nokogiri 1.7.1 → 1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6c48bfb8026d4c2b05cdfbe4ad41d1977de3f13e
-  data.tar.gz: 3e86ba34536a69fa2bf755caed6ca26e469d5f2d
+  metadata.gz: eb765e84ffdc4d37c60bcdecccf93a7013903a79
+  data.tar.gz: f38b3df6ddee2451259d8724cb581ee5e668bf9e
 SHA512:
-  metadata.gz: 5e88b5fcbba44fa565b649fbc3c70ff1273d78bdd806f6214ec2e6c5ad5738ec507e151794875c4fefdd2be09f3d2ef3fe5eb9ed3c1660f416dc7d8fa0368deb
-  data.tar.gz: 4d67a00540da6a2473c7789128afa8cee0c428fe8f64c6dec503976530c7ef15417093391b99a149439ea246c85a05632efe8acb4aabd840c32d83431b2da86b
+  metadata.gz: f4740c16a8184bba54ac3729687cbfcd2ca31e08e7f65c8c146fbe119a8300bb1746328fa5478904ccc86d53adc52842efb00b073444c5b376da085e3b5ddf2f
+  data.tar.gz: dd97a4581ccc39013db1f1d2ab67b5ab44cc70eb89483a16e71c1063bb55c7b78690a6e6f5fbc28ded75e1eaf48819c452b72ef4299fe8283fc6ce4e3435bb7c

data/CHANGELOG.md

@@ -1,3 +1,16 @@
+# 1.7.2 / 2017-05-09
+
+## Security Notes
+
+[MRI] Upstream libxslt patches are applied to the vendored libxslt 1.1.29 which address CVE-2017-5029 and CVE-2016-4738.
+
+For more information:
+
+* https://github.com/sparklemotion/nokogiri/issues/1634
+* http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5029.html
+* http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4738.html
+
+
 # 1.7.1 / unreleased
 
 ## Security Notes

data/Manifest.txt

@@ -249,6 +249,8 @@ lib/xsd/xmlparser/nokogiri.rb
 patches/libxml2/0001-Fix-comparison-with-root-node-in-xmlXPathCmpNodes.patch
 patches/libxml2/0002-Fix-XPointer-paths-beginning-with-range-to.patch
 patches/libxml2/0003-Disallow-namespace-nodes-in-XPointer-ranges.patch
+patches/libxslt/0001-Fix-heap-overread-in-xsltFormatNumberConversion.patch
+patches/libxslt/0002-Check-for-integer-overflow-in-xsltAddTextString.patch
 patches/sort-patches-by-date
 suppressions/README.txt
 suppressions/nokogiri_ree-1.8.7.358.supp

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = '1.7.1'
+  VERSION = '1.7.2'
 
   class VersionInfo # :nodoc:
     def jruby?

data/patches/libxslt/0001-Fix-heap-overread-in-xsltFormatNumberConversion.patch

@@ -0,0 +1,31 @@
+From eb1030de31165b68487f288308f9d1810fed6880 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Fri, 10 Jun 2016 14:23:58 +0200
+Subject: [PATCH] Fix heap overread in xsltFormatNumberConversion
+
+An empty decimal-separator could cause a heap overread. This can be
+exploited to leak a couple of bytes after the buffer that holds the
+pattern string.
+
+Found with afl-fuzz and ASan.
+---
+ libxslt/numbers.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libxslt/numbers.c b/libxslt/numbers.c
+index d1549b4..e78c46b 100644
+--- a/libxslt/numbers.c
++++ b/libxslt/numbers.c
+@@ -1090,7 +1090,8 @@ xsltFormatNumberConversion(xsltDecimalFormatPtr self,
+     }
+ 
+     /* We have finished the integer part, now work on fraction */
+-    if (xsltUTF8Charcmp(the_format, self->decimalPoint) == 0) {
++    if ( (*the_format != 0) &&
++         (xsltUTF8Charcmp(the_format, self->decimalPoint) == 0) ) {
+         format_info.add_decimal = TRUE;
+ 	the_format += xsltUTF8Size(the_format);	/* Skip over the decimal */
+     }
+-- 
+2.9.3
+

data/patches/libxslt/0002-Check-for-integer-overflow-in-xsltAddTextString.patch

@@ -0,0 +1,74 @@
+From 08ab2774b870de1c7b5a48693df75e8154addae5 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Thu, 12 Jan 2017 15:39:52 +0100
+Subject: [PATCH] Check for integer overflow in xsltAddTextString
+
+Limit buffer size in xsltAddTextString to INT_MAX. The issue can be
+exploited to trigger an out of bounds write on 64-bit systems.
+
+Originally reported to Chromium:
+
+https://crbug.com/676623
+---
+ libxslt/transform.c     | 25 ++++++++++++++++++++++---
+ libxslt/xsltInternals.h |  4 ++--
+ 2 files changed, 24 insertions(+), 5 deletions(-)
+
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 519133f..02bff34 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -813,13 +813,32 @@ xsltAddTextString(xsltTransformContextPtr ctxt, xmlNodePtr target,
+         return(target);
+ 
+     if (ctxt->lasttext == target->content) {
++        int minSize;
+ 
+-	if (ctxt->lasttuse + len >= ctxt->lasttsize) {
++        /* Check for integer overflow accounting for NUL terminator. */
++        if (len >= INT_MAX - ctxt->lasttuse) {
++            xsltTransformError(ctxt, NULL, target,
++                "xsltCopyText: text allocation failed\n");
++            return(NULL);
++        }
++        minSize = ctxt->lasttuse + len + 1;
++
++        if (ctxt->lasttsize < minSize) {
+ 	    xmlChar *newbuf;
+ 	    int size;
++            int extra;
++
++            /* Double buffer size but increase by at least 100 bytes. */
++            extra = minSize < 100 ? 100 : minSize;
++
++            /* Check for integer overflow. */
++            if (extra > INT_MAX - ctxt->lasttsize) {
++                size = INT_MAX;
++            }
++            else {
++                size = ctxt->lasttsize + extra;
++            }
+ 
+-	    size = ctxt->lasttsize + len + 100;
+-	    size *= 2;
+ 	    newbuf = (xmlChar *) xmlRealloc(target->content,size);
+ 	    if (newbuf == NULL) {
+ 		xsltTransformError(ctxt, NULL, target,
+diff --git a/libxslt/xsltInternals.h b/libxslt/xsltInternals.h
+index 060b178..5ad1771 100644
+--- a/libxslt/xsltInternals.h
++++ b/libxslt/xsltInternals.h
+@@ -1754,8 +1754,8 @@ struct _xsltTransformContext {
+      * Speed optimization when coalescing text nodes
+      */
+     const xmlChar  *lasttext;		/* last text node content */
+-    unsigned int    lasttsize;		/* last text node size */
+-    unsigned int    lasttuse;		/* last text node use */
++    int             lasttsize;		/* last text node size */
++    int             lasttuse;		/* last text node use */
+     /*
+      * Per Context Debugging
+      */
+-- 
+2.9.3
+

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.7.1
+  version: 1.7.2
 platform: ruby
 authors:
 - Aaron Patterson
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-20 00:00:00.000000000 Z
+date: 2017-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile2
@@ -411,6 +411,8 @@ files:
 - patches/libxml2/0001-Fix-comparison-with-root-node-in-xmlXPathCmpNodes.patch
 - patches/libxml2/0002-Fix-XPointer-paths-beginning-with-range-to.patch
 - patches/libxml2/0003-Disallow-namespace-nodes-in-XPointer-ranges.patch
+- patches/libxslt/0001-Fix-heap-overread-in-xsltFormatNumberConversion.patch
+- patches/libxslt/0002-Check-for-integer-overflow-in-xsltAddTextString.patch
 - patches/sort-patches-by-date
 - ports/archives/libxml2-2.9.4.tar.gz
 - ports/archives/libxslt-1.1.29.tar.gz