Skip to content

[libxml] Fix dict corruption caused by entity reference cycles - #4990

Merged
dahlstrom-g merged 2 commits into
youtube:25.lts.1+from
dahlstrom-g:CVE-2022-40304
Mar 13, 2025
Merged

dahlstrom-g merged 2 commits into
youtube:25.lts.1+from
dahlstrom-g:CVE-2022-40304

Conversation

@dahlstrom-g

Copy link
Copy Markdown
Contributor

Issue: 398872877

@kaidokert kaidokert changed the title Fix dict corruption caused by entity reference cycles [libxml] Fix dict corruption caused by entity reference cycles Mar 5, 2025
nwellnhof and others added 2 commits March 13, 2025 15:00
When an entity reference cycle is detected, the entity content is
cleared by setting its first byte to zero. But the entity content might
be allocated from a dict. In this case, the dict entry becomes corrupted
leading to all kinds of logic errors, including memory errors like
double-frees.

Stop storing entity content, orig, ExternalID and SystemID in a dict.
These values are unlikely to occur multiple times in a document, so they
shouldn't have been stored in a dict in the first place.

Thanks to Ned Williamson and Nathan Wachholz working with Google Project
Zero for the report!

(cherry picked from commit 1b41ec4e9433b05bb0376be4725804c54ef1d80b)
… by commit d88efc0.

Issue: 398872877
Reviewed-on: youtube#4990
@dahlstrom-g
dahlstrom-g merged commit 9da5a01 into youtube:25.lts.1+ Mar 13, 2025
@dahlstrom-g
dahlstrom-g deleted the CVE-2022-40304 branch March 13, 2025 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants