[Libreoffice-commits] core.git: Branch 'libreoffice-7-1' - external/redland

[Caolán McNamara (via logerrit)]

 external/redland/UnpackedTarball_raptor.mk     |    1 +
 external/redland/raptor/raptor-fix-oob.patch.1 |   14 ++++++++++++++
 2 files changed, 15 insertions(+)

New commits:
commit 702d6c1d688c905d8cc58664b9eebf532bc0ae6d
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Nov 23 14:33:06 2020 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Mon Nov 23 20:58:48 2020 +0100

    CVE-2020-25713 raptor2: malformed input file can lead to a segfault
    
    due to an out of bounds array access in
    raptor_xml_writer_start_element_common
    
    See:
    https://bugs.mageia.org/show_bug.cgi?id=27605
    https://www.openwall.com/lists/oss-security/2020/11/13/1
    
    Change-Id: Ida4783a61412ffce868eacf81310da338d3e2df1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/106248
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/external/redland/UnpackedTarball_raptor.mk b/external/redland/UnpackedTarball_raptor.mk
index 2e0ef98fa2b5..3a4d7f17a471 100644
--- a/external/redland/UnpackedTarball_raptor.mk
+++ b/external/redland/UnpackedTarball_raptor.mk
@@ -28,6 +28,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,raptor,\
 	$(if $(SYSTEM_LIBXML),,external/redland/raptor/rpath.patch) \
 	external/redland/raptor/xml2-config.patch \
 	external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1 \
+	external/redland/raptor/raptor-fix-oob.patch.1\
 	external/redland/raptor/libtool.patch \
 	external/redland/raptor/libxml-override.patch \
 ))
diff --git a/external/redland/raptor/raptor-fix-oob.patch.1 b/external/redland/raptor/raptor-fix-oob.patch.1
new file mode 100644
index 000000000000..04106dc9a70e
--- /dev/null
+++ b/external/redland/raptor/raptor-fix-oob.patch.1
@@ -0,0 +1,14 @@
+diff --git a/src/raptor_xml_writer.c b/src/raptor_xml_writer.c
+index 56993dc3..163f34d5 100644
+--- a/src/raptor_xml_writer.c
++++ b/src/raptor_xml_writer.c
+@@ -216,6 +216,9 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer,
+ 
+   if(nstack && element->attributes) {
+     for(i = 0; i < element->attribute_count; i++) {
++      if (nspace_declarations_count > element->attribute_count)
++        goto error;
++
+       /* qname */
+       if(element->attributes[i]->nspace) {
+         /* Check if we need a namespace declaration attribute */