95a83c45f5
- Security fix: [bsc#1140101, CVE-2019-13118]
* Fix uninitialized read with UTF-8 grouping chars. Read of
uninitialized stack data due to too narrow xsl:number
instruction and an invalid character
* Added libxslt-CVE-2019-13118.patch
- Security fix: [bsc#1140095, CVE-2019-13117]
* Fix uninitialized read of xsl:number token. An xsl number with
certain format strings could lead to a uninitialized read in
xsltNumberFormatInsertNumbers
* Added libxslt-CVE-2019-13117.patch
- Security fix: [bsc#1140101, CVE-2019-13118]
* Fix uninitialized read with UTF-8 grouping chars. Read of
uninitialized stack data due to too narrow xsl:number
instruction and an invalid character
* Added libxslt-CVE-2019-13118.patch
- Security fix: [bsc#1140095, CVE-2019-13117]
* Fix uninitialized read of xsl:number token. An xsl number with
certain format strings could lead to a uninitialized read in
xsltNumberFormatInsertNumbers
* Added libxslt-CVE-2019-13117.patch
OBS-URL: https://build.opensuse.org/request/show/713209
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libxslt?expand=0&rev=73
72 lines
2.3 KiB
Diff
72 lines
2.3 KiB
Diff
From 6ce8de69330783977dd14f6569419489875fb71b Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Mon, 3 Jun 2019 13:14:45 +0200
|
|
Subject: [PATCH] Fix uninitialized read with UTF-8 grouping chars
|
|
|
|
The character type in xsltFormatNumberConversion was too narrow and
|
|
an invalid character/length combination could be passed to
|
|
xsltNumberFormatDecimal, resulting in an uninitialized read.
|
|
|
|
Found by OSS-Fuzz.
|
|
---
|
|
libxslt/numbers.c | 5 +++--
|
|
tests/docs/bug-222.xml | 1 +
|
|
tests/general/bug-222.out | 2 ++
|
|
tests/general/bug-222.xsl | 6 ++++++
|
|
4 files changed, 12 insertions(+), 2 deletions(-)
|
|
create mode 100644 tests/docs/bug-222.xml
|
|
create mode 100644 tests/general/bug-222.out
|
|
create mode 100644 tests/general/bug-222.xsl
|
|
|
|
diff --git a/libxslt/numbers.c b/libxslt/numbers.c
|
|
index f1ed8846..20b99d5a 100644
|
|
--- a/libxslt/numbers.c
|
|
+++ b/libxslt/numbers.c
|
|
@@ -1298,13 +1298,14 @@ OUTPUT_NUMBER:
|
|
number = floor((scale * number + 0.5)) / scale;
|
|
if ((self->grouping != NULL) &&
|
|
(self->grouping[0] != 0)) {
|
|
+ int gchar;
|
|
|
|
len = xmlStrlen(self->grouping);
|
|
- pchar = xsltGetUTF8Char(self->grouping, &len);
|
|
+ gchar = xsltGetUTF8Char(self->grouping, &len);
|
|
xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0],
|
|
format_info.integer_digits,
|
|
format_info.group,
|
|
- pchar, len);
|
|
+ gchar, len);
|
|
} else
|
|
xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0],
|
|
format_info.integer_digits,
|
|
diff --git a/tests/docs/bug-222.xml b/tests/docs/bug-222.xml
|
|
new file mode 100644
|
|
index 00000000..69d62f2c
|
|
--- /dev/null
|
|
+++ b/tests/docs/bug-222.xml
|
|
@@ -0,0 +1 @@
|
|
+<doc/>
|
|
diff --git a/tests/general/bug-222.out b/tests/general/bug-222.out
|
|
new file mode 100644
|
|
index 00000000..e3139698
|
|
--- /dev/null
|
|
+++ b/tests/general/bug-222.out
|
|
@@ -0,0 +1,2 @@
|
|
+<?xml version="1.0"?>
|
|
+1⠢0
|
|
diff --git a/tests/general/bug-222.xsl b/tests/general/bug-222.xsl
|
|
new file mode 100644
|
|
index 00000000..e32dc473
|
|
--- /dev/null
|
|
+++ b/tests/general/bug-222.xsl
|
|
@@ -0,0 +1,6 @@
|
|
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
|
|
+ <xsl:decimal-format name="f" grouping-separator="⠢"/>
|
|
+ <xsl:template match="/">
|
|
+ <xsl:value-of select="format-number(10,'#⠢0','f')"/>
|
|
+ </xsl:template>
|
|
+</xsl:stylesheet>
|
|
--
|
|
2.21.0
|
|
|