4c74f82dc2
Security fixes:
CVE-2017-9233 -- External entity infinite loop DoS
Details: https://libexpat.github.io/doc/cve-2017-9233/
Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
[MOX-002] CVE-2016-9063 -- Detect integer overflow; commit
d4f735b88d9932bd5039df2335eefdd0723dbe20
(Fixed version of existing downstream patches!)
(SF.net) #539 Fix regression from fix to CVE-2016-0718 cutting off
longer tag names; commits
* 896b6c1fd3b842f377d1b62135dccf0a579cf65d
* af507cef2c93cb8d40062a0abe43a4f4e9158fb2
#16 * 0dbbf43fdb20f593ddf4fa1ff67288000dd4a7fd
#25 More integer overflow detection (function poolGrow); commits
* 810b74e4703dcfdd8f404e3cb177d44684775143
* 44178553f3539ce69d34abee77a05e879a7982ac
[MOX-002] Detect overflow from len=INT_MAX call to XML_Parse; commits
* 4be2cb5afcc018d996f34bbbce6374b7befad47f
* 7e5b71b748491b6e459e5c9a1d090820f94544d8
[MOX-005] #30 Use high quality entropy for hash initialization:
* arc4random_buf on BSD, systems with libbsd
(when configured with --with-libbsd), CloudABI
* RtlGenRandom on Windows XP / Server 2003 and later
* getrandom on Linux 3.17+
In a way, that's still part of CVE-2016-5300.
https://github.com/libexpat/libexpat/pull/30/commits
[MOX-005] For the low quality entropy extraction fallback code,
the parser instance address can no longer leak, commit
04ad658bd3079dd15cb60fc67087900f0ff4b083
[MOX-003] Prevent use of uninitialised variable; commit
[MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
Add missing parameter validation to public API functions
and dedicated error code XML_ERROR_INVALID_ARGUMENT:
[MOX-006] * NULL checks; commits
* d37f74b2b7149a3a95a680c4c4cd2a451a51d60a (merge/many)
* 9ed727064b675b7180c98cb3d4f75efba6966681
* 6a747c837c50114dfa413994e07c0ba477be4534
* Negative length (XML_Parse); commit
[MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
[MOX-001] #35 Change hash algorithm to William Ahern's version of SipHash
to go further with fixing CVE-2012-0876.
https://github.com/libexpat/libexpat/pull/39/commits
Bug fixes:
#32 Fix sharing of hash salt across parsers;
relevant where XML_ExternalEntityParserCreate is called
prior to XML_Parse, in particular (e.g. FBReader)
#28 xmlwf: Auto-disable use of memory-mapping (and parsing
as a single chunk) for files larger than ~1 GB (2^30 bytes)
rather than failing with error "out of memory"
#3 Fix double free after malloc failure in DTD code; commit
7ae9c3d3af433cd4defe95234eae7dc8ed15637f
#17 Fix memory leak on parser error for unbound XML attribute
prefix with new namespaces defined in the same tag;
found by Google's OSS-Fuzz; commits
* 16f87daae5a16132e479e4f71862128c7a915c73
* b47dbc9745932c160893d433220e462bd605f8cd
xmlwf on Windows: Add missing calls to CloseHandle
New features:
#30 Introduced environment switch EXPAT_ENTROPY_DEBUG=1
for runtime debugging of entropy extraction
Other changes:
Increase code coverage
#33 Reject use of XML_UNICODE_WCHAR_T with sizeof(wchar_t) != 2;
XML_UNICODE_WCHAR_T was never meant to be used outside
of Windows; 4-byte wchar_t is common on Linux
(SF.net) #538 Start using -fno-strict-aliasing
(SF.net) #540 Support compilation against cloudlibc of CloudABI
Allow MinGW cross-compilation
(SF.net) #534 CMake: Introduce option "BUILD_doc" (enabled by default)
to bypass compilation of the xmlwf.1 man page
(SF.net) pr2 CMake: Introduce option "INSTALL" (enabled by default)
to bypass installation of expat files
CMake: Fix ninja support
Autotools: Add parameters --enable-xml-context [COUNT]
and --disable-xml-context; default of context of 1024
bytes enabled unchanged
#14 Drop AmigaOS 4.x code and includes
#14 Drop ancient build systems:
* Borland C++ Builder
* OpenVMS
* Open Watcom
* Visual Studio 6.0
* Pre-X Mac OS (MPW Makefile)
If you happen to rely on some of these, please get in
touch for joining with maintenance.
#10 Move from WIN32 to _WIN32
#13 Fix "make run-xmltest" order instability
Address compile warnings
Bump version info from 7:2:6 to 7:3:6
Add AUTHORS file
Infrastructure:
#1 Migrate from SourceForge to GitHub (except downloads):
https://github.com/libexpat/
#1 Re-create http://libexpat.org/ project website
Start utilizing Travis CI
Special thanks to:
Andy Wang
Don Lewis
Ed Schouten
Karl Waclawek
Pascal Cuoq
Rhodri James
Sergei Nikulov
Tobias Taschner
Viktor Szakats
and
Core Infrastructure Initiative
Mozilla Foundation (MOSS Track 3: Secure Open Source)
Radically Open Security
98 lines
2.2 KiB
C
Executable File
98 lines
2.2 KiB
C
Executable File
/* Copyright (c) 1998, 1999 Thai Open Source Software Center Ltd
|
|
See the file COPYING for copying permission.
|
|
*/
|
|
|
|
#define STRICT 1
|
|
#define WIN32_LEAN_AND_MEAN 1
|
|
|
|
#ifdef XML_UNICODE_WCHAR_T
|
|
#ifndef XML_UNICODE
|
|
#define XML_UNICODE
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef XML_UNICODE
|
|
#define UNICODE
|
|
#define _UNICODE
|
|
#endif /* XML_UNICODE */
|
|
#include <windows.h>
|
|
#include <stdio.h>
|
|
#include <tchar.h>
|
|
#include "filemap.h"
|
|
|
|
static void win32perror(const TCHAR *);
|
|
|
|
int
|
|
filemap(const TCHAR *name,
|
|
void (*processor)(const void *, size_t, const TCHAR *, void *arg),
|
|
void *arg)
|
|
{
|
|
HANDLE f;
|
|
HANDLE m;
|
|
DWORD size;
|
|
DWORD sizeHi;
|
|
void *p;
|
|
|
|
f = CreateFile(name, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
|
|
FILE_FLAG_SEQUENTIAL_SCAN, NULL);
|
|
if (f == INVALID_HANDLE_VALUE) {
|
|
win32perror(name);
|
|
return 0;
|
|
}
|
|
size = GetFileSize(f, &sizeHi);
|
|
if (size == (DWORD)-1) {
|
|
win32perror(name);
|
|
CloseHandle(f);
|
|
return 0;
|
|
}
|
|
if (sizeHi || (size > XML_MAX_CHUNK_LEN)) {
|
|
CloseHandle(f);
|
|
return 2; /* Cannot be passed to XML_Parse in one go */
|
|
}
|
|
/* CreateFileMapping barfs on zero length files */
|
|
if (size == 0) {
|
|
static const char c = '\0';
|
|
processor(&c, 0, name, arg);
|
|
CloseHandle(f);
|
|
return 1;
|
|
}
|
|
m = CreateFileMapping(f, NULL, PAGE_READONLY, 0, 0, NULL);
|
|
if (m == NULL) {
|
|
win32perror(name);
|
|
CloseHandle(f);
|
|
return 0;
|
|
}
|
|
p = MapViewOfFile(m, FILE_MAP_READ, 0, 0, 0);
|
|
if (p == NULL) {
|
|
win32perror(name);
|
|
CloseHandle(m);
|
|
CloseHandle(f);
|
|
return 0;
|
|
}
|
|
processor(p, size, name, arg);
|
|
UnmapViewOfFile(p);
|
|
CloseHandle(m);
|
|
CloseHandle(f);
|
|
return 1;
|
|
}
|
|
|
|
static void
|
|
win32perror(const TCHAR *s)
|
|
{
|
|
LPVOID buf;
|
|
if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER
|
|
| FORMAT_MESSAGE_FROM_SYSTEM,
|
|
NULL,
|
|
GetLastError(),
|
|
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
|
|
(LPTSTR) &buf,
|
|
0,
|
|
NULL)) {
|
|
_ftprintf(stderr, _T("%s: %s"), s, buf);
|
|
fflush(stderr);
|
|
LocalFree(buf);
|
|
}
|
|
else
|
|
_ftprintf(stderr, _T("%s: unknown Windows error\n"), s);
|
|
}
|