File Fix-for-CVE-2019-20199-ezxml-bug-18.patch of Package netcdf

Overview Repositories Revisions Requests Users Attributes Meta

File Fix-for-CVE-2019-20199-ezxml-bug-18.patch of Package netcdf (Revision 41cb929ac91b495978fb1eaa6c079e77)

Currently displaying revision 41cb929ac91b495978fb1eaa6c079e77 , Show latest

From: Egbert Eich <eich@suse.com>
Date: Mon Oct 25 15:41:34 2021 +0200
Subject: Fix for CVE-2019-20199 / ezxml bug 18
Patch-mainline: Not yet
Git-commit: f9eadbe3f5825d5389731bdc8f6decf3d07152bd
References:

Make sure end token ';' has really been found.
This fixes
 https://sourceforge.net/p/ezxml/bugs/18/

Signed-off-by: Egbert Eich <eich@suse.com>
---
 netcdf-c-4.8.0/libdap4/ezxml.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/netcdf-c-4.8.0/libdap4/ezxml.c b/netcdf-c-4.8.0/libdap4/ezxml.c
index 8a57cfa..d60d4a3 100644
--- a/libdap4/ezxml.c
+++ b/libdap4/ezxml.c
@@ -198,9 +198,11 @@ char *ezxml_decode(char *s, char **ent, char t)
 
             if (ent[b++]) { /* found a match*/
                 if ((c = strlen(ent[b])) - 1 > (e = strchr(s, ';')) - s) {
-                    l = (d = (s - r)) + c + strlen(e); /* new length*/
+                    if (!e) { s++; continue; } // bug#18 / CVE-2019-20199
+		    l = (d = (s - r)) + c + strlen(e); /* new length*/
                     r = (r == m) ? strcpy(malloc(l), r) : realloc(r, l);
                     e = strchr((s = r + d), ';'); /* fix up pointers*/
+                    if (!e) { s++; continue; } // bug#18
                 }
 
                 memmove(s + c, e + 1, strlen(e)); /* shift rest of string*/

Places

File Fix-for-CVE-2019-20199-ezxml-bug-18.patch of Package netcdf (Revision 41cb929ac91b495978fb1eaa6c079e77)

Places