fix(tinyxml2): CVE-2024-50614, CVE-2024-50615

Fix potential overflow in char refs.

- CVE-2024-50614: reachable assertion for UINT_MAX/16 in GetCharacterRef
- CVE-2024-50615: reachable assertion for UINT_MAX/digit in GetCharacterRef

Upstream: leethomason/tinyxml2@494735de30c9
Generated-By: glm-5.1
Co-Authored-By: hudeng <hudeng@deepin.org>

Author: 2 people

debian/changelog

@@ -1,3 +1,11 @@
+tinyxml2 (9.0.0+dfsg-3deepin1) unstable; urgency=medium
+
+  * Fix potential overflow in char refs (CVE-2024-50614, CVE-2024-50615)
+    - Patch from upstream commit 494735de30c9
+    - Fixes reachable assertion in XMLUtil::GetCharacterRef
+
+ -- deepin-ci-robot <packages@deepin.org>  Tue, 26 May 2026 23:30:00 +0800
+
 tinyxml2 (9.0.0+dfsg-3) unstable; urgency=medium
 
   * [a6e98f0] Drop Provides/Conflicts libtinyxml2-8 (Closes: #992602)

debian/patches/Fix-potential-overflow-in-char-refs-CVE-2024-50614-50615.patch

@@ -0,0 +1,75 @@
+Index: tinyxml2/tinyxml2.cpp
+===================================================================
+--- tinyxml2.orig/tinyxml2.cpp
++++ tinyxml2/tinyxml2.cpp
+@@ -472,11 +472,11 @@ const char* XMLUtil::GetCharacterRef( co
+     // Presume an entity, and pull it out.
+     *length = 0;
+ 
++    static const uint32_t MAX_CODE_POINT = 0x10FFFF;
++
+     if ( *(p+1) == '#' && *(p+2) ) {
+-        unsigned long ucs = 0;
+-        TIXMLASSERT( sizeof( ucs ) >= 4 );
+-        ptrdiff_t delta = 0;
+-        unsigned mult = 1;
++        uint32_t ucs = 0;
++        uint32_t mult = 1;
+         static const char SEMICOLON = ';';
+ 
+         if ( *(p+2) == 'x' ) {
+@@ -497,7 +497,7 @@ const char* XMLUtil::GetCharacterRef( co
+             --q;
+ 
+             while ( *q != 'x' ) {
+-                unsigned int digit = 0;
++                uint32_t digit = 0;
+ 
+                 if ( *q >= '0' && *q <= '9' ) {
+                     digit = *q - '0';
+@@ -512,11 +512,12 @@ const char* XMLUtil::GetCharacterRef( co
+                     return 0;
+                 }
+                 TIXMLASSERT( digit < 16 );
+-                TIXMLASSERT( digit == 0 || mult <= UINT_MAX / digit );
+-                const unsigned int digitScaled = mult * digit;
+-                TIXMLASSERT( ucs <= ULONG_MAX - digitScaled );
++                const uint32_t digitScaled = mult * digit;
+                 ucs += digitScaled;
+-                TIXMLASSERT( mult <= UINT_MAX / 16 );
++                if (ucs > MAX_CODE_POINT) {
++                    return 0;
++                }
++
+                 mult *= 16;
+                 --q;
+             }
+@@ -540,22 +541,23 @@ const char* XMLUtil::GetCharacterRef( co
+ 
+             while ( *q != '#' ) {
+                 if ( *q >= '0' && *q <= '9' ) {
+-                    const unsigned int digit = *q - '0';
++                    const uint32_t digit = *q - '0';
+                     TIXMLASSERT( digit < 10 );
+-                    TIXMLASSERT( digit == 0 || mult <= UINT_MAX / digit );
+-                    const unsigned int digitScaled = mult * digit;
+-                    TIXMLASSERT( ucs <= ULONG_MAX - digitScaled );
++                    const uint32_t digitScaled = mult * digit;
+                     ucs += digitScaled;
++                    if (ucs > MAX_CODE_POINT) {
++                        return 0;
++                    }
+                 }
+                 else {
+                     return 0;
+                 }
+-                TIXMLASSERT( mult <= UINT_MAX / 10 );
+                 mult *= 10;
+                 --q;
+             }
+         }
+         // convert the UCS to UTF-8
++        TIXMLASSERT(ucs <= MAX_CODE_POINT);
+         ConvertUTF32ToUTF8( ucs, value, length );
+         return p + delta + 1;
+     }

debian/patches/series

@@ -1 +1,2 @@
 Set-visibility-to-hidden-for-private-functions.patch
+Fix-potential-overflow-in-char-refs-CVE-2024-50614-50615.patch