|
| 1 | +From df738c6288e9f48f299569016cf4e2716543ecea Mon Sep 17 00:00:00 2001 |
| 2 | +From: Sreenivasulu Malavathula <v-smalavathu@microsoft.com> |
| 3 | +Date: Fri, 18 Apr 2025 17:44:25 -0500 |
| 4 | +Subject: [PATCH] Address CVE-2025-32414 |
| 5 | +Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8d415b8911be26b12b85497f7cc57143b5321787.patch |
| 6 | + |
| 7 | +--- |
| 8 | + python/libxml.c | 28 ++++++++++++++++++---------- |
| 9 | + 1 file changed, 18 insertions(+), 10 deletions(-) |
| 10 | + |
| 11 | +diff --git a/python/libxml.c b/python/libxml.c |
| 12 | +index fb14c7a..ebd51ef 100644 |
| 13 | +--- a/python/libxml.c |
| 14 | ++++ b/python/libxml.c |
| 15 | +@@ -266,7 +266,9 @@ xmlPythonFileReadRaw (void * context, char * buffer, int len) { |
| 16 | + #endif |
| 17 | + file = (PyObject *) context; |
| 18 | + if (file == NULL) return(-1); |
| 19 | +- ret = PyObject_CallMethod(file, (char *) "read", (char *) "(i)", len); |
| 20 | ++ /* When read() returns a string, the length is in characters not bytes, so |
| 21 | ++ request at most len / 4 characters to leave space for UTF-8 encoding. */ |
| 22 | ++ ret = PyObject_CallMethod(file, (char *) "read", (char *) "(i)", len / 4); |
| 23 | + if (ret == NULL) { |
| 24 | + printf("xmlPythonFileReadRaw: result is NULL\n"); |
| 25 | + return(-1); |
| 26 | +@@ -301,10 +303,12 @@ xmlPythonFileReadRaw (void * context, char * buffer, int len) { |
| 27 | + Py_DECREF(ret); |
| 28 | + return(-1); |
| 29 | + } |
| 30 | +- if (lenread > len) |
| 31 | +- memcpy(buffer, data, len); |
| 32 | +- else |
| 33 | +- memcpy(buffer, data, lenread); |
| 34 | ++ if (lenread < 0 || lenread > len) { |
| 35 | ++ printf("xmlPythonFileReadRaw: invalid lenread\n"); |
| 36 | ++ Py_DECREF(ret); |
| 37 | ++ return(-1); |
| 38 | ++ } |
| 39 | ++ memcpy(buffer, data, lenread); |
| 40 | + Py_DECREF(ret); |
| 41 | + return(lenread); |
| 42 | + } |
| 43 | +@@ -331,7 +335,9 @@ xmlPythonFileRead (void * context, char * buffer, int len) { |
| 44 | + #endif |
| 45 | + file = (PyObject *) context; |
| 46 | + if (file == NULL) return(-1); |
| 47 | +- ret = PyObject_CallMethod(file, (char *) "io_read", (char *) "(i)", len); |
| 48 | ++ /* When read() returns a string, the length is in characters not bytes, so |
| 49 | ++ request at most len / 4 characters to leave space for UTF-8 encoding. */ |
| 50 | ++ ret = PyObject_CallMethod(file, (char *) "io_read", (char *) "(i)", len / 4); |
| 51 | + if (ret == NULL) { |
| 52 | + printf("xmlPythonFileRead: result is NULL\n"); |
| 53 | + return(-1); |
| 54 | +@@ -366,10 +372,12 @@ xmlPythonFileRead (void * context, char * buffer, int len) { |
| 55 | + Py_DECREF(ret); |
| 56 | + return(-1); |
| 57 | + } |
| 58 | +- if (lenread > len) |
| 59 | +- memcpy(buffer, data, len); |
| 60 | +- else |
| 61 | +- memcpy(buffer, data, lenread); |
| 62 | ++ if (lenread < 0 || lenread > len) { |
| 63 | ++ printf("xmlPythonFileRead: invalid lenread\n"); |
| 64 | ++ Py_DECREF(ret); |
| 65 | ++ return(-1); |
| 66 | ++ } |
| 67 | ++ memcpy(buffer, data, lenread); |
| 68 | + Py_DECREF(ret); |
| 69 | + return(lenread); |
| 70 | + } |
| 71 | +-- |
| 72 | +2.45.2 |
| 73 | + |
0 commit comments