Bug 145820 – possible crash in dev-libs/libxml2

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Tavis Ormandy (RETIRED) 2006-09-01 02:28:26 UTC]

This case from xmlSchemaGetCanonValue() mismatches snprintf length restriction
and buffer size.

        case XML_SCHEMAS_GMONTH: {
                /* TODO: Unclear in XML Schema 1.0 */
                /* TODO: What to do with the timezone? */
                *retValue = xmlMalloc(5);
                snprintf((char *) *retValue, 6, "--%02u",
                    val->value.date.mon);
            }

[Comment 1 Harlan Lieberman-Berg (RETIRED) 2006-09-01 02:40:13 UTC]

Could cause arbitrary code execution in some twisted universe on some strange compiler. Otherwise, possible crash (DoS).

gnome, please provide fixed ebuilds.

Whiteboard: A2/A3

[Comment 2 Harlan Lieberman-Berg (RETIRED) 2006-09-01 02:40:35 UTC]

Could cause arbitrary code execution in some twisted universe on some strange compiler. Otherwise, possible crash (DoS).

gnome, please provide fixed ebuilds.

Whiteboard: A2/A3 [ebuild] hlieberman

[Comment 3 Leonardo Boshell (RETIRED) 2006-12-13 17:55:31 UTC]

libxml2-2.6.27 includes a fix for this. I'm not sure if the security team has further plans regarding this problem. If not, please feel free to close.

[Comment 4 Mart Raudsepp 2007-01-09 07:46:55 UTC]

security@ seems to never have been CC'ed, it seems.
Closing as fixed as almost a month has passed without anyone raising any concerns.