!42 Fix CVE-2021-29623 CVE-2021-32617
From: @liuyumeng1 Reviewed-by: @shirely16,@dwl301 Signed-off-by:
This commit is contained in:
openeuler-ci-bot
Gitee
commit
ac4ca436ce
26
backport-CVE-2021-29623.patch
Normal file
26
backport-CVE-2021-29623.patch
Normal file
@ -0,0 +1,26 @@
|
||||
From 82e46b5524fb904e6660dadd2c6d8e5e47375a1a Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Backhouse <kevinbackhouse@github.com>
|
||||
Date: Tue, 11 May 2021 12:14:33 +0100
|
||||
Subject: [PATCH] Use readOrThrow to check error conditions of iIo.read().
|
||||
|
||||
---
|
||||
src/webpimage.cpp | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/webpimage.cpp b/src/webpimage.cpp
|
||||
index 7c64ff3d7..ca26e514a 100644
|
||||
--- a/src/webpimage.cpp
|
||||
+++ b/src/webpimage.cpp
|
||||
@@ -754,9 +754,9 @@ namespace Exiv2 {
|
||||
byte webp[len];
|
||||
byte data[len];
|
||||
byte riff[len];
|
||||
- iIo.read(riff, len);
|
||||
- iIo.read(data, len);
|
||||
- iIo.read(webp, len);
|
||||
+ readOrThrow(iIo, riff, len, Exiv2::kerCorruptedMetadata);
|
||||
+ readOrThrow(iIo, data, len, Exiv2::kerCorruptedMetadata);
|
||||
+ readOrThrow(iIo, webp, len, Exiv2::kerCorruptedMetadata);
|
||||
bool matched_riff = (memcmp(riff, RiffImageId, len) == 0);
|
||||
bool matched_webp = (memcmp(webp, WebPImageId, len) == 0);
|
||||
iIo.seek(-12, BasicIo::cur);
|
||||
126
backport-CVE-2021-32617.patch
Normal file
126
backport-CVE-2021-32617.patch
Normal file
@ -0,0 +1,126 @@
|
||||
From c261fbaa2567687eec6a595d3016212fd6ae648d Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Backhouse <kevinbackhouse@github.com>
|
||||
Date: Sun, 16 May 2021 15:05:08 +0100
|
||||
Subject: [PATCH] Fix quadratic complexity performance bug.
|
||||
|
||||
---
|
||||
xmpsdk/src/XMPMeta-Parse.cpp | 57 +++++++++++++++++++++++-------------
|
||||
1 file changed, 36 insertions(+), 21 deletions(-)
|
||||
|
||||
diff --git a/xmpsdk/src/XMPMeta-Parse.cpp b/xmpsdk/src/XMPMeta-Parse.cpp
|
||||
index 9f66fe8e1d..69596934ea 100644
|
||||
--- a/xmpsdk/src/XMPMeta-Parse.cpp
|
||||
+++ b/xmpsdk/src/XMPMeta-Parse.cpp
|
||||
@@ -976,12 +976,26 @@ ProcessUTF8Portion ( XMLParserAdapter * xmlParser,
|
||||
{
|
||||
const XMP_Uns8 * bufEnd = buffer + length;
|
||||
|
||||
- const XMP_Uns8 * spanStart = buffer;
|
||||
const XMP_Uns8 * spanEnd;
|
||||
+
|
||||
+ // `buffer` is copied into this std::string. If `buffer` only
|
||||
+ // contains valid UTF-8 and no escape characters, then the copy
|
||||
+ // will be identical to the original, but invalid characters are
|
||||
+ // replaced - usually with a space character. This std::string was
|
||||
+ // added as a performance fix for:
|
||||
+ // https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj
|
||||
+ // Previously, the code was repeatedly calling
|
||||
+ // `xmlParser->ParseBuffer()`, which turned out to have quadratic
|
||||
+ // complexity, because expat kept reparsing the entire string from
|
||||
+ // the beginning.
|
||||
+ std::string copy;
|
||||
|
||||
- for ( spanEnd = spanStart; spanEnd < bufEnd; ++spanEnd ) {
|
||||
+ for ( spanEnd = buffer; spanEnd < bufEnd; ++spanEnd ) {
|
||||
|
||||
- if ( (0x20 <= *spanEnd) && (*spanEnd <= 0x7E) && (*spanEnd != '&') ) continue; // A regular ASCII character.
|
||||
+ if ( (0x20 <= *spanEnd) && (*spanEnd <= 0x7E) && (*spanEnd != '&') ) {
|
||||
+ copy.push_back(*spanEnd);
|
||||
+ continue; // A regular ASCII character.
|
||||
+ }
|
||||
|
||||
if ( *spanEnd >= 0x80 ) {
|
||||
|
||||
@@ -992,21 +1006,20 @@ ProcessUTF8Portion ( XMLParserAdapter * xmlParser,
|
||||
if ( uniLen > 0 ) {
|
||||
|
||||
// A valid UTF-8 character, keep it as-is.
|
||||
+ copy.append((const char*)spanEnd, uniLen);
|
||||
spanEnd += uniLen - 1; // ! The loop increment will put back the +1.
|
||||
|
||||
} else if ( (uniLen < 0) && (! last) ) {
|
||||
|
||||
// Have a partial UTF-8 character at the end of the buffer and more input coming.
|
||||
- xmlParser->ParseBuffer ( spanStart, (spanEnd - spanStart), false );
|
||||
+ xmlParser->ParseBuffer ( copy.c_str(), copy.size(), false );
|
||||
return (spanEnd - buffer);
|
||||
|
||||
} else {
|
||||
|
||||
// Not a valid UTF-8 sequence. Replace the first byte with the Latin-1 equivalent.
|
||||
- xmlParser->ParseBuffer ( spanStart, (spanEnd - spanStart), false );
|
||||
const char * replacement = kReplaceLatin1 [ *spanEnd - 0x80 ];
|
||||
- xmlParser->ParseBuffer ( replacement, strlen ( replacement ), false );
|
||||
- spanStart = spanEnd + 1; // ! The loop increment will do "spanEnd = spanStart".
|
||||
+ copy.append ( replacement );
|
||||
|
||||
}
|
||||
|
||||
@@ -1014,11 +1027,12 @@ ProcessUTF8Portion ( XMLParserAdapter * xmlParser,
|
||||
|
||||
// Replace ASCII controls other than tab, LF, and CR with a space.
|
||||
|
||||
- if ( (*spanEnd == kTab) || (*spanEnd == kLF) || (*spanEnd == kCR) ) continue;
|
||||
+ if ( (*spanEnd == kTab) || (*spanEnd == kLF) || (*spanEnd == kCR) ) {
|
||||
+ copy.push_back(*spanEnd);
|
||||
+ continue;
|
||||
+ }
|
||||
|
||||
- xmlParser->ParseBuffer ( spanStart, (spanEnd - spanStart), false );
|
||||
- xmlParser->ParseBuffer ( " ", 1, false );
|
||||
- spanStart = spanEnd + 1; // ! The loop increment will do "spanEnd = spanStart".
|
||||
+ copy.push_back(' ');
|
||||
|
||||
} else {
|
||||
|
||||
@@ -1030,18 +1044,21 @@ ProcessUTF8Portion ( XMLParserAdapter * xmlParser,
|
||||
if ( escLen < 0 ) {
|
||||
|
||||
// Have a partial numeric escape in this buffer, wait for more input.
|
||||
- if ( last ) continue; // No more buffers, not an escape, absorb as normal input.
|
||||
- xmlParser->ParseBuffer ( spanStart, (spanEnd - spanStart), false );
|
||||
+ if ( last ) {
|
||||
+ copy.push_back('&');
|
||||
+ continue; // No more buffers, not an escape, absorb as normal input.
|
||||
+ }
|
||||
+ xmlParser->ParseBuffer ( copy.c_str(), copy.size(), false );
|
||||
return (spanEnd - buffer);
|
||||
|
||||
} else if ( escLen > 0 ) {
|
||||
|
||||
// Have a complete numeric escape to replace.
|
||||
- xmlParser->ParseBuffer ( spanStart, (spanEnd - spanStart), false );
|
||||
- xmlParser->ParseBuffer ( " ", 1, false );
|
||||
- spanStart = spanEnd + escLen;
|
||||
- spanEnd = spanStart - 1; // ! The loop continuation will increment spanEnd!
|
||||
+ copy.push_back(' ');
|
||||
+ spanEnd = spanEnd + escLen - 1; // ! The loop continuation will increment spanEnd!
|
||||
|
||||
+ } else {
|
||||
+ copy.push_back('&');
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1049,10 +1066,8 @@ ProcessUTF8Portion ( XMLParserAdapter * xmlParser,
|
||||
}
|
||||
|
||||
XMP_Assert ( spanEnd == bufEnd );
|
||||
-
|
||||
- if ( spanStart < bufEnd ) xmlParser->ParseBuffer ( spanStart, (spanEnd - spanStart), false );
|
||||
- if ( last ) xmlParser->ParseBuffer ( " ", 1, true );
|
||||
-
|
||||
+ copy.push_back(' ');
|
||||
+ xmlParser->ParseBuffer ( copy.c_str(), copy.size(), true );
|
||||
return length;
|
||||
|
||||
} // ProcessUTF8Portion
|
||||
10
exiv2.spec
10
exiv2.spec
@ -1,6 +1,6 @@
|
||||
Name: exiv2
|
||||
Version: 0.26
|
||||
Release: 26
|
||||
Release: 27
|
||||
Summary: Exif, IPTC and XMP metadata and the ICC Profile
|
||||
License: GPLv2+
|
||||
URL: http://www.exiv2.org/
|
||||
@ -67,6 +67,8 @@ Patch6034: backport-0002-CVE-2021-29463.patch
|
||||
Patch6035: backport-CVE-2021-29464.patch
|
||||
Patch6036: backport-CVE-2021-29463.patch
|
||||
Patch6037: backport-CVE-2021-29473.patch
|
||||
Patch6038: backport-CVE-2021-29623.patch
|
||||
Patch6039: backport-CVE-2021-32617.patch
|
||||
|
||||
Provides: exiv2-libs
|
||||
Obsoletes: exiv2-libs
|
||||
@ -130,6 +132,12 @@ test -x %{buildroot}%{_libdir}/libexiv2.so
|
||||
%{_datadir}/doc/html/
|
||||
|
||||
%changelog
|
||||
* Thu May 27 2021 liuyumeng <liuyumeng5@huawei.com> - 0.26-27
|
||||
- Type:cves
|
||||
- ID:CVE-2021-29623 CVE-2021-32617
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2021-29623 CVE-2021-32617
|
||||
|
||||
* Wed May 12 2021 wangkerong <wangkerong@huawei.com> - 0.26-26
|
||||
- Type:cves
|
||||
- ID:CVE-2021-29464 CVE-2021-29463 CVE-2021-29473
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user