
+ const size_t valueLen = (value == NULL) ? 0 : URI_STRLEN(value);
int valueRequiredChars;
- if ((keyLen >= INT_MAX / worstCase) || (valueLen >= INT_MAX / worstCase)) {
+ if ((keyLen >= (size_t)INT_MAX / worstCase) || (valueLen >= (size_t)INT_MAX / worstCase)) {
return URI_ERROR_OUTPUT_TOO_LARGE;
}
- keyRequiredChars = worstCase * keyLen;
- valueRequiredChars = worstCase * valueLen;
+ keyRequiredChars = worstCase * (int)keyLen;
+ valueRequiredChars = worstCase * (int)valueLen;
if (dest == NULL) {
(*charsRequired) += ampersandLen + keyRequiredChars + ((value == NULL)

27
CVE-2024-34403.patch Normal file
View File

@ -0,0 +1,27 @@
From bb6b9b3f25fbafeb12dac68574d9f677b09880e3 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 28 Apr 2024 21:57:27 +0200
Subject: [PATCH] Protect against integer overflow in ComposeQueryMallocExMm
Requires string input that is longer than INT_MAX / 6 - 1 to exploit.
---
src/UriQuery.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/src/UriQuery.c
+++ b/src/UriQuery.c
@@ -178,10 +178,13 @@ int URI_FUNC(ComposeQueryMallocExMm)(URI
if (res != URI_SUCCESS) {
return res;
}
+ if (charsRequired == INT_MAX) {
+ return URI_ERROR_MALLOC;
+ }
charsRequired++;
/* Allocate space */
- queryString = memory->malloc(memory, charsRequired * sizeof(URI_CHAR));
+ queryString = memory->calloc(memory, charsRequired, sizeof(URI_CHAR));
if (queryString == NULL) {
return URI_ERROR_MALLOC;
}

8
uriparser.changes
View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Wed May 22 11:52:17 UTC 2024 - Gus Kenion <gus.kenion@suse.com>
- CVE-2024-34402.patch: Protect against integer overflow in
ComposeQueryEngine (bsc#1223887, CVE-2024-34402)
- CVE-2024-34403.patch: Protect against integer overflow in
ComposeQueryMallocExMm (bsc#1223888, CVE-2024-34403)
-------------------------------------------------------------------
Mon Oct 17 11:52:32 UTC 2022 - Dirk Müller <dmueller@suse.com>

4
uriparser.spec
View File

@ -28,6 +28,8 @@ Group: Development/Libraries/C and C++
URL: https://uriparser.github.io
Source: https://github.com/uriparser/uriparser/releases/download/uriparser-%{version}/uriparser-%{version}.tar.xz
Source1: baselibs.conf
Patch0: CVE-2024-34402.patch
Patch1: CVE-2024-34403.patch
BuildRequires: cmake
BuildRequires: doxygen
BuildRequires: fdupes
@ -92,6 +94,8 @@ This subpackage contains the documentation for %{name}.
%prep
%setup -q -n %{name}-%{version}
%patch0 -p1
%patch1 -p1
%build
%cmake \