HCoop / jackhill / guix / guix.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
gnu: emacs-consult: Fix grammar.
[jackhill/guix/guix.git] / gnu / packages / patches / libcroco-CVE-2020-12825.patch
CommitLineData
e940f6d8
LLB		 1From 7b64eb285dd937b34df71c95188301be50dd1409 Mon Sep 17 00:00:00 2001
2From: Michael Catanzaro <mcatanzaro@gnome.org>
3Date: Wed, 12 Aug 2020 13:54:15 -0500
4Subject: [PATCH] libcroco: Limit recursion in block and any productions
5 (CVE-2020-12825)
6
7If we don't have any limits, we can recurse forever and overflow the
8stack.
9
10This is per https://gitlab.gnome.org/Archive/libcroco/-/issues/8
11
12https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404
13---
14 src/st/croco/cr-parser.c | 44 ++++++++++++++++++++++++++--------------
15 1 file changed, 29 insertions(+), 15 deletions(-)
16
17diff --git a/src/st/croco/cr-parser.c b/src/st/croco/cr-parser.c
18index 07f4ed9e8b..8304b75614 100644
19--- a/src/cr-parser.c
20+++ b/src/cr-parser.c
21@@ -136,6 +136,8 @@ struct _CRParserPriv {
22
23 #define CHARS_TAB_SIZE 12
24
25+#define RECURSIVE_CALLERS_LIMIT 100
26+
27 /**
28 * IS_NUM:
29 *@a_char: the char to test.
30@@ -343,9 +345,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this);
31
32 static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this);
33
34-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this);
35+static enum CRStatus cr_parser_parse_any_core (CRParser * a_this,
36+ guint n_calls);
37
38-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this);
39+static enum CRStatus cr_parser_parse_block_core (CRParser * a_this,
40+ guint n_calls);
41
42 static enum CRStatus cr_parser_parse_value_core (CRParser * a_this);
43
44@@ -783,7 +787,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
45 cr_parser_try_to_skip_spaces_and_comments (a_this);
46
47 do {
48- status = cr_parser_parse_any_core (a_this);
49+ status = cr_parser_parse_any_core (a_this, 0);
50 } while (status == CR_OK);
51
52 status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr,
53@@ -794,7 +798,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)
54 cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
55 token);
56 token = NULL;
57- status = cr_parser_parse_block_core (a_this);
58+ status = cr_parser_parse_block_core (a_this, 0);
59 CHECK_PARSING_STATUS (status,
60 FALSE);
61 goto done;
62@@ -929,11 +933,11 @@ cr_parser_parse_selector_core (CRParser * a_this)
63
64 RECORD_INITIAL_POS (a_this, &init_pos);
65
66- status = cr_parser_parse_any_core (a_this);
67+ status = cr_parser_parse_any_core (a_this, 0);
68 CHECK_PARSING_STATUS (status, FALSE);
69
70 do {
71- status = cr_parser_parse_any_core (a_this);
72+ status = cr_parser_parse_any_core (a_this, 0);
73
74 } while (status == CR_OK);
75
76@@ -955,10 +959,12 @@ cr_parser_parse_selector_core (CRParser * a_this)
77 *in chapter 4.1 of the css2 spec.
78 *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*;
79 *@param a_this the current instance of #CRParser.
80+ *@param n_calls used to limit recursion depth
81 *FIXME: code this function.
82 */
83 static enum CRStatus
84-cr_parser_parse_block_core (CRParser * a_this)
85+cr_parser_parse_block_core (CRParser * a_this,
86+ guint n_calls)
87 {
88 CRToken *token = NULL;
89 CRInputPos init_pos;
90@@ -966,6 +972,9 @@ cr_parser_parse_block_core (CRParser * a_this)
91
92 g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR);
93
94+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
95+ return CR_ERROR;
96+
97 RECORD_INITIAL_POS (a_this, &init_pos);
98
99 status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token);
100@@ -995,13 +1004,13 @@ cr_parser_parse_block_core (CRParser * a_this)
101 } else if (token->type == CBO_TK) {
102 cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
103 token = NULL;
104- status = cr_parser_parse_block_core (a_this);
105+ status = cr_parser_parse_block_core (a_this, n_calls + 1);
106 CHECK_PARSING_STATUS (status, FALSE);
107 goto parse_block_content;
108 } else {
109 cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);
110 token = NULL;
111- status = cr_parser_parse_any_core (a_this);
112+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
113 CHECK_PARSING_STATUS (status, FALSE);
114 goto parse_block_content;
115 }
116@@ -1108,7 +1117,7 @@ cr_parser_parse_value_core (CRParser * a_this)
117 status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
118 token);
119 token = NULL;
120- status = cr_parser_parse_block_core (a_this);
121+ status = cr_parser_parse_block_core (a_this, 0);
122 CHECK_PARSING_STATUS (status, FALSE);
123 ref++;
124 goto continue_parsing;
125@@ -1122,7 +1131,7 @@ cr_parser_parse_value_core (CRParser * a_this)
126 status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,
127 token);
128 token = NULL;
129- status = cr_parser_parse_any_core (a_this);
130+ status = cr_parser_parse_any_core (a_this, 0);
131 if (status == CR_OK) {
132 ref++;
133 goto continue_parsing;
134@@ -1161,10 +1170,12 @@ cr_parser_parse_value_core (CRParser * a_this)
135 * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*;
136 *
137 *@param a_this the current instance of #CRParser.
138+ *@param n_calls used to limit recursion depth
139 *@return CR_OK upon successfull completion, an error code otherwise.
140 */
141 static enum CRStatus
142-cr_parser_parse_any_core (CRParser * a_this)
143+cr_parser_parse_any_core (CRParser * a_this,
144+ guint n_calls)
145 {
146 CRToken *token1 = NULL,
147 *token2 = NULL;
148@@ -1173,6 +1184,9 @@ cr_parser_parse_any_core (CRParser * a_this)
149
150 g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR);
151
152+ if (n_calls > RECURSIVE_CALLERS_LIMIT)
153+ return CR_ERROR;
154+
155 RECORD_INITIAL_POS (a_this, &init_pos);
156
157 status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1);
158@@ -1211,7 +1225,7 @@ cr_parser_parse_any_core (CRParser * a_this)
159 *We consider parameter as being an "any*" production.
160 */
161 do {
162- status = cr_parser_parse_any_core (a_this);
163+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
164 } while (status == CR_OK);
165
166 ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
167@@ -1236,7 +1250,7 @@ cr_parser_parse_any_core (CRParser * a_this)
168 }
169
170 do {
171- status = cr_parser_parse_any_core (a_this);
172+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
173 } while (status == CR_OK);
174
175 ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
176@@ -1264,7 +1278,7 @@ cr_parser_parse_any_core (CRParser * a_this)
177 }
178
179 do {
180- status = cr_parser_parse_any_core (a_this);
181+ status = cr_parser_parse_any_core (a_this, n_calls + 1);
182 } while (status == CR_OK);
183
184 ENSURE_PARSING_COND (status == CR_PARSING_ERROR);
185--
186GitLab
187
jackhill's copy of GNU Guix: https://guix.gnu.org/