Attachment 312112 Details for Bug 455848 – Upstream patch

[patch] Upstream patch

exslt_crypt.patch (text/plain), 4.79 KB, created by Tomas Hoger on 2008-07-18 09:57:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-07-18 09:57:48 UTC

Size: 4.79 KB

patch

obsolete

>Index: libexslt/crypto.c
>===================================================================
>--- libexslt/crypto.c	(revision 1479)
>+++ libexslt/crypto.c	(working copy)
>@@ -595,11 +595,13 @@ exsltCryptoRc4EncryptFunction (xmlXPathP
>     int str_len = 0, bin_len = 0, hex_len = 0;
>     xmlChar *key = NULL, *str = NULL, *padkey = NULL;
>     xmlChar *bin = NULL, *hex = NULL;
>+    xsltTransformContextPtr tctxt = NULL;
> 
>-    if ((nargs < 1) || (nargs > 3)) {
>+    if (nargs != 2) {
> 	xmlXPathSetArityError (ctxt);
> 	return;
>     }
>+    tctxt = xsltXPathGetTransformContext(ctxt);
> 
>     str = xmlXPathPopString (ctxt);
>     str_len = xmlUTF8Strlen (str);
>@@ -611,7 +613,7 @@ exsltCryptoRc4EncryptFunction (xmlXPathP
>     }
> 
>     key = xmlXPathPopString (ctxt);
>-    key_len = xmlUTF8Strlen (str);
>+    key_len = xmlUTF8Strlen (key);
> 
>     if (key_len == 0) {
> 	xmlXPathReturnEmptyString (ctxt);
>@@ -620,15 +622,33 @@ exsltCryptoRc4EncryptFunction (xmlXPathP
> 	return;
>     }
> 
>-    padkey = xmlMallocAtomic (RC4_KEY_LENGTH);
>+    padkey = xmlMallocAtomic (RC4_KEY_LENGTH + 1);
>+    if (padkey == NULL) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: Failed to allocate padkey\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
>+	xmlXPathReturnEmptyString (ctxt);
>+	goto done;
>+    }
>+    memset(padkey, 0, RC4_KEY_LENGTH + 1);
>+
>     key_size = xmlUTF8Strsize (key, key_len);
>+    if ((key_size > RC4_KEY_LENGTH) || (key_size < 0)) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: key size too long or key broken\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
>+	xmlXPathReturnEmptyString (ctxt);
>+	goto done;
>+    }
>     memcpy (padkey, key, key_size);
>-    memset (padkey + key_size, '\0', sizeof (padkey));
> 
> /* encrypt it */
>     bin_len = str_len;
>     bin = xmlStrdup (str);
>     if (bin == NULL) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: Failed to allocate string\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
> 	xmlXPathReturnEmptyString (ctxt);
> 	goto done;
>     }
>@@ -638,6 +658,9 @@ exsltCryptoRc4EncryptFunction (xmlXPathP
>     hex_len = str_len * 2 + 1;
>     hex = xmlMallocAtomic (hex_len);
>     if (hex == NULL) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: Failed to allocate result\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
> 	xmlXPathReturnEmptyString (ctxt);
> 	goto done;
>     }
>@@ -670,11 +693,13 @@ exsltCryptoRc4DecryptFunction (xmlXPathP
>     int str_len = 0, bin_len = 0, ret_len = 0;
>     xmlChar *key = NULL, *str = NULL, *padkey = NULL, *bin =
> 	NULL, *ret = NULL;
>+    xsltTransformContextPtr tctxt = NULL;
> 
>-    if ((nargs < 1) || (nargs > 3)) {
>+    if (nargs != 2) {
> 	xmlXPathSetArityError (ctxt);
> 	return;
>     }
>+    tctxt = xsltXPathGetTransformContext(ctxt);
> 
>     str = xmlXPathPopString (ctxt);
>     str_len = xmlUTF8Strlen (str);
>@@ -686,7 +711,7 @@ exsltCryptoRc4DecryptFunction (xmlXPathP
>     }
> 
>     key = xmlXPathPopString (ctxt);
>-    key_len = xmlUTF8Strlen (str);
>+    key_len = xmlUTF8Strlen (key);
> 
>     if (key_len == 0) {
> 	xmlXPathReturnEmptyString (ctxt);
>@@ -695,22 +720,51 @@ exsltCryptoRc4DecryptFunction (xmlXPathP
> 	return;
>     }
> 
>-    padkey = xmlMallocAtomic (RC4_KEY_LENGTH);
>+    padkey = xmlMallocAtomic (RC4_KEY_LENGTH + 1);
>+    if (padkey == NULL) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: Failed to allocate padkey\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
>+	xmlXPathReturnEmptyString (ctxt);
>+	goto done;
>+    }
>+    memset(padkey, 0, RC4_KEY_LENGTH + 1);
>     key_size = xmlUTF8Strsize (key, key_len);
>+    if ((key_size > RC4_KEY_LENGTH) || (key_size < 0)) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: key size too long or key broken\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
>+	xmlXPathReturnEmptyString (ctxt);
>+	goto done;
>+    }
>     memcpy (padkey, key, key_size);
>-    memset (padkey + key_size, '\0', sizeof (padkey));
> 
> /* decode hex to binary */
>     bin_len = str_len;
>     bin = xmlMallocAtomic (bin_len);
>+    if (bin == NULL) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: Failed to allocate string\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
>+	xmlXPathReturnEmptyString (ctxt);
>+	goto done;
>+    }
>     ret_len = exsltCryptoHex2Bin (str, str_len, bin, bin_len);
> 
> /* decrypt the binary blob */
>     ret = xmlMallocAtomic (ret_len);
>+    if (ret == NULL) {
>+	xsltTransformError(tctxt, NULL, tctxt->inst,
>+	    "exsltCryptoRc4EncryptFunction: Failed to allocate result\n");
>+	tctxt->state = XSLT_STATE_STOPPED;
>+	xmlXPathReturnEmptyString (ctxt);
>+	goto done;
>+    }
>     PLATFORM_RC4_DECRYPT (ctxt, padkey, bin, ret_len, ret, ret_len);
> 
>     xmlXPathReturnString (ctxt, ret);
> 
>+done:
>     if (key != NULL)
> 	xmlFree (key);
>     if (str != NULL)

Actions: View | Diff

Attachments on bug 455848: 312112