diff options
| author | Michael Gilbert <mgilbert@debian.org> | 2012-05-23 13:48:52 -0400 |
|---|---|---|
| committer | Aron Xu <aron@debian.org> | 2012-05-25 02:48:58 +0000 |
| commit | dd256939db63dccc88ab2fc7d73d702f4c8c8e8f (patch) | |
| tree | 156aa2a797a4dc046f755cf59197bcf588c152d5 /debian/patches | |
| parent | c3cecab4b77bdb3f2faefe0e319e7394696045f7 (diff) | |
| download | libxml2-dd256939db63dccc88ab2fc7d73d702f4c8c8e8f.tar.gz | |
Imported Debian patch 2.7.8.dfsg-9.1debian/2.7.8.dfsg-9.1
Diffstat (limited to 'debian/patches')
| -rw-r--r-- | debian/patches/cve-2012-3102.patch | 39 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
2 files changed, 40 insertions, 0 deletions
diff --git a/debian/patches/cve-2012-3102.patch b/debian/patches/cve-2012-3102.patch new file mode 100644 index 0000000..4f6a92c --- /dev/null +++ b/debian/patches/cve-2012-3102.patch @@ -0,0 +1,39 @@ +From d8e1faeaa99c7a7c07af01c1c72de352eb590a3e Mon Sep 17 00:00:00 2001 +From: Jüri Aedla <asd@ut.ee> +Date: Mon, 07 May 2012 07:06:56 +0000 +Subject: Fix an off by one pointer access + +getting out of the range of memory allocated for xpointer decoding +--- +diff --git a/xpointer.c b/xpointer.c +index 37afa3a..0b463dd 100644 +--- a/xpointer.c ++++ b/xpointer.c +@@ -1007,21 +1007,14 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) { + NEXT; + break; + } +- *cur++ = CUR; + } else if (CUR == '(') { + level++; +- *cur++ = CUR; + } else if (CUR == '^') { +- NEXT; +- if ((CUR == ')') || (CUR == '(') || (CUR == '^')) { +- *cur++ = CUR; +- } else { +- *cur++ = '^'; +- *cur++ = CUR; +- } +- } else { +- *cur++ = CUR; ++ if ((NXT(1) == ')') || (NXT(1) == '(') || (NXT(1) == '^')) { ++ NEXT; ++ } + } ++ *cur++ = CUR; + NEXT; + } + *cur = 0; +-- +cgit v0.9.0.2 diff --git a/debian/patches/series b/debian/patches/series index 306e703..15e3e97 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1 +1,2 @@ 01_historical_changes.patch +cve-2012-3102.patch |