diff options
Diffstat (limited to 'meta/recipes-support/libcroco/files/CVE-2020-12825.patch')
-rw-r--r-- | meta/recipes-support/libcroco/files/CVE-2020-12825.patch | 192 |
1 files changed, 0 insertions, 192 deletions
diff --git a/meta/recipes-support/libcroco/files/CVE-2020-12825.patch b/meta/recipes-support/libcroco/files/CVE-2020-12825.patch deleted file mode 100644 index 42f92e3607..0000000000 --- a/meta/recipes-support/libcroco/files/CVE-2020-12825.patch +++ /dev/null @@ -1,192 +0,0 @@ -From fdf78a4877afa987ba646a8779b513f258e6d04c Mon Sep 17 00:00:00 2001 -From: Michael Catanzaro <mcatanzaro@gnome.org> -Date: Fri, 31 Jul 2020 15:21:53 -0500 -Subject: [PATCH] libcroco: Limit recursion in block and any productions - - (CVE-2020-12825) - -If we don't have any limits, we can recurse forever and overflow the -stack. - -Fixes #8 -This is per https://gitlab.gnome.org/Archive/libcroco/-/issues/8 - -https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404 - -CVE: CVE-2020-12825 -Upstream-Status: Backport [https://gitlab.gnome.org/Archive/libcroco/-/commit/6eb257e5c731c691eb137fca94e916ca73941a5a] -Comment: No refreshing changes done. -Signed-off-by: Saloni Jain <Saloni.Jain@kpit.com> - ---- - src/cr-parser.c | 44 +++++++++++++++++++++++++++++--------------- - 1 file changed, 29 insertions(+), 15 deletions(-) - -diff --git a/src/cr-parser.c b/src/cr-parser.c -index 18c9a01..f4a62e3 100644 ---- a/src/cr-parser.c -+++ b/src/cr-parser.c -@@ -136,6 +136,8 @@ struct _CRParserPriv { - - #define CHARS_TAB_SIZE 12 - -+#define RECURSIVE_CALLERS_LIMIT 100 -+ - /** - * IS_NUM: - *@a_char: the char to test. -@@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); - - static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); - --static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); -+static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, -+ guint n_calls); - --static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); -+static enum CRStatus cr_parser_parse_block_core (CRParser * a_this, -+ guint n_calls); - - static enum CRStatus cr_parser_parse_value_core (CRParser * a_this); - -@@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) - cr_parser_try_to_skip_spaces_and_comments (a_this); - - do { -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, 0); - } while (status == CR_OK); - - status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, -@@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) - cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, - token); - token = NULL; -- status = cr_parser_parse_block_core (a_this); -+ status = cr_parser_parse_block_core (a_this, 0); - CHECK_PARSING_STATUS (status, - FALSE); - goto done; -@@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this) - - RECORD_INITIAL_POS (a_this, &init_pos); - -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, 0); - CHECK_PARSING_STATUS (status, FALSE); - - do { -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, 0); - - } while (status == CR_OK); - -@@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this) - *in chapter 4.1 of the css2 spec. - *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*; - *@param a_this the current instance of #CRParser. -+ *@param n_calls used to limit recursion depth - *FIXME: code this function. - */ - static enum CRStatus --cr_parser_parse_block_core (CRParser * a_this) -+cr_parser_parse_block_core (CRParser * a_this, -+ guint n_calls) - { - CRToken *token = NULL; - CRInputPos init_pos; -@@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this) - - g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR); - -+ if (n_calls > RECURSIVE_CALLERS_LIMIT) -+ return CR_ERROR; -+ - RECORD_INITIAL_POS (a_this, &init_pos); - - status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token); -@@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this) - } else if (token->type == CBO_TK) { - cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); - token = NULL; -- status = cr_parser_parse_block_core (a_this); -+ status = cr_parser_parse_block_core (a_this, n_calls + 1); - CHECK_PARSING_STATUS (status, FALSE); - goto parse_block_content; - } else { - cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); - token = NULL; -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, n_calls + 1); - CHECK_PARSING_STATUS (status, FALSE); - goto parse_block_content; - } -@@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this) - status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, - token); - token = NULL; -- status = cr_parser_parse_block_core (a_this); -+ status = cr_parser_parse_block_core (a_this, 0); - CHECK_PARSING_STATUS (status, FALSE); - ref++; - goto continue_parsing; -@@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this) - status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, - token); - token = NULL; -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, 0); - if (status == CR_OK) { - ref++; - goto continue_parsing; -@@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this) - * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*; - * - *@param a_this the current instance of #CRParser. -+ *@param n_calls used to limit recursion depth - *@return CR_OK upon successfull completion, an error code otherwise. - */ - static enum CRStatus --cr_parser_parse_any_core (CRParser * a_this) -+cr_parser_parse_any_core (CRParser * a_this, -+ guint n_calls) - { - CRToken *token1 = NULL, - *token2 = NULL; -@@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this) - - g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); - -+ if (n_calls > RECURSIVE_CALLERS_LIMIT) -+ return CR_ERROR; -+ - RECORD_INITIAL_POS (a_this, &init_pos); - - status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1); -@@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this) - *We consider parameter as being an "any*" production. - */ - do { -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, n_calls + 1); - } while (status == CR_OK); - - ENSURE_PARSING_COND (status == CR_PARSING_ERROR); -@@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this) - } - - do { -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, n_calls + 1); - } while (status == CR_OK); - - ENSURE_PARSING_COND (status == CR_PARSING_ERROR); -@@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this) - } - - do { -- status = cr_parser_parse_any_core (a_this); -+ status = cr_parser_parse_any_core (a_this, n_calls + 1); - } while (status == CR_OK); - - ENSURE_PARSING_COND (status == CR_PARSING_ERROR); |