mirror of
https://git.in.rschanz.org/ryan77627/guix.git
synced 2024-12-29 07:42:23 -05:00
e940f6d801
* gnu/packages/patches/libcroco-CVE-2020-12825.patch: New patch. * gnu/local.mk (dist_patch_DATA): Register it. * gnu/packages/gnome.scm (libcroco/fixed): New variable. Apply patch. (libcroco)[replacement]: Graft.
187 lines
7.4 KiB
Diff
187 lines
7.4 KiB
Diff
From 7b64eb285dd937b34df71c95188301be50dd1409 Mon Sep 17 00:00:00 2001
|
|
From: Michael Catanzaro <mcatanzaro@gnome.org>
|
|
Date: Wed, 12 Aug 2020 13:54:15 -0500
|
|
Subject: [PATCH] libcroco: Limit recursion in block and any productions
|
|
(CVE-2020-12825)
|
|
|
|
If we don't have any limits, we can recurse forever and overflow the
|
|
stack.
|
|
|
|
This is per https://gitlab.gnome.org/Archive/libcroco/-/issues/8
|
|
|
|
https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404
|
|
---
|
|
src/st/croco/cr-parser.c | 44 ++++++++++++++++++++++++++--------------
|
|
1 file changed, 29 insertions(+), 15 deletions(-)
|
|
|
|
diff --git a/src/st/croco/cr-parser.c b/src/st/croco/cr-parser.c
|
|
index 07f4ed9e8b..8304b75614 100644
|
|
--- a/src/cr-parser.c
|
|
+++ b/src/cr-parser.c
|
|
@@ -136,6 +136,8 @@ struct _CRParserPriv {
|
|
|
|
#define CHARS_TAB_SIZE 12
|
|
|
|
+#define RECURSIVE_CALLERS_LIMIT 100
|
|
+
|
|
/**
|
|
* IS_NUM:
|
|
*@a_char: the char to test.
|
|
@@ -343,9 +345,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this);
|
|
|
|
static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this);
|
|
|
|
-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this);
|
|
+static enum CRStatus cr_parser_parse_any_core (CRParser * a_this,
|
|
+ guint n_calls);
|
|
|
|
-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this);
|
|
+static enum CRStatus cr_parser_parse_block_core (CRParser * a_this,
|
|
+ guint n_calls);
|
|
|
|
static enum CRStatus cr_parser_parse_value_core (CRParser * a_this);
|
|
|
|
@@ -783,7 +787,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
|
|
cr_parser_try_to_skip_spaces_and_comments (a_this);
|
|
|
|
do {
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, 0);
|
|
} while (status == CR_OK);
|
|
|
|
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr,
|
|
@@ -794,7 +798,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
|
|
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
|
|
token);
|
|
token = NULL;
|
|
- status = cr_parser_parse_block_core (a_this);
|
|
+ status = cr_parser_parse_block_core (a_this, 0);
|
|
CHECK_PARSING_STATUS (status,
|
|
FALSE);
|
|
goto done;
|
|
@@ -929,11 +933,11 @@ cr_parser_parse_selector_core (CRParser * a_this)
|
|
|
|
RECORD_INITIAL_POS (a_this, &init_pos);
|
|
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, 0);
|
|
CHECK_PARSING_STATUS (status, FALSE);
|
|
|
|
do {
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, 0);
|
|
|
|
} while (status == CR_OK);
|
|
|
|
@@ -955,10 +959,12 @@ cr_parser_parse_selector_core (CRParser * a_this)
|
|
*in chapter 4.1 of the css2 spec.
|
|
*block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*;
|
|
*@param a_this the current instance of #CRParser.
|
|
+ *@param n_calls used to limit recursion depth
|
|
*FIXME: code this function.
|
|
*/
|
|
static enum CRStatus
|
|
-cr_parser_parse_block_core (CRParser * a_this)
|
|
+cr_parser_parse_block_core (CRParser * a_this,
|
|
+ guint n_calls)
|
|
{
|
|
CRToken *token = NULL;
|
|
CRInputPos init_pos;
|
|
@@ -966,6 +972,9 @@ cr_parser_parse_block_core (CRParser * a_this)
|
|
|
|
g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR);
|
|
|
|
+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
|
|
+ return CR_ERROR;
|
|
+
|
|
RECORD_INITIAL_POS (a_this, &init_pos);
|
|
|
|
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token);
|
|
@@ -995,13 +1004,13 @@ cr_parser_parse_block_core (CRParser * a_this)
|
|
} else if (token->type == CBO_TK) {
|
|
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
|
|
token = NULL;
|
|
- status = cr_parser_parse_block_core (a_this);
|
|
+ status = cr_parser_parse_block_core (a_this, n_calls + 1);
|
|
CHECK_PARSING_STATUS (status, FALSE);
|
|
goto parse_block_content;
|
|
} else {
|
|
cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
|
|
token = NULL;
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
|
|
CHECK_PARSING_STATUS (status, FALSE);
|
|
goto parse_block_content;
|
|
}
|
|
@@ -1108,7 +1117,7 @@ cr_parser_parse_value_core (CRParser * a_this)
|
|
status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
|
|
token);
|
|
token = NULL;
|
|
- status = cr_parser_parse_block_core (a_this);
|
|
+ status = cr_parser_parse_block_core (a_this, 0);
|
|
CHECK_PARSING_STATUS (status, FALSE);
|
|
ref++;
|
|
goto continue_parsing;
|
|
@@ -1122,7 +1131,7 @@ cr_parser_parse_value_core (CRParser * a_this)
|
|
status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
|
|
token);
|
|
token = NULL;
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, 0);
|
|
if (status == CR_OK) {
|
|
ref++;
|
|
goto continue_parsing;
|
|
@@ -1161,10 +1170,12 @@ cr_parser_parse_value_core (CRParser * a_this)
|
|
* | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*;
|
|
*
|
|
*@param a_this the current instance of #CRParser.
|
|
+ *@param n_calls used to limit recursion depth
|
|
*@return CR_OK upon successfull completion, an error code otherwise.
|
|
*/
|
|
static enum CRStatus
|
|
-cr_parser_parse_any_core (CRParser * a_this)
|
|
+cr_parser_parse_any_core (CRParser * a_this,
|
|
+ guint n_calls)
|
|
{
|
|
CRToken *token1 = NULL,
|
|
*token2 = NULL;
|
|
@@ -1173,6 +1184,9 @@ cr_parser_parse_any_core (CRParser * a_this)
|
|
|
|
g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR);
|
|
|
|
+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
|
|
+ return CR_ERROR;
|
|
+
|
|
RECORD_INITIAL_POS (a_this, &init_pos);
|
|
|
|
status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1);
|
|
@@ -1211,7 +1225,7 @@ cr_parser_parse_any_core (CRParser * a_this)
|
|
*We consider parameter as being an "any*" production.
|
|
*/
|
|
do {
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
|
|
} while (status == CR_OK);
|
|
|
|
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
|
|
@@ -1236,7 +1250,7 @@ cr_parser_parse_any_core (CRParser * a_this)
|
|
}
|
|
|
|
do {
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
|
|
} while (status == CR_OK);
|
|
|
|
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
|
|
@@ -1264,7 +1278,7 @@ cr_parser_parse_any_core (CRParser * a_this)
|
|
}
|
|
|
|
do {
|
|
- status = cr_parser_parse_any_core (a_this);
|
|
+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
|
|
} while (status == CR_OK);
|
|
|
|
ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
|
|
--
|
|
GitLab
|
|
|