a124f15
From e44d1dbe769f3b60a3d671be310f4af4f9490e6b Mon Sep 17 00:00:00 2001
a124f15
From: Andreas Schneider <asn@cryptomilk.org>
a124f15
Date: Thu, 3 Jan 2019 10:31:25 +0100
a124f15
Subject: [PATCH 68/70] xmpsdk: Build with -DBanAllEntityUsage=1
a124f15
a124f15
Prevent a denial-service-attack related to XML entity expansion
a124f15
("billion laughs attack").
a124f15
See https://bugzilla.redhat.com/show_bug.cgi?id=888769
a124f15
a124f15
Search for BanAllEntityUsage in xmpsdk/src/ExpatAdapter.cpp
a124f15
a124f15
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
a124f15
---
a124f15
 xmpsdk/CMakeLists.txt | 4 ++++
a124f15
 1 file changed, 4 insertions(+)
a124f15
a124f15
diff --git a/xmpsdk/CMakeLists.txt b/xmpsdk/CMakeLists.txt
a124f15
index fa521043..ae011dc3 100644
a124f15
--- a/xmpsdk/CMakeLists.txt
a124f15
+++ b/xmpsdk/CMakeLists.txt
a124f15
@@ -38,6 +38,10 @@ target_include_directories(exiv2-xmp
a124f15
         ${EXPAT_INCLUDE_DIR}
a124f15
 )
a124f15
 
a124f15
+# Prevent a denial-service-attack related to XML entity expansion
a124f15
+# ("billion laughs attack").
a124f15
+# See https://bugzilla.redhat.com/show_bug.cgi?id=888769
a124f15
+target_compile_definitions(exiv2-xmp PRIVATE BanAllEntityUsage=1)
a124f15
 if (MSVC)
a124f15
     target_compile_definitions(exiv2-xmp PRIVATE XML_STATIC)
a124f15
 endif()
a124f15
-- 
a124f15
2.17.2
a124f15