This patch addresses two heap overflow bugs in raptor2: http://seclists.org/oss-sec/2017/q2/424 Patch copied from libreoffice: https://github.com/LibreOffice/core/blob/master/external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1 From 590681e546cd9aa18d57dc2ea1858cb734a3863f Mon Sep 17 00:00:00 2001 From: Dave Beckett Date: Sun, 16 Apr 2017 23:15:12 +0100 Subject: [PATCH] Calcualte max nspace declarations correctly for XML writer (raptor_xml_writer_start_element_common): Calculate max including for each attribute a potential name and value. Fixes Issues #0000617 http://bugs.librdf.org/mantis/view.php?id=617 and #0000618 http://bugs.librdf.org/mantis/view.php?id=618 --- src/raptor_xml_writer.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c index 693b946..0d3a36a 100644 --- a/src/raptor_xml_writer.c +++ b/src/raptor_xml_writer.c @@ -181,9 +181,10 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, size_t nspace_declarations_count = 0; unsigned int i; - /* max is 1 per element and 1 for each attribute + size of declared */ if(nstack) { - int nspace_max_count = element->attribute_count+1; + int nspace_max_count = element->attribute_count * 2; /* attr and value */ + if(element->name->nspace) + nspace_max_count++; if(element->declared_nspaces) nspace_max_count += raptor_sequence_size(element->declared_nspaces); if(element->xml_language) @@ -237,7 +238,7 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer, } } - /* Add the attribute + value */ + /* Add the attribute's value */ nspace_declarations[nspace_declarations_count].declaration= raptor_qname_format_as_xml(element->attributes[i], &nspace_declarations[nspace_declarations_count].length); -- 2.9.3 uix/log/?id=b1f29b1124a08f67aa31dbe991b50ae91ef08174'>root/configure.ac
AgeCommit message (Expand)Author
2022-07-03etc: Add teams.scm....* etc/teams.scm.in: New file. * configure.ac: Generate executable. * .gitignore: Ignore generated file. Ricardo Wurmus
2022-01-25build: Require Guile >= 3.0.3....Fixes <https://issues.guix.gnu.org/53157>. Reported by Efraim Flashner <efraim@flashner.co.il>. * configure.ac: Require Guile >= 3.0.3. * doc/guix.texi (Requirements): Update accordingly. Ludovic Courtès
2021-11-23maint: "make dist" builds tarballs in 'ustar' format....This allows us to have file names longer than 99 characters. * configure.ac: Pass 'tar-ustar' to 'AM_INIT_AUTOMAKE'. Ludovic Courtès
2021-06-01maint: Require Guile 3.0....* configure.ac: Require Guile 3.0. * doc/guix.texi (Requirements): Adjust accordingly. * gnu/packages/package-management.scm (guile2.2-guix): Remove. * guix/lint.scm (exception-with-kind-and-args?): Remove 'cond-expand'. * guix/scripts/deploy.scm (deploy-machine*): Likewise. * guix/store.scm (call-with-store): Likewise. * guix/swh.scm (http-get*, http-post*): Likewise. * guix/ui.scm (without-compiler-optimizations, guard*) (call-with-error-handling): Likewise. Ludovic Courtès
2021-05-03nls: Do not update po files on first make invocation....We need to update the minimal gettext version to take advantage of new features. Before this patch, the first make invocation would modify po/guix and po/packages po files, and we advised to run `git checkout po` to clean the changes. * configure.ac (AM_GNU_GETTEXT_VERSION): Update to 0.19.1. * po/guix/Makevars: Set PO_DEPENDS_ON_POT to no. * po/packages/Makevars: Set PO_DEPENDS_ON_POT to no. Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com> Julien Lepiller
2021-04-25import: Remove Nix importer....This importer has suffered from bitrot and no longer works with current Nix and Nixpkgs. See <https://bugs.gnu.org/32339> and <https://bugs.gnu.org/36255>. * guix/import/snix.scm, guix/scripts/import/nix.scm, tests/snix.scm: Remove. * Makefile.am (MODULES, SCM_TESTS): Remove them. * guix/scripts/import.scm (importers): Remove "nix". * build-aux/test-env.in: Remove NIXPKGS variable. * configure.ac: Remove '--with-nixpkgs' option. * doc/guix.texi (Invoking guix import): Remove bit about "guix import nix". * etc/completion/fish/guix.fish: Likewise. Ludovic Courtès
2021-04-23build: Add a check for Guile-Lib....* configure.ac: Check if the Guile-Lib module is present and recent enough and warn in case it isn't. Maxim Cournoyer
2021-03-17maint: Check whether Guile-zlib is recent enough....This is a followup to a04aef2430645357d7796969d4b6453478ff8a3f. * m4/guix.m4 (GUIX_CHECK_GUILE_ZLIB): New macro. * configure.ac: Use it when checking for Guile-zlib. Ludovic Courtès
2021-02-04build: Add '--with-channel-commit' and related configure flags....Partially fixes <https://bugs.gnu.org/45896>. * m4/guix.m4 (GUIX_CHANNEL_METADATA): New macro. * configure.ac: Use it. * guix/config.scm.in (%channel-metadata): Adjust accordingly. Ludovic Courtès