diff options
Diffstat (limited to 'gnu/packages/patches/tinyxml-CVE-2023-34194.patch')
| -rw-r--r-- | gnu/packages/patches/tinyxml-CVE-2023-34194.patch | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/gnu/packages/patches/tinyxml-CVE-2023-34194.patch b/gnu/packages/patches/tinyxml-CVE-2023-34194.patch new file mode 100644 index 0000000000..dee0aa1d93 --- /dev/null +++ b/gnu/packages/patches/tinyxml-CVE-2023-34194.patch @@ -0,0 +1,28 @@ +From: Guilhem Moulin <guilhem@debian.org> +Date: Sat, 30 Dec 2023 14:15:54 +0100 +Subject: Avoid reachable assertion via crafted XML document with a '\0' + located after whitespace + +Bug: https://www.forescout.com/resources/sierra21-vulnerabilities +Bug-Debian: https://bugs.debian.org/1059315 +Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2023-34194 +Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2023-40462 +--- + tinyxmlparser.cpp | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tinyxmlparser.cpp b/tinyxmlparser.cpp +index 8aa0dfa..1601962 100644 +--- a/tinyxmlparser.cpp ++++ b/tinyxmlparser.cpp +@@ -1606,6 +1606,10 @@ const char* TiXmlDeclaration::Parse( const char* p, TiXmlParsingData* data, TiXm + } + + p = SkipWhiteSpace( p, _encoding ); ++ if ( !p || !*p ) ++ { ++ break; ++ } + if ( StringEqual( p, "version", true, _encoding ) ) + { + TiXmlAttribute attrib; |