[forwarded from http://bugs.debian.org/229281] seen with 2.3.3, works with 2.2.3 and 2.1.3 (after fixing the 2.1 incompatibilities). The pyexpat code used is the one direct from the distribution, no external library. The attached testcase demonstrates a bug in, apparently, /usr/lib/python2.3/lib-dynload/pyexpat.so. Here's the bug in gdb: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 28350)] 0x40566800 in XmlInitUnknownEncodingNS () from /usr/lib/python2.3/lib-dynload/pyexpat.so To try it youself, run "make" in the testcase directory. I apoligise for the size of this testcase; I would have whitteled it down to something simpler, but I am not a python programmer. I also apoligise if the bug is really in some library that python uses; I only went back as far as pyexpat.so. Some developers on IRC feel this may be exploitable. Talk with Scott James Remnant <scott@netsplit.com>, who also has some idea of the encoding problems in the rss file that are causing the crash.
Logged In: YES user_id=21627 The parser crashes because it invokes GetBuffer inside Parser, when Python is providing the next chunk of input, which reallocs the buffer to a different location. However, eventPtr is not updated inside GetBuffer (and neither is positionPtr). As a result, the next access to eventPtr (in XML_GetCurrentLineNumber, invoked from set_error), will cause a segfault. It is not clear to me why these pointers are not adjusted when the buffer is reallocated. However, a consistent fix appears to be to update the eventPtr close to the place where positionPtr is initialized, which is done in the attached patch exp.diff, which fixes this test case. Fred, can you please review this patch?
