M gnu/local.mk => gnu/local.mk +1 -0
@@ 2349,6 2349,7 @@ dist_patch_DATA = \
%D%/packages/patches/tidy-CVE-2015-5522+5523.patch \
%D%/packages/patches/timewarrior-time-sensitive-tests.patch \
%D%/packages/patches/tinydir-fix-cbehave-test.patch \
+ %D%/packages/patches/tinyxml-CVE-2023-34194.patch \
%D%/packages/patches/tinyxml-use-stl.patch \
%D%/packages/patches/tk-find-library.patch \
%D%/packages/patches/tla2tools-build-xml.patch \
A gnu/packages/patches/tinyxml-CVE-2023-34194.patch => gnu/packages/patches/tinyxml-CVE-2023-34194.patch +28 -0
@@ 0,0 1,28 @@
+From: Guilhem Moulin <guilhem@debian.org>
+Date: Sat, 30 Dec 2023 14:15:54 +0100
+Subject: Avoid reachable assertion via crafted XML document with a '\0'
+ located after whitespace
+
+Bug: https://www.forescout.com/resources/sierra21-vulnerabilities
+Bug-Debian: https://bugs.debian.org/1059315
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2023-34194
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2023-40462
+---
+ tinyxmlparser.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tinyxmlparser.cpp b/tinyxmlparser.cpp
+index 8aa0dfa..1601962 100644
+--- a/tinyxmlparser.cpp
++++ b/tinyxmlparser.cpp
+@@ -1606,6 +1606,10 @@ const char* TiXmlDeclaration::Parse( const char* p, TiXmlParsingData* data, TiXm
+ }
+
+ p = SkipWhiteSpace( p, _encoding );
++ if ( !p || !*p )
++ {
++ break;
++ }
+ if ( StringEqual( p, "version", true, _encoding ) )
+ {
+ TiXmlAttribute attrib;
M gnu/packages/xml.scm => gnu/packages/xml.scm +2 -1
@@ 1288,7 1288,8 @@ UTF-8 and UTF-16 encoding.")
(sha256
(base32
"14smciid19lvkxqznfig77jxn5s4iq3jpb47vh5a6zcaqp7gvg8m"))
- (patches (search-patches "tinyxml-use-stl.patch"))))
+ (patches (search-patches "tinyxml-use-stl.patch"
+ "tinyxml-CVE-2023-34194.patch"))))
(build-system gnu-build-system)
;; This library is missing *a lot* of the steps to make it usable, so we
;; have to add them here, like every other distro must do.