| From fdf78a4877afa987ba646a8779b513f258e6d04c Mon Sep 17 00:00:00 2001 |
| From: Michael Catanzaro <mcatanzaro@gnome.org> |
| Date: Fri, 31 Jul 2020 15:21:53 -0500 |
| Subject: [PATCH] libcroco: Limit recursion in block and any productions |
| |
| (CVE-2020-12825) |
| |
| If we don't have any limits, we can recurse forever and overflow the |
| stack. |
| |
| Fixes #8 |
| This is per https://gitlab.gnome.org/Archive/libcroco/-/issues/8 |
| |
| https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404 |
| |
| CVE: CVE-2020-12825 |
| Upstream-Status: Backport [https://gitlab.gnome.org/Archive/libcroco/-/commit/6eb257e5c731c691eb137fca94e916ca73941a5a] |
| Comment: No refreshing changes done. |
| Signed-off-by: Saloni Jain <Saloni.Jain@kpit.com> |
| |
| --- |
| src/cr-parser.c | 44 +++++++++++++++++++++++++++++--------------- |
| 1 file changed, 29 insertions(+), 15 deletions(-) |
| |
| diff --git a/src/cr-parser.c b/src/cr-parser.c |
| index 18c9a01..f4a62e3 100644 |
| --- a/src/cr-parser.c |
| +++ b/src/cr-parser.c |
| @@ -136,6 +136,8 @@ struct _CRParserPriv { |
| |
| #define CHARS_TAB_SIZE 12 |
| |
| +#define RECURSIVE_CALLERS_LIMIT 100 |
| + |
| /** |
| * IS_NUM: |
| *@a_char: the char to test. |
| @@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); |
| |
| static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); |
| |
| -static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); |
| +static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, |
| + guint n_calls); |
| |
| -static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); |
| +static enum CRStatus cr_parser_parse_block_core (CRParser * a_this, |
| + guint n_calls); |
| |
| static enum CRStatus cr_parser_parse_value_core (CRParser * a_this); |
| |
| @@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) |
| cr_parser_try_to_skip_spaces_and_comments (a_this); |
| |
| do { |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, 0); |
| } while (status == CR_OK); |
| |
| status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, |
| @@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) |
| cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, |
| token); |
| token = NULL; |
| - status = cr_parser_parse_block_core (a_this); |
| + status = cr_parser_parse_block_core (a_this, 0); |
| CHECK_PARSING_STATUS (status, |
| FALSE); |
| goto done; |
| @@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this) |
| |
| RECORD_INITIAL_POS (a_this, &init_pos); |
| |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, 0); |
| CHECK_PARSING_STATUS (status, FALSE); |
| |
| do { |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, 0); |
| |
| } while (status == CR_OK); |
| |
| @@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this) |
| *in chapter 4.1 of the css2 spec. |
| *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*; |
| *@param a_this the current instance of #CRParser. |
| + *@param n_calls used to limit recursion depth |
| *FIXME: code this function. |
| */ |
| static enum CRStatus |
| -cr_parser_parse_block_core (CRParser * a_this) |
| +cr_parser_parse_block_core (CRParser * a_this, |
| + guint n_calls) |
| { |
| CRToken *token = NULL; |
| CRInputPos init_pos; |
| @@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this) |
| |
| g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR); |
| |
| + if (n_calls > RECURSIVE_CALLERS_LIMIT) |
| + return CR_ERROR; |
| + |
| RECORD_INITIAL_POS (a_this, &init_pos); |
| |
| status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token); |
| @@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this) |
| } else if (token->type == CBO_TK) { |
| cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); |
| token = NULL; |
| - status = cr_parser_parse_block_core (a_this); |
| + status = cr_parser_parse_block_core (a_this, n_calls + 1); |
| CHECK_PARSING_STATUS (status, FALSE); |
| goto parse_block_content; |
| } else { |
| cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); |
| token = NULL; |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, n_calls + 1); |
| CHECK_PARSING_STATUS (status, FALSE); |
| goto parse_block_content; |
| } |
| @@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this) |
| status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, |
| token); |
| token = NULL; |
| - status = cr_parser_parse_block_core (a_this); |
| + status = cr_parser_parse_block_core (a_this, 0); |
| CHECK_PARSING_STATUS (status, FALSE); |
| ref++; |
| goto continue_parsing; |
| @@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this) |
| status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, |
| token); |
| token = NULL; |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, 0); |
| if (status == CR_OK) { |
| ref++; |
| goto continue_parsing; |
| @@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this) |
| * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*; |
| * |
| *@param a_this the current instance of #CRParser. |
| + *@param n_calls used to limit recursion depth |
| *@return CR_OK upon successfull completion, an error code otherwise. |
| */ |
| static enum CRStatus |
| -cr_parser_parse_any_core (CRParser * a_this) |
| +cr_parser_parse_any_core (CRParser * a_this, |
| + guint n_calls) |
| { |
| CRToken *token1 = NULL, |
| *token2 = NULL; |
| @@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this) |
| |
| g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); |
| |
| + if (n_calls > RECURSIVE_CALLERS_LIMIT) |
| + return CR_ERROR; |
| + |
| RECORD_INITIAL_POS (a_this, &init_pos); |
| |
| status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1); |
| @@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this) |
| *We consider parameter as being an "any*" production. |
| */ |
| do { |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, n_calls + 1); |
| } while (status == CR_OK); |
| |
| ENSURE_PARSING_COND (status == CR_PARSING_ERROR); |
| @@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this) |
| } |
| |
| do { |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, n_calls + 1); |
| } while (status == CR_OK); |
| |
| ENSURE_PARSING_COND (status == CR_PARSING_ERROR); |
| @@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this) |
| } |
| |
| do { |
| - status = cr_parser_parse_any_core (a_this); |
| + status = cr_parser_parse_any_core (a_this, n_calls + 1); |
| } while (status == CR_OK); |
| |
| ENSURE_PARSING_COND (status == CR_PARSING_ERROR); |