67 lines
2.2 KiB
Diff
67 lines
2.2 KiB
Diff
From: Maks Verver <maks@verver.ch>
|
|
Date: Tue, 8 Apr 2025 13:13:55 +0200
|
|
Subject: [PATCH 2/2] [CVE-2025-32414] python: Read at most len/4 characters.
|
|
|
|
Fixes #889 by reserving space in the buffer for UTF-8 encoding of text.
|
|
|
|
Index: libxml2-2.9.10+dfsg/python/libxml.c
|
|
===================================================================
|
|
--- libxml2-2.9.10+dfsg.orig/python/libxml.c 2025-04-28 12:34:16.797639445 +0200
|
|
+++ libxml2-2.9.10+dfsg/python/libxml.c 2025-04-28 12:34:16.793639446 +0200
|
|
@@ -286,7 +286,9 @@
|
|
#endif
|
|
file = (PyObject *) context;
|
|
if (file == NULL) return(-1);
|
|
- ret = PyEval_CallMethod(file, (char *) "read", (char *) "(i)", len);
|
|
+ /* When read() returns a string, the length is in characters not bytes, so
|
|
+ request at most len / 4 characters to leave space for UTF-8 encoding. */
|
|
+ ret = PyEval_CallMethod(file, (char *) "read", (char *) "(i)", len / 4);
|
|
if (ret == NULL) {
|
|
printf("xmlPythonFileReadRaw: result is NULL\n");
|
|
return(-1);
|
|
@@ -321,10 +323,12 @@
|
|
Py_DECREF(ret);
|
|
return(-1);
|
|
}
|
|
- if (lenread > len)
|
|
- memcpy(buffer, data, len);
|
|
- else
|
|
- memcpy(buffer, data, lenread);
|
|
+ if (lenread < 0 || lenread > len) {
|
|
+ printf("xmlPythonFileReadRaw: invalid lenread\n");
|
|
+ Py_DECREF(ret);
|
|
+ return(-1);
|
|
+ }
|
|
+ memcpy(buffer, data, lenread);
|
|
Py_DECREF(ret);
|
|
return(lenread);
|
|
}
|
|
@@ -351,7 +355,9 @@
|
|
#endif
|
|
file = (PyObject *) context;
|
|
if (file == NULL) return(-1);
|
|
- ret = PyEval_CallMethod(file, (char *) "io_read", (char *) "(i)", len);
|
|
+ /* When read() returns a string, the length is in characters not bytes, so
|
|
+ request at most len / 4 characters to leave space for UTF-8 encoding. */
|
|
+ ret = PyEval_CallMethod(file, (char *) "io_read", (char *) "(i)", len / 4);
|
|
if (ret == NULL) {
|
|
printf("xmlPythonFileRead: result is NULL\n");
|
|
return(-1);
|
|
@@ -386,10 +392,12 @@
|
|
Py_DECREF(ret);
|
|
return(-1);
|
|
}
|
|
- if (lenread > len)
|
|
- memcpy(buffer, data, len);
|
|
- else
|
|
- memcpy(buffer, data, lenread);
|
|
+ if (lenread < 0 || lenread > len) {
|
|
+ printf("xmlPythonFileRead: invalid lenread\n");
|
|
+ Py_DECREF(ret);
|
|
+ return(-1);
|
|
+ }
|
|
+ memcpy(buffer, data, lenread);
|
|
Py_DECREF(ret);
|
|
return(lenread);
|
|
}
|