From 3536feedeed718087ca757869301ba85b57c5c24 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Tue, 1 Jul 2025 18:06:35 +0200 Subject: [PATCH] package/tinyxml: add patch for CVE-2023-34194 This fixes the following vulnerability: - CVE-2023-34194: StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace. Signed-off-by: Titouan Christophe Signed-off-by: Julien Olivain (cherry picked from commit 184a1b94a589da215282aec9f515914ba7831804) Signed-off-by: Thomas Perale --- ...e-assertion-via-crafted-XML-document.patch | 33 +++++++++++++++++++ package/tinyxml/tinyxml.mk | 3 ++ 2 files changed, 36 insertions(+) create mode 100644 package/tinyxml/0002-Avoid-reachable-assertion-via-crafted-XML-document.patch diff --git a/package/tinyxml/0002-Avoid-reachable-assertion-via-crafted-XML-document.patch b/package/tinyxml/0002-Avoid-reachable-assertion-via-crafted-XML-document.patch new file mode 100644 index 0000000000..802d964e15 --- /dev/null +++ b/package/tinyxml/0002-Avoid-reachable-assertion-via-crafted-XML-document.patch @@ -0,0 +1,33 @@ +From: Guilhem Moulin +Date: Sat, 30 Dec 2023 14:15:54 +0100 +Subject: Avoid reachable assertion via crafted XML document with a '\0' + located after whitespace + +Upstream: https://salsa.debian.org/debian/tinyxml/-/raw/2366e1f23d059d4c20c43c54176b6bd78d6a83fc/debian/patches/CVE-2023-34194.patch + +CVE: CVE-2023-34194 + +Bug: https://www.forescout.com/resources/sierra21-vulnerabilities +Bug-Debian: https://bugs.debian.org/1059315 +Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2023-34194 +Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2023-40462 +Signed-off-by: Titouan Christophe +--- + tinyxmlparser.cpp | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/tinyxmlparser.cpp b/src/tinyxmlparser.cpp +index 8aa0dfa..1601962 100644 +--- a/src/tinyxmlparser.cpp ++++ b/src/tinyxmlparser.cpp +@@ -1606,6 +1606,10 @@ const char* TiXmlDeclaration::Parse( const char* p, TiXmlParsingData* data, TiXm + } + + p = SkipWhiteSpace( p, _encoding ); ++ if ( !p || !*p ) ++ { ++ break; ++ } + if ( StringEqual( p, "version", true, _encoding ) ) + { + TiXmlAttribute attrib; diff --git a/package/tinyxml/tinyxml.mk b/package/tinyxml/tinyxml.mk index c6150b13fe..2f57b8a4f1 100644 --- a/package/tinyxml/tinyxml.mk +++ b/package/tinyxml/tinyxml.mk @@ -17,4 +17,7 @@ TINYXML_CPE_ID_VERSION = $(firstword $(subst _,$(space),$(TINYXML_VERSION))) # 0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch TINYXML_IGNORE_CVES += CVE-2021-42260 +# 0002-Avoid-reachable-assertion-via-crafted-XML-document.patch +TINYXML_IGNORE_CVES += CVE-2023-34194 + $(eval $(autotools-package))