After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 763071 - (CVE-2016-1834) heap-buffer-overflow in xmlStrncat
(CVE-2016-1834)
heap-buffer-overflow in xmlStrncat
Status: RESOLVED FIXED
Product: libxml2
Classification: Platform
Component: general
git master
Other All
: Normal normal
: ---
Assigned To: Daniel Veillard
libxml QA maintainers
Depends on:
Blocks: 765977
 
 
Reported: 2016-03-04 00:34 UTC by pjumde
Modified: 2016-08-22 20:22 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
poc.c (801 bytes, text/x-csrc)
2016-03-06 19:36 UTC, pjumde 		  Details
Patch for stop-gap fix (appropriate for older branches/releases) (1.46 KB, patch)
2016-03-09 01:35 UTC, David Kilzer 		none Details | Review

Description pjumde 2016-03-04 00:34:22 UTC 
#Security
Comment 1 André Klapper 2016-03-04 10:26:02 UTC 
pjumde: Hi! This bug report is empty. Do you plan to add more information?
Comment 2 pjumde 2016-03-06 19:36:13 UTC 
Created attachment 323205 [details]
poc.c

Repro steps:

- cc -fsanitize=address -I/Users/pjumde/Documents/Debug/Safari/libxml2/libxml2/include -lxml2 poc.c -o poc
- DYLD_INSERT_LIBRARIES=./.libs/libxml2.2.dylib ./poc
Comment 3 David Kilzer 2016-03-09 01:35:46 UTC 
Created attachment 323460 [details] [review]
Patch for stop-gap fix (appropriate for older branches/releases)

This is a safe fix for branches.

The comprehensive fix is to change the return type of xmlStrlen() to size_t so that it doesn't overflow.
Comment 4 Daniel Veillard 2016-05-16 12:07:48 UTC 
Fix looks fine.

W.r.t. size_t, no, you can't change the API to return a 64bit when it was an
int as this is both an ABI and API breakage on a variety of platforms.
My life is too short at this point to try to version libxml2 API so int it is
int it will remain, sorry :)

Daniel
Comment 6 Olav Vitters 2016-08-22 20:22:27 UTC 
Removing security group as commit is public