From 46041b65f2fbddf5c284ee1a1332fa2c515c0515 Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer Date: Thu, 5 Dec 2024 12:43:19 +0100 Subject: [PATCH] [CVE-2024-55549] Fix UAF related to excluded namespaces Definitions of excluded namespaces could be deleted in xsltParseTemplateContent. Store excluded namespace URIs in the stylesheet's dictionary instead of referencing the namespace definition. Thanks to Ivan Fratric for the report! Fixes #127. Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxslt/-/commit/46041b65f2fbddf5c284ee1a1332fa2c515c0515] CVE: CVE-2024-55549 Signed-off-by: Vijay Anusuri --- libxslt/xslt.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libxslt/xslt.c b/libxslt/xslt.c index 69116f2..02c2e3a 100644 --- a/libxslt/xslt.c +++ b/libxslt/xslt.c @@ -153,10 +153,20 @@ xsltParseContentError(xsltStylesheetPtr style, * in case of error */ static int -exclPrefixPush(xsltStylesheetPtr style, xmlChar * value) +exclPrefixPush(xsltStylesheetPtr style, xmlChar * orig) { + xmlChar *value; int i; + /* + * orig can come from a namespace definition on a node which + * could be deleted later, for example in xsltParseTemplateContent. + * Store the string in stylesheet's dict to avoid use after free. + */ + value = (xmlChar *) xmlDictLookup(style->dict, orig, -1); + if (value == NULL) + return(-1); + if (style->exclPrefixMax == 0) { style->exclPrefixMax = 4; style->exclPrefixTab = -- 2.34.1