8000 gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742) · miss-islington/cpython@372517c · GitHub
[go: up one dir, main page]
Skip to content

Commit 372517c

Browse files
scdubmiss-islington
scdub
authored and
miss-islington
committed
pythongh-98739: Update libexpat from 2.4.9 to 2.5.0 (pythonGH-98742)
* Update libexpat from 2.4.9 to 2.5.0 to address CVE-2022-43680. Co-authored-by: Shaun Walbridge <shaun.walbridge@gmail.com> (cherry picked from commit 3e07f82) Co-authored-by: Shaun Walbridge <46331011+scdub@users.noreply.github.com>
1 parent cfbc01f commit 372517c

File tree

4 files changed

+36
-18
lines changed

4 files changed

+36
-18
lines changed

‎Misc/NEWS.d/next/Security/2022-10-26-21-04-23.gh-issue-98739.keBWcY.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Update bundled libexpat to 2.5.0

‎Modules/expat/expat.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1054,8 +1054,8 @@ XML_SetBillionLaughsAttackProtectionActivationThreshold(
10541054
See http://semver.org.
10551055
*/
10561056
#define XML_MAJOR_VERSION 2
1057-
#define XML_MINOR_VERSION 4
1058-
#define XML_MICRO_VERSION 9
1057+
#define XML_MINOR_VERSION 5
1058+
#define XML_MICRO_VERSION 0
10591059

10601060
#ifdef __cplusplus
10611061
}

‎Modules/expat/xmlparse.c

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* 90815a2b2c80c03b2b889fe1d427bb2b9e3282aa065e42784e001db4f23de324 (2.4.9+)
1+
/* 5ab094ffadd6edfc94c3eee53af44a86951f9f1f0933ada3114bbce2bfb02c99 (2.5.0+)
22
__ __ _
33
___\ \/ /_ __ __ _| |_
44
/ _ \\ /| '_ \ / _` | __|
@@ -35,6 +35,7 @@
3535
Copyright (c) 2021 Dong-hee Na <donghee.na@python.org>
3636
Copyright (c) 2022 Samanta Navarro <ferivoz@riseup.net>
3737
Copyright (c) 2022 Jeffrey Walton <noloader@gmail.com>
38+
Copyright (c) 2022 Jann Horn <jannh@google.com>
3839
Licensed under the MIT license:
3940
4041
Permission is hereby granted, free of charge, to any person obtaining
@@ -1068,6 +1069,14 @@ parserCreate(const XML_Char *encodingName,
10681069
parserInit(parser, encodingName);
10691070

10701071
if (encodingName && ! parser->m_protocolEncodingName) {
1072+
if (dtd) {
1073+
// We need to stop the upcoming call to XML_ParserFree from happily
1074+
// destroying parser->m_dtd because the DTD is shared with the parent
1075+
// parser and the only guard that keeps XML_ParserFree from destroying
1076+
// parser->m_dtd is parser->m_isParamEntity but it will be set to
1077+
// XML_TRUE only later in XML_ExternalEntityParserCreate (or not at all).
1078+
parser->m_dtd = NULL;
1079+
}
10711080
XML_ParserFree(parser);
10721081
return NULL;
10731082
}
@@ -3011,16 +3020,16 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
30113020
int len;
30123021
const char *rawName;
30133022
TAG *tag = parser->m_tagStack;
3014-
parser->m_tagStack = tag->parent;
3015-
tag->parent = parser->m_freeTagList;
3016-
parser->m_freeTagList = tag;
30173023
rawName = s + enc->minBytesPerChar * 2;
30183024
len = XmlNameLength(enc, rawName);
30193025
if (len != tag->rawNameLength
30203026
|| memcmp(tag->rawName, rawName, len) != 0) {
30213027
*eventPP = rawName;
30223028
return XML_ERROR_TAG_MISMATCH;
30233029
}
3030+
parser->m_tagStack = tag->parent;
3031+
tag->parent = parser->m_freeTagList;
3032+
parser->m_freeTagList = tag;
30243033
--parser->m_tagLevel;
30253034
if (parser->m_endElementHandler) {
30263035
const XML_Char *localPart;
@@ -4975,10 +4984,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
49754984
parser->m_handlerArg, parser->m_declElementType->name,
49764985
parser->m_declAttributeId->name, parser->m_declAttributeType, 0,
49774986
role == XML_ROLE_REQUIRED_ATTRIBUTE_VALUE);
4978-
poolClear(&parser->m_tempPool);
49794987
handleDefault = XML_FALSE;
49804988
}
49814989
}
4990+
poolClear(&parser->m_tempPool);
49824991
break;
49834992
case XML_ROLE_DEFAULT_ATTRIBUTE_VALUE:
49844993
case XML_ROLE_FIXED_ATTRIBUTE_VALUE:
@@ -5386,7 +5395,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
53865395
*
53875396
* If 'standalone' is false, the DTD must have no
53885397
* parameter entities or we wouldn't have passed the outer
5389-
* 'if' statement. That measn the only entity in the hash
5398+
* 'if' statement. That means the only entity in the hash
53905399
* table is the external subset name "#" which cannot be
53915400
* given as a parameter entity name in XML syntax, so the
53925401
* lookup must have returned NULL and we don't even reach
@@ -5798,19 +5807,27 @@ internalEntityProcessor(XML_Parser parser, const char *s, const char *end,
57985807

57995808
if (result != XML_ERROR_NONE)
58005809
return result;
5801-
else if (textEnd != next
5802-
&& parser->m_parsingStatus.parsing == XML_SUSPENDED) {
5810+
5811+
if (textEnd != next && parser->m_parsingStatus.parsing == XML_SUSPENDED) {
58035812
entity->processed = (int)(next - (const char *)entity->textPtr);
58045813
return result;
5805-
} else {
5814+
}
5815+
58065816
#ifdef XML_DTD
5807-
entityTrackingOnClose(parser, entity, __LINE__);
5817+
entityTrackingOnClose(parser, entity, __LINE__);
58085818
#endif
5809-
entity->open = XML_FALSE;
5810-
parser->m_openInternalEntities = openEntity->next;
5811-
/* put openEntity back in list of free instances */
5812-
openEntity->next = parser->m_freeInternalEntities;
5813-
parser->m_freeInternalEntities = openEntity;
5819+
entity->open = XML_FALSE;
5820+
parser->m_openInternalEntities = openEntity->next;
5821+
/* put openEntity back in list of free instances */
5822+
openEntity->next = parser->m_freeInternalEntities;
5823+
parser->m_freeInternalEntities = openEntity;
5824+
5825+
// If there are more open entities we want to stop right here and have the
5826+
// upcoming call to XML_ResumeParser continue with entity content, or it would
5827+
// be ignored altogether.
5828+
if (parser->m_openInternalEntities != NULL
5829+
&& parser->m_parsingStatus.parsing == XML_SUSPENDED) {
5830+
return XML_ERROR_NONE;
58145831
}
58155832

58165833
#ifdef XML_DTD

‎Modules/expat/xmltok_impl.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ enum {
4545
BT_LF, /* line feed = "\n" */
4646
BT_GT, /* greater than = ">" */
4747
BT_QUOT, /* quotation character = "\"" */
48-
BT_APOS, /* aposthrophe = "'" */
48+
BT_APOS, /* apostrophe = "'" */
4949
BT_EQUALS, /* equal sign = "=" */
5050
BT_QUEST, /* question mark = "?" */
5151
BT_EXCL, /* exclamation mark = "!" */

0 commit comments

Comments
 (0)
0