oss-security - CVE request: Null pointer derefence parsing xml file using libxml 2.9.4 (in recover mode)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACn5sdQKBq6cDXY_OAp6a+7dYWXtjE6=hSQps5g5aMxtiCTZHQ@mail.gmail.com>
Date: Sat, 5 Nov 2016 10:04:30 -0300
From: Gustavo Grieco <gustavo.grieco@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: Null pointer derefence parsing xml file using libxml
 2.9.4 (in recover mode)

Hi,

We found a null pointer dereference when parsing a xml file using recover
mode. It was tested in libxml 2.9.4 (ArchLinux x86_64). To reproduce:

$ xmllint --recover crash-libxml2-recover.xml

==27646==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x0000004fbd88 bp 0x7ffc3345dff0 sp 0x7ffc3345dfd0 T0)
    #0 0x4fbd87 in xmlDumpElementContent
/home/g/Work/Code/libxml2-2.9.4/valid.c:1181
    #1 0x4fbcd5 in xmlDumpElementContent
/home/g/Work/Code/libxml2-2.9.4/valid.c:1177
    #2 0x4fe5ff in xmlDumpElementDecl
/home/g/Work/Code/libxml2-2.9.4/valid.c:1706
    #3 0x72e714 in xmlBufDumpElementDecl
/home/g/Work/Code/libxml2-2.9.4/xmlsave.c:501
    #4 0x73048f in xmlNodeDumpOutputInternal
/home/g/Work/Code/libxml2-2.9.4/xmlsave.c:939
    #5 0x72fc47 in xmlNodeListDumpOutput
/home/g/Work/Code/libxml2-2.9.4/xmlsave.c:825
    #6 0x72f6d5 in xmlDtdDumpOutput
/home/g/Work/Code/libxml2-2.9.4/xmlsave.c:749
    #7 0x73038f in xmlNodeDumpOutputInternal
/home/g/Work/Code/libxml2-2.9.4/xmlsave.c:931
    #8 0x732412 in xmlDocContentDumpOutput
/home/g/Work/Code/libxml2-2.9.4/xmlsave.c:1234
    #9 0x735883 in xmlSaveDoc /home/g/Work/Code/libxml2-2.9.4/xmlsave.c:1936
    #10 0x40ba0f in parseAndPrintFile
/home/g/Work/Code/libxml2-2.9.4/xmllint.c:2712
    #11 0x411eb6 in main /home/g/Work/Code/libxml2-2.9.4/xmllint.c:3767
    #12 0x7f23dcd4c290 in __libc_start_main (/usr/lib/libc.so.6+0x20290)
    #13 0x4032b9 in _start
(/home/g/Work/Code/libxml2-2.9.4/xmllint+0x4032b9)


A reproducer is attached. It is interesting to note that the developers of
libxml2 strongly recommend not to use recover mode to parse untrusted
inputs. Please assign a CVE if suitable.

Regards,
Gustavo.

Content of type "text/html" skipped

View attachment "crash-libxml2-recover.xml" of type "text/xml" (803 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.