opt/libxml2/CVE-2011-0216.patch
Juergen Daubert ee2b265f81 [notify] libxml2: apply several security fixes
Fix for CVE-2010-4494, CVE-2011-{0216,2821,2834,3905,3919}
2012-01-31 12:31:34 +01:00

33 lines
1.1 KiB
Diff

From 69f04562f75212bfcabecd190ea8b06ace28ece2 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 19 Aug 2011 03:05:04 +0000
Subject: Fix an off by one error in encoding
this off by one error doesn't seems to reproduce on linux
but the error is real.
---
diff --git a/encoding.c b/encoding.c
index d1140bf..fb0c38a 100644
--- a/encoding.c
+++ b/encoding.c
@@ -1928,7 +1928,7 @@ xmlCharEncFirstLineInt(xmlCharEncodingHandler *handler, xmlBufferPtr out,
if (in == NULL) return(-1);
/* calculate space available */
- written = out->size - out->use;
+ written = out->size - out->use - 1; /* count '\0' */
toconv = in->use;
/*
* echo '<?xml version="1.0" encoding="UCS4"?>' | wc -c => 38
@@ -2059,7 +2059,7 @@ xmlCharEncInFunc(xmlCharEncodingHandler * handler, xmlBufferPtr out,
toconv = in->use;
if (toconv == 0)
return (0);
- written = out->size - out->use;
+ written = out->size - out->use -1; /* count '\0' */
if (toconv * 2 >= written) {
xmlBufferGrow(out, out->size + toconv * 2);
written = out->size - out->use - 1;
--
cgit v0.9.0.2