New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 616040 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug

Blocking:
issue 616046
issue 616698
issue 620679



Sign in to add a comment

Security: another round of security fixes at libxml

Project Member Reported by mmoroz@chromium.org, May 31 2016

Issue description

There are more vulnerabilities in the libxml not fixed yet.

Let it be a tracking bug for future updates

Opened issues (access to bugzilla links is likely to be restricted):
1) heap-buffer-overflow in htmlCurrentChar after encoding failure (https://bugzilla.gnome.org/show_bug.cgi?id=765468)

2) libxml2 heap-buffer-overflow in htmlCurrentChar (https://bugzilla.gnome.org/show_bug.cgi?id=764615)

3) Fixing libxml2 format string warnings reveals possible user-controlled format string vulnerability (https://bugzilla.gnome.org/show_bug.cgi?id=761029)

4) heap-buffer-overflow in xmlParseEndTag2 (https://bugzilla.gnome.org/show_bug.cgi?id=758549)

5) heap-buffer-overflow in xmlParseMisc (https://bugzilla.gnome.org/show_bug.cgi?id=756525)

6) Heap Out-of-bound read and UAF in xmlDictComputeFastKey from xmlParseNameComplex (https://bugzilla.gnome.org/show_bug.cgi?id=766956)

7) Infinite recursion in parser.c (https://bugzilla.gnome.org/show_bug.cgi?id=759495 and https://bugzilla.gnome.org/show_bug.cgi?id=759579)

The list may be not too accurate, but this is what I see.
 

Comment 1 by mmoroz@chromium.org, May 31 2016

Blocking: 616046
I've collected reproducers for these bugs and for old ones, uploaded reproducers for fixed bugs into the _static corpus folder. Also will upload reproducers for currently opened bugs once they get fixed (otherwise CF will stuck at them).
Project Member

Comment 2 by ClusterFuzz, May 31 2016

Status: Assigned (was: Unconfirmed)
Cc: ail@google.com
I'm ready and able to do this, but I don't see any upstream commits. I'll monitor it but if you see something available please ping.
Cc: mruhstaller@google.com
Blocking: 616698

Comment 7 by f...@chromium.org, Jun 2 2016

Components: Security
Labels: -Type-Bug-Security Type-Bug
Changing labels to move this out of the security sheriff triage queue, since this is meant to be a broader tracking bug.

Comment 8 by mmoroz@chromium.org, Jun 16 2016

Blocking: 620679

Comment 9 by ddkil...@apple.com, Jun 16 2016

You may also want to keep an eye on:

 Bug 763686 : multiple heap overflow vulnerabilities in html parse functions
<https://bugzilla.gnome.org/show_bug.cgi?id=763686>
- Reporter uploaded zip of ~3000 test cases that crash under ASan on a public bug.

 Bug 764427 : CVE-2016-2073: Buffer overread in xmlDictLookup with POC
<https://bugzilla.gnome.org/show_bug.cgi?id=764427>
- Filed based on mail to sos-security mailing list.
  <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2073>

Cc: mmoroz@chromium.org
Status: Started (was: Assigned)
Here is how I understand the current status:

Fixed in 2.9.4 which Chromium has rolled:
gnome:761029, gnome:764427

Apparently fixed, but not verified:
mmoroz, could you help verify these and comment upstream?
gnome:758549, gnome:756525

Has upstream patches we could try to monkey patch and roll:
security ppl/mmoroz: these bugs are private upstream; what's the procedure here? Is it OK to commit these proposed patches to Chromium?
gnome:764615, gnome:765468

No fix upstream--needs fixes:
gnome:766956/ Issue 620679 , gnome:767734/ Issue 616698 

Needs to be *filed*/deduped upstream:
 Issue 603486 ,  Issue 619006 

The rest:
gnome:763686 is a big public disclosure of ASAN test cases that hasn't been sorted through

gnome:759495, gnome:759579. A couple of infinite recursion bugs. Limited impact?
gnome:758549 - Cannot reproduce with Chromium version (2.9.4).
gnome:756525 - Cannot reproduce with Chromium version (2.9.4).


Regarding gnome:764615 and gnome:765468, it looks like we don't use HTML parser from libxml (htmlReadDoc(), htmlReadFile(), htmlReadMemory()). This is also why we don't have a fuzzer for that parser.

Given that, I'm not sure if it makes sense to use separate patches or may be we just wait for the next release. Also we had an email thread about embargo dates, so probably would be better to wait.

gnome:763686 - Sadly, that this is public, but those testcases should not affect Chromium since we don't use HTML parser.


gnome:759495, gnome:759579 - since it is only DoS, I guess they are lowest priority of known issues.

Status: Fixed (was: Started)
I think the only remaining bugs of interest are

gnome:759495
gnome:759579

Given the lower priority (DoS) and that neither of them repro in Chrome 55.0.2883.87 (Official Build) (64-bit) I think I will mark this bug fixed. Please push back if I got that wrong.
Project Member

Comment 13 by sheriffbot@chromium.org, Jan 13 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 14 by sheriffbot@chromium.org, Apr 21 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment