From d8566dd918c612078dfb3ee1a95d7bb6f0656bfe Mon Sep 17 00:00:00 2001 From: Daniel Garcia Moreno Date: Fri, 22 May 2026 12:21:20 +0200 Subject: [PATCH] xmlcatalog: overflow check for large --shell commands Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124 CVE: CVE-2026-11979 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e] Backport Changes: - The commit modifies test/catalogs/test.sh. - test/catalogs/test.sh does not exist in the libxml2 v2.12.10 source used in Scarthgap and was introduced later version libxml2 v2.14.0 [1]. - The test changes were omitted; only the required fix in xmlcatalog.c was backported. [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/f06fc933cdaea2ce8e9cea275fdbf4edb85f9837 (cherry picked from commit c2e233fc1b341685fc99621b2768b503f777a72e) Signed-off-by: Devansh Patel --- xmlcatalog.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/xmlcatalog.c b/xmlcatalog.c index 588802b41..51569b879 100644 --- a/xmlcatalog.c +++ b/xmlcatalog.c @@ -114,6 +114,12 @@ static void usershell(void) { (*cur != '\n') && (*cur != '\r')) { if (*cur == 0) break; + /* Do not read beyond the command array capacity */ + if (i >= (int)sizeof(command) - 2) { + printf("Invalid command %s\n", cur); + i = 0; + break; + } command[i++] = *cur++; } command[i] = 0; @@ -131,6 +137,11 @@ static void usershell(void) { while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) { if (*cur == 0) break; + if (i >= (int)sizeof(arg) - 2) { + printf("Invalid arg %s\n", arg); + i = 0; + break; + } arg[i++] = *cur++; } arg[i] = 0; @@ -143,6 +154,11 @@ static void usershell(void) { cur = arg; memset(argv, 0, sizeof(argv)); while (*cur != 0) { + if (i >= (int)sizeof(argv) / (int)sizeof(char*)) { + printf("Too much arguments\n"); + break; + } + while ((*cur == ' ') || (*cur == '\t')) cur++; if (*cur == '\'') { cur++; -- 2.35.6