1217609 - Multiple invalid left shifts in libexpat

Status: RESOLVED DUPLICATE of bug 1754724

(Core :: XML, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: ubsan_results.txt

While fuzzing libexpat (2.1.0) I came a across a number of invalid left shifts.

I will attach the fixes I made to get past these errors. Please feel free to use these.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: xmlparse.diff

Fixes for https://dxr.mozilla.org/mozilla-central/source/parser/expat/lib/xmlparse.c

Comment 2

[Tyson Smith [:tsmith]]

Attachment: xmltok.diff

Fixes for https://dxr.mozilla.org/mozilla-central/source/parser/expat/lib/xmltok.c

Comment 3

[Peter Van der Beken [:peterv]]

Can you file a bug in the Expat tracker (https://github.com/libexpat/libexpat) for the patch in xmlparse.c? The problems addressed in the patch for xmltok.c have been fixed in https://sourceforge.net/p/expat/bugs/529/.

Comment 4

[Tyson Smith [:tsmith]]

Fixes are available. Upstream issue: https://github.com/libexpat/libexpat/issues/531

Commit 2106ee4 addresses the issues in xmlparse.c

Comment 5

[sebastian]

Tyson, FYI I have just requested a CVE for the 2 unfixed cases from Mitre.

Comment 6

[Tyson Smith [:tsmith]]

Note: Bug 1688452 sandboxes Expat via RLBox

Comment 7

[Andrew McCreight [:mccr8]]

Doesn't sound easy to exploit, so I'll mark it sec-low. Only 91 is really affected from a sec perspective due to RLBox, but we should fix it on Nightly at least.

Comment 8

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Does it make more sense to move status-firefox97 to disabled due to RLBox, too?

Comment 9

[Andrew McCreight [:mccr8]]

I think I meant to mark it wontfix, not disabled.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Glad we have rlbox \o/

FWIW, it has been uploaded in Debian old old stable:
https://tracker.debian.org/news/1299039/accepted-expat-220-2deb9u4-source-into-oldoldstable/

Comment 11

[Peter Van der Beken [:peterv]]

The xmltok.c issue was fixed a while ago in bug 1374012.
The xmlparse.c issue is CVE-2021-45960 and was fixed in bug 1754724.