r40311 - in /desktop/squeeze/librsvg/debian: changelog patches/CVE-2013-1881.policy.patch patches/CVE-2013-1881.xmlentities.patch

joss at users.alioth.debian.org joss at users.alioth.debian.org
Wed Dec 4 14:39:39 UTC 2013


Author: joss
Date: Wed Dec  4 14:39:39 2013
New Revision: 40311

URL: http://svn.debian.org/wsvn/pkg-gnome/?sc=1&rev=40311
Log:
Fix CVE-2013-1881: disable loading of external entities.
Closes: #724741.

Added:
    desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.policy.patch
    desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.xmlentities.patch
Modified:
    desktop/squeeze/librsvg/debian/changelog

Modified: desktop/squeeze/librsvg/debian/changelog
URL: http://svn.debian.org/wsvn/pkg-gnome/desktop/squeeze/librsvg/debian/changelog?rev=40311&op=diff
==============================================================================
--- desktop/squeeze/librsvg/debian/changelog	[utf-8] (original)
+++ desktop/squeeze/librsvg/debian/changelog	[utf-8] Wed Dec  4 14:39:39 2013
@@ -1,3 +1,11 @@
+librsvg (2.26.3-2) oldstable; urgency=low
+
+  [ Raphaël Geissert ]
+  * Fix CVE-2013-1881: disable loading of external entities.
+    Closes: #724741.
+
+ -- Josselin Mouette <joss at debian.org>  Wed, 04 Dec 2013 15:35:15 +0100
+
 librsvg (2.26.3-1) unstable; urgency=low
 
   * New upstream bugfix release.

Added: desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.policy.patch
URL: http://svn.debian.org/wsvn/pkg-gnome/desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.policy.patch?rev=40311&op=file
==============================================================================
--- desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.policy.patch	(added)
+++ desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.policy.patch	[utf-8] Wed Dec  4 14:39:39 2013
@@ -0,0 +1,90 @@
+Index: librsvg-2.26.3/rsvg-image.c
+===================================================================
+--- librsvg-2.26.3.orig/rsvg-image.c	2013-11-28 12:01:22.865236793 +0100
++++ librsvg-2.26.3/rsvg-image.c	2013-11-28 12:17:25.242370794 +0100
+@@ -356,6 +356,51 @@ rsvg_acquire_vfs_resource (const char *f
+ }
+ #endif
+ 
++/* Partial origin-based policy, based on the one implemented in f01aded72c38f0e1  */
++gboolean
++_rsvg_acquire_xlink_allow_load (const char *href, const char *base_uri, GError ** err)
++{
++    char *base_scheme = NULL, *href_scheme = NULL;
++
++    if (base_uri)
++        base_scheme = g_uri_parse_scheme (base_uri);
++    if (href)
++        href_scheme = g_uri_parse_scheme (href);
++
++    /* Not a valid URI */
++    if (href_scheme == NULL)
++        goto deny;
++
++    /* Allow loads of data: from any location */
++    if (g_str_equal (href_scheme, "data"))
++        return TRUE;
++
++    /* no valid base URI */
++    if (base_scheme == NULL)
++        goto deny;
++
++    /* Deny loads from differing URI schemes */
++    if (href_scheme == NULL || !g_str_equal (href_scheme, base_scheme))
++        goto deny;
++
++    /* resource: is allowed to load anything from other resources */
++    if (g_str_equal (href_scheme, "resource"))
++        return TRUE;
++
++    /* Non-file: isn't allowed to load anything */
++    if (!g_str_equal (href_scheme, "file"))
++        goto deny;
++
++    /* no local-file policy is applied here */
++
++    return TRUE;
++
++deny:
++    g_set_error (err, G_IO_ERROR, G_IO_ERROR_PERMISSION_DENIED,
++                 "File may not link to URI \"%s\"", href);
++    return FALSE;
++}
++
+ GByteArray *
+ _rsvg_acquire_xlink_href_resource (const char *href, const char *base_uri, GError ** err)
+ {
+@@ -367,6 +412,9 @@ _rsvg_acquire_xlink_href_resource (const
+     if (!strncmp (href, "data:", 5))
+         arr = rsvg_acquire_base64_resource (href, NULL);
+ 
++    if (!_rsvg_acquire_xlink_allow_load(href, base_uri, err))
++        return NULL;
++
+     if (!arr)
+         arr = rsvg_acquire_file_resource (href, base_uri, NULL);
+ 
+Index: librsvg-2.26.3/rsvg-base.c
+===================================================================
+--- librsvg-2.26.3.orig/rsvg-base.c	2013-11-28 12:01:22.865236793 +0100
++++ librsvg-2.26.3/rsvg-base.c	2013-11-28 12:13:54.913248784 +0100
+@@ -1049,12 +1049,13 @@ rsvg_handle_set_base_uri (RsvgHandle * h
+     else
+         uri = rsvg_get_base_uri_from_filename (base_uri);
+ 
+-    if (uri) {
+-        if (handle->priv->base_uri)
+-            g_free (handle->priv->base_uri);
+-        handle->priv->base_uri = uri;
+-        rsvg_defs_set_base_uri (handle->priv->defs, handle->priv->base_uri);
+-    }
++    if (!uri)
++        uri = g_strdup("data:");
++
++    if (handle->priv->base_uri)
++        g_free (handle->priv->base_uri);
++    handle->priv->base_uri = uri;
++    rsvg_defs_set_base_uri (handle->priv->defs, handle->priv->base_uri);
+ }
+ 
+ /**

Added: desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.xmlentities.patch
URL: http://svn.debian.org/wsvn/pkg-gnome/desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.xmlentities.patch?rev=40311&op=file
==============================================================================
--- desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.xmlentities.patch	(added)
+++ desktop/squeeze/librsvg/debian/patches/CVE-2013-1881.xmlentities.patch	[utf-8] Wed Dec  4 14:39:39 2013
@@ -0,0 +1,20 @@
+Index: librsvg-2.26.3/rsvg-base.c
+===================================================================
+--- librsvg-2.26.3.orig/rsvg-base.c	2010-05-01 01:10:51.000000000 +0200
++++ librsvg-2.26.3/rsvg-base.c	2013-11-26 16:24:02.903472891 +0100
+@@ -602,6 +602,7 @@ rsvg_start_xinclude (RsvgHandle * ctx, R
+                 int result;
+ 
+                 xml_parser = xmlCreatePushParserCtxt (&rsvgSAXHandlerStruct, ctx, NULL, 0, NULL);
++                xml_parser->options |= XML_PARSE_NONET;
+                 result = xmlParseChunk (xml_parser, (char *) data->data, data->len, 0);
+                 result = xmlParseChunk (xml_parser, "", 0, TRUE);
+ 
+@@ -1118,6 +1119,7 @@ rsvg_handle_write_impl (RsvgHandle * han
+     if (handle->priv->ctxt == NULL) {
+         handle->priv->ctxt = xmlCreatePushParserCtxt (&rsvgSAXHandlerStruct, handle, NULL, 0,
+                                                       rsvg_handle_get_base_uri (handle));
++        handle->priv->ctxt->options |= XML_PARSE_NONET;
+ 
+         /* if false, external entities work, but internal ones don't. if true, internal entities
+            work, but external ones don't. favor internal entities, in order to not cause a




More information about the pkg-gnome-commits mailing list