[xmltooling] 01/01: Security fix from 1.5.5 for CVE-2015-0851

[Ferenc Wágner]

This is an automated email from the git hooks/post-receive script.

wferi-guest pushed a commit to branch squeeze
in repository xmltooling.

commit a4189150e01a0dd9a658a23dd909ae02030bb565
Author: Ferenc Wágner <wferi at niif.hu>
Date:   Sat Jul 18 21:36:24 2015 +0200

    Security fix from 1.5.5 for CVE-2015-0851
    
    Shibboleth SP software crashes on well-formed but invalid XML
    ====================================================================
    The Service Provider software contains a code path with an uncaught
    exception that can be triggered by an unauthenticated attacker by
    supplying well-formed but schema-invalid XML in the form of SAML
    metadata or SAML protocol messages. The result is a crash and so
    causes a denial of service.
---
 debian/changelog  |  7 +++++++
 xmltooling/base.h | 22 ++++++++++++++++++++--
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 39a1031..1dd77fe 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+xmltooling (1.3.3-2+deb6u1) squeeze-lts; urgency=high
+
+  * Apply security fix from 1.5.5 for CVE-2015-0851 DoS (Closes: #793855):
+    Shibboleth SP software crashes on well-formed but invalid XML
+
+ -- Ferenc Wagner <wferi at niif.hu>  Mon, 03 Aug 2015 13:25:11 +0200
+
 xmltooling (1.3.3-2) unstable; urgency=low
 
   * Force source format 1.0 for now since it makes backporting easier.
diff --git a/xmltooling/base.h b/xmltooling/base.h
index d1192dc..9794076 100644
--- a/xmltooling/base.h
+++ b/xmltooling/base.h
@@ -683,7 +683,16 @@
         XMLCh* m_##proper; \
     public: \
         pair<bool,int> get##proper() const { \
-            return make_pair((m_##proper!=NULL),(m_##proper!=NULL ? xercesc::XMLString::parseInt(m_##proper): 0)); \
+            if (m_##proper) { \
+                try { \
+                    return std::make_pair(true, xercesc::XMLString::parseInt(m_##proper)); \
+                } \
+                catch (...) { \
+                    return std::make_pair(true, 0); \
+                } \
+            } else { \
+                return std::make_pair(false, 0); \
+            } \
         } \
         void set##proper(const XMLCh* proper) { \
             m_##proper = prepareForAssignment(m_##proper,proper); \
@@ -1237,7 +1246,16 @@
 #define DECL_INTEGER_CONTENT(proper) \
     XMLTOOLING_DOXYGEN(Returns proper in integer form after a NULL indicator.) \
     std::pair<bool,int> get##proper() const { \
-        return std::make_pair((getTextContent()!=NULL), (getTextContent()!=NULL ? xercesc::XMLString::parseInt(getTextContent()) : 0)); \
+        if (getTextContent()) { \
+            try { \
+                return std::make_pair(true, xercesc::XMLString::parseInt(getTextContent())); \
+            } \
+            catch (...) { \
+                return std::make_pair(true, 0); \
+            } \
+        } else { \
+            return std::make_pair(false, 0); \
+        } \
     } \
     XMLTOOLING_DOXYGEN(Sets proper.) \
     void set##proper(int proper) { \

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-shibboleth/xmltooling.git