|
 |
9beba4b |
diff -up thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236 thunderbird-91.7.0/parser/expat/lib/xmlparse.c
|
|
|
9beba4b |
--- thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236 2022-03-02 18:08:40.085642028 +0100
|
|
|
9beba4b |
+++ thunderbird-91.7.0/parser/expat/lib/xmlparse.c 2022-03-02 18:13:31.838667958 +0100
|
|
|
9beba4b |
@@ -700,8 +700,7 @@ XML_ParserCreate(const XML_Char *encodin
|
|
|
9beba4b |
XML_Parser XMLCALL
|
|
|
9beba4b |
XML_ParserCreateNS(const XML_Char *encodingName, XML_Char nsSep)
|
|
|
9beba4b |
{
|
|
|
9beba4b |
- XML_Char tmp[2];
|
|
|
9beba4b |
- *tmp = nsSep;
|
|
|
9beba4b |
+ XML_Char tmp[2] = {nsSep, 0};
|
|
|
9beba4b |
return XML_ParserCreate_MM(encodingName, NULL, tmp);
|
|
|
9beba4b |
}
|
|
|
9beba4b |
#endif
|
|
|
9beba4b |
@@ -1276,8 +1275,7 @@ XML_ExternalEntityParserCreate(XML_Parse
|
|
|
9beba4b |
would be otherwise.
|
|
|
9beba4b |
*/
|
|
|
9beba4b |
if (ns) {
|
|
|
9beba4b |
- XML_Char tmp[2];
|
|
|
9beba4b |
- *tmp = namespaceSeparator;
|
|
|
9beba4b |
+ XML_Char tmp[2] = {parser->m_namespaceSeparator, 0};
|
|
|
9beba4b |
parser = parserCreate(encodingName, &parser->m_mem, tmp, newDtd);
|
|
|
9beba4b |
}
|
|
|
9beba4b |
else {
|
|
|
9beba4b |
@@ -3667,6 +3665,16 @@ addBinding(XML_Parser parser, PREFIX *pr
|
|
|
9beba4b |
if (!mustBeXML && isXMLNS
|
|
|
9beba4b |
&& (len > xmlnsLen || uri[len] != xmlnsNamespace[len]))
|
|
|
9beba4b |
isXMLNS = XML_FALSE;
|
|
|
9beba4b |
+ // NOTE: While Expat does not validate namespace URIs against RFC 3986,
|
|
|
9beba4b |
+ // we have to at least make sure that the XML processor on top of
|
|
|
9beba4b |
+ // Expat (that is splitting tag names by namespace separator into
|
|
|
9beba4b |
+ // 2- or 3-tuples (uri-local or uri-local-prefix)) cannot be confused
|
|
|
9beba4b |
+ // by an attacker putting additional namespace separator characters
|
|
|
9beba4b |
+ // into namespace declarations. That would be ambiguous and not to
|
|
|
9beba4b |
+ // be expected.
|
|
|
9beba4b |
+ if (parser->m_ns && (uri[len] == parser->m_namespaceSeparator)) {
|
|
|
9beba4b |
+ return XML_ERROR_SYNTAX;
|
|
|
9beba4b |
+ }
|
|
|
9beba4b |
}
|
|
|
9beba4b |
isXML = isXML && len == xmlLen;
|
|
|
9beba4b |
isXMLNS = isXMLNS && len == xmlnsLen;
|