# Buildsheet autogenerated by ravenadm tool -- Do not edit. NAMEBASE= libcroco VERSION= 0.6.13 REVISION= 2 KEYWORDS= textproc VARIANTS= std SDESC[std]= CSS2 parsing library HOMEPAGE= https://gitlab.gnome.org/Archive/libcroco CONTACT= nobody DOWNLOAD_GROUPS= main SITES[main]= GNOME/libcroco/0.6 DISTFILE[1]= libcroco-0.6.13.tar.xz:main DIST_SUBDIR= gnome2 DF_INDEX= 1 SPKGS[std]= set primary dev docs OPTIONS_AVAILABLE= none OPTIONS_STANDARD= none USES= cpe gmake libtool pkgconfig mbsdfix GNOME_COMPONENTS= glib libxml2 LICENSE= LGPL21:primary LICENSE_TERMS= primary:{{WRKDIR}}/TERMS LICENSE_FILE= LGPL21:{{WRKSRC}}/COPYING.LIB LICENSE_AWK= TERMS:"__LIBCROCO_H__" LICENSE_SOURCE= TERMS:{{WRKSRC}}/src/libcroco.h LICENSE_SCHEME= solo CPE_VENDOR= gnome FPC_EQUIVALENT= textproc/libcroco MUST_CONFIGURE= gnu CONFIGURE_ARGS= --disable-gtk-doc-html INSTALL_TARGET= install-strip PLIST_SUB= VERSION="0.6" VAR_OPSYS[sunos]= CONFIGURE_ARGS=--disable-Bsymbolic CVE_FIXED= CVE-2020-12825 post-install: ${MKDIR} ${STAGEDIR}${STD_DOCDIR} ${MV} ${STAGEDIR}${PREFIX}/share/gtk-doc/html/libcroco \ ${STAGEDIR}${PREFIX}/share/doc/ ${RM} -r ${STAGEDIR}${PREFIX}/share/gtk-doc [FILE:266:descriptions/desc.primary] libcroco is a standalone css2 parsing library. It provides a low level event driven SAC like api and a css object model like api. This library was written to bring the css support to the mlview xml editor project but it can be used for other applications as well. [FILE:108:distinfo] 767ec234ae7aa684695b3a735548224888132e063f92db585759b422570621d4 487840 gnome2/libcroco-0.6.13.tar.xz [FILE:115:manifests/plist.primary] bin/ croco-%%VERSION%%-config csslint-%%VERSION%% lib/ libcroco-%%VERSION%%.so.3 libcroco-%%VERSION%%.so.3.0.1 [FILE:542:manifests/plist.dev] include/libcroco-%%VERSION%%/libcroco/ cr-additional-sel.h cr-attr-sel.h cr-cascade.h cr-declaration.h cr-doc-handler.h cr-enc-handler.h cr-fonts.h cr-input.h cr-num.h cr-om-parser.h cr-parser.h cr-parsing-location.h cr-prop-list.h cr-pseudo.h cr-rgb.h cr-sel-eng.h cr-selector.h cr-simple-sel.h cr-statement.h cr-string.h cr-style.h cr-stylesheet.h cr-term.h cr-tknzr.h cr-token.h cr-utils.h libcroco-config.h libcroco.h lib/ libcroco-%%VERSION%%.a libcroco-%%VERSION%%.so lib/pkgconfig/libcroco-%%VERSION%%.pc [FILE:900:manifests/plist.docs] share/doc/libcroco/ ch01.html home.png index.html left-insensitive.png left.png libcroco-cr-additional-sel.html libcroco-cr-attr-sel.html libcroco-cr-cascade.html libcroco-cr-declaration.html libcroco-cr-doc-handler.html libcroco-cr-enc-handler.html libcroco-cr-fonts.html libcroco-cr-input.html libcroco-cr-num.html libcroco-cr-om-parser.html libcroco-cr-parser.html libcroco-cr-parsing-location.html libcroco-cr-prop-list.html libcroco-cr-pseudo.html libcroco-cr-rgb.html libcroco-cr-sel-eng.html libcroco-cr-selector.html libcroco-cr-simple-sel.html libcroco-cr-statement.html libcroco-cr-string.html libcroco-cr-style.html libcroco-cr-stylesheet.html libcroco-cr-term.html libcroco-cr-tknzr.html libcroco-cr-token.html libcroco-cr-utils.html libcroco-libcroco-config.html libcroco.devhelp2 right-insensitive.png right.png style.css up-insensitive.png up.png [FILE:213:patches/patch-csslint_csslint.c] --- csslint/csslint.c.orig 2019-04-06 16:37:03 UTC +++ csslint/csslint.c @@ -25,6 +25,7 @@ #include "libcroco.h" #include +#include #include #include [FILE:7746:patches/patch-fix-CVE-2020-12825] From fdf78a4877afa987ba646a8779b513f258e6d04c Mon Sep 17 00:00:00 2001 From: Michael Catanzaro Date: Fri, 31 Jul 2020 15:21:53 -0500 Subject: [PATCH] libcroco: Limit recursion in block and any productions (CVE-2020-12825) If we don't have any limits, we can recurse forever and overflow the stack. Fixes #8 This is per https://gitlab.gnome.org/Archive/libcroco/-/issues/8 https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404 CVE: CVE-2020-12825 Upstream-Status: Backport [https://gitlab.gnome.org/Archive/libcroco/-/commit/6eb257e5c731c691eb137fca94e916ca73941a5a] Comment: No refreshing changes done. Signed-off-by: Saloni Jain --- src/cr-parser.c | 44 +++++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 15 deletions(-) --- a/src/cr-parser.c +++ src/cr-parser.c @@ -136,6 +136,8 @@ struct _CRParserPriv { #define CHARS_TAB_SIZE 12 +#define RECURSIVE_CALLERS_LIMIT 100 + /** * IS_NUM: *@a_char: the char to test. @@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); -static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); +static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, + guint n_calls); -static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); +static enum CRStatus cr_parser_parse_block_core (CRParser * a_this, + guint n_calls); static enum CRStatus cr_parser_parse_value_core (CRParser * a_this); @@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) cr_parser_try_to_skip_spaces_and_comments (a_this); do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); } while (status == CR_OK); status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, @@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_block_core (a_this); + status = cr_parser_parse_block_core (a_this, 0); CHECK_PARSING_STATUS (status, FALSE); goto done; @@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this) RECORD_INITIAL_POS (a_this, &init_pos); - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); CHECK_PARSING_STATUS (status, FALSE); do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); } while (status == CR_OK); @@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this) *in chapter 4.1 of the css2 spec. *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*; *@param a_this the current instance of #CRParser. + *@param n_calls used to limit recursion depth *FIXME: code this function. */ static enum CRStatus -cr_parser_parse_block_core (CRParser * a_this) +cr_parser_parse_block_core (CRParser * a_this, + guint n_calls) { CRToken *token = NULL; CRInputPos init_pos; @@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this) g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR); + if (n_calls > RECURSIVE_CALLERS_LIMIT) + return CR_ERROR; + RECORD_INITIAL_POS (a_this, &init_pos); status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token); @@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this) } else if (token->type == CBO_TK) { cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_block_core (a_this); + status = cr_parser_parse_block_core (a_this, n_calls + 1); CHECK_PARSING_STATUS (status, FALSE); goto parse_block_content; } else { cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); CHECK_PARSING_STATUS (status, FALSE); goto parse_block_content; } @@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this) status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_block_core (a_this); + status = cr_parser_parse_block_core (a_this, 0); CHECK_PARSING_STATUS (status, FALSE); ref++; goto continue_parsing; @@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this) status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); token = NULL; - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, 0); if (status == CR_OK) { ref++; goto continue_parsing; @@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this) * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*; * *@param a_this the current instance of #CRParser. + *@param n_calls used to limit recursion depth *@return CR_OK upon successfull completion, an error code otherwise. */ static enum CRStatus -cr_parser_parse_any_core (CRParser * a_this) +cr_parser_parse_any_core (CRParser * a_this, + guint n_calls) { CRToken *token1 = NULL, *token2 = NULL; @@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this) g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); + if (n_calls > RECURSIVE_CALLERS_LIMIT) + return CR_ERROR; + RECORD_INITIAL_POS (a_this, &init_pos); status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1); @@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this) *We consider parameter as being an "any*" production. */ do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); ENSURE_PARSING_COND (status == CR_PARSING_ERROR); @@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this) } do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); ENSURE_PARSING_COND (status == CR_PARSING_ERROR); @@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this) } do { - status = cr_parser_parse_any_core (a_this); + status = cr_parser_parse_any_core (a_this, n_calls + 1); } while (status == CR_OK); ENSURE_PARSING_COND (status == CR_PARSING_ERROR); [FILE:202:patches/patch-tests_test5-main.c] --- tests/test5-main.c.orig 2019-04-06 16:37:03 UTC +++ tests/test5-main.c @@ -21,6 +21,7 @@ */ #include +#include #include "cr-test-utils.h" #include "libcroco.h"