svn commit: r417847 - in head/textproc/expat2: . files

[Mark Felder]

Author: feld
Date: Thu Jun 30 22:36:05 2016
New Revision: 417847
URL: https://svnweb.freebsd.org/changeset/ports/417847

Log:
  textproc/expat2: Patch vulnerability
  
  This patch resolves a vulnerability that may still exist due to
  compiler optimizations. The previous patches for CVE-2015-1283 and
  CVE-2015-2716 may not work as intended in some situations.
  
  MFH:		2016Q2
  Security:	CVE-2016-4472

Added:
  head/textproc/expat2/files/patch-CVE-2016-4472   (contents, props changed)
Modified:
  head/textproc/expat2/Makefile

Modified: head/textproc/expat2/Makefile
==============================================================================
--- head/textproc/expat2/Makefile	Thu Jun 30 22:32:36 2016	(r417846)
+++ head/textproc/expat2/Makefile	Thu Jun 30 22:36:05 2016	(r417847)
@@ -3,7 +3,7 @@
 
 PORTNAME=	expat
 PORTVERSION=	2.1.1
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	textproc
 MASTER_SITES=	SF
 

Added: head/textproc/expat2/files/patch-CVE-2016-4472
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/textproc/expat2/files/patch-CVE-2016-4472	Thu Jun 30 22:36:05 2016	(r417847)
@@ -0,0 +1,26 @@
+ expat/CMakeLists.txt |  3 +++
+ expat/lib/xmlparse.c | 48 +++++++++++++++++++++++++++++++++++++++++-------
+ 2 files changed, 44 insertions(+), 7 deletions(-)
+
+--- lib/xmlparse.c.orig	2016-06-30 22:23:11 UTC
++++ lib/xmlparse.c
+@@ -1693,7 +1693,8 @@ XML_GetBuffer(XML_Parser parser, int len
+   }
+ 
+   if (len > bufferLim - bufferEnd) {
+-    int neededSize = len + (int)(bufferEnd - bufferPtr);
++    /* Do not invoke signed arithmetic overflow: */
++    int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
+     if (neededSize < 0) {
+       errorCode = XML_ERROR_NO_MEMORY;
+       return NULL;
+@@ -1725,7 +1726,8 @@ XML_GetBuffer(XML_Parser parser, int len
+       if (bufferSize == 0)
+         bufferSize = INIT_BUFFER_SIZE;
+       do {
+-        bufferSize *= 2;
++        /* Do not invoke signed arithmetic overflow: */
++        bufferSize = (int) (2U * (unsigned) bufferSize);
+       } while (bufferSize < neededSize && bufferSize > 0);
+       if (bufferSize <= 0) {
+         errorCode = XML_ERROR_NO_MEMORY;