CVE-2017-16932: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2017-11-23T21:29Z
Repository: https://github.com/GNOME/libxml2
Language: Other
Files changed: parser.c, result/errors/759579.xml.err, result/errors/759579.xml.str, test/errors/759579.xml
Commit date: 2017-07-25 15:21:12 +0200
Commit message: Detect infinite recursion in parameter entities

When expanding a parameter entity in a DTD, infinite recursion could
lead to an infinite loop or memory exhaustion.

Thanks to Wei Lei for the first of many reports.

Fixes bug 759579.

Diff: diff --git a/parser.c b/parser.c
index 6286cad61..51452a257 100644
--- a/parser.c
+++ b/parser.c
@@ -2248,10 +2248,17 @@ xmlPushInput(xmlParserCtxtPtr ctxt, xmlParserInputPtr input) {
 		    "%s(%d): ", ctxt->input->filename,
 		    ctxt->input->line);
 	xmlGenericError(xmlGenericErrorContext,
 		"Pushing input %d : %.30s\n", ctxt->inputNr+1, input->cur);
     }
+    if (((ctxt->inputNr > 40) && ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
+        (ctxt->inputNr > 1024)) {
+        xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+        while (ctxt->inputNr > 1)
+            xmlFreeInputStream(inputPop(ctxt));
+	return(-1);
+    }
     ret = inputPush(ctxt, input);
     if (ctxt->instate == XML_PARSER_EOF)
         return(-1);
     GROW;
     return(ret);
@@ -7914,12 +7921,14 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
 		(ctxt->replaceEntities == 0) &&
 		(ctxt->validate == 0))
 		return;
 
 	    input = xmlNewEntityInputStream(ctxt, entity);
-	    if (xmlPushInput(ctxt, input) < 0)
+	    if (xmlPushInput(ctxt, input) < 0) {
+                xmlFreeInputStream(input);
 		return;
+            }
 
 	    if (entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) {
                 /*
                  * Get the 4 first bytes and decode the charset
                  * if enc != XML_CHAR_ENCODING_NONE
diff --git a/result/errors/759579.xml b/result/errors/759579.xml
new file mode 100644
index 000000000..e69de29bb
diff --git a/result/errors/759579.xml.err b/result/errors/759579.xml.err
new file mode 100644
index 000000000..288026e69
--- /dev/null
+++ b/result/errors/759579.xml.err
@@ -0,0 +1,6 @@
+Entity: line 2: parser error : Detected an entity reference loop
+        %z; %z; %z; %z; %z;
+           ^
+Entity: line 2: 
+        %z; %z; %z; %z; %z;
+           ^
diff --git a/result/errors/759579.xml.str b/result/errors/759579.xml.str
new file mode 100644
index 000000000..09408f520
--- /dev/null
+++ b/result/errors/759579.xml.str
@@ -0,0 +1,7 @@
+Entity: line 2: parser error : Detected an entity reference loop
+        %z; %z; %z; %z; %z;
+           ^
+Entity: line 2: 
+        %z; %z; %z; %z; %z;
+           ^
+./test/errors/759579.xml : failed to parse
diff --git a/test/errors/759579.xml b/test/errors/759579.xml
new file mode 100644
index 000000000..7fadd7024
--- /dev/null
+++ b/test/errors/759579.xml
@@ -0,0 +1,11 @@
+<!DOCTYPE doc [
+    <!ENTITY % z '
+        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
+        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
+        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
+        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
+        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
+    '>
+    %z;
+]>
+<doc/>

Vulnerable code: 	    if (xmlPushInput(ctxt, input) < 0)
Fixed code:     if (((ctxt->inputNr > 40) && ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
        (ctxt->inputNr > 1024)) {
        xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
        while (ctxt->inputNr > 1)
            xmlFreeInputStream(inputPop(ctxt));
	return(-1);
    }
	    if (xmlPushInput(ctxt, input) < 0) {
                xmlFreeInputStream(input);
            }
Entity: line 2: parser error : Detected an entity reference loop
        %z; %z; %z; %z; %z;
           ^
Entity: line 2: 
        %z; %z; %z; %z; %z;
           ^
Entity: line 2: parser error : Detected an entity reference loop
        %z; %z; %z; %z; %z;
           ^
Entity: line 2: 
        %z; %z; %z; %z; %z;
           ^
./test/errors/759579.xml : failed to parse
<!DOCTYPE doc [
    <!ENTITY % z '
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
        &#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
    '>
    %z;
]>
<doc/>