francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
35 lines
1.1 KiB
Diff
35 lines
1.1 KiB
Diff
From 107d3801361b9f9084f78710178e683391f1d245 Mon Sep 17 00:00:00 2001
|
|
From: Jan Rybar <jrybar@redhat.com>
|
|
Date: Fri, 6 Jun 2025 13:25:55 +0200
|
|
Subject: [PATCH] Nested .policy files cause xml parsing overflow leading to
|
|
crash
|
|
|
|
CVE: CVE-2025-7519
|
|
|
|
Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245]
|
|
|
|
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
|
|
---
|
|
src/polkitbackend/polkitbackendactionpool.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/src/polkitbackend/polkitbackendactionpool.c b/src/polkitbackend/polkitbackendactionpool.c
|
|
index 43f89cb..f4acca9 100644
|
|
--- a/src/polkitbackend/polkitbackendactionpool.c
|
|
+++ b/src/polkitbackend/polkitbackendactionpool.c
|
|
@@ -739,6 +739,12 @@ _start (void *data, const char *el, const char **attr)
|
|
guint num_attr;
|
|
ParserData *pd = data;
|
|
|
|
+ if (pd->stack_depth < 0 || pd->stack_depth >= PARSER_MAX_DEPTH)
|
|
+ {
|
|
+ g_warning ("XML parsing reached max depth?");
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
for (num_attr = 0; attr[num_attr] != NULL; num_attr++)
|
|
;
|
|
|
|
--
|
|
2.40.0
|