[ expat-Bugs-3500861 ] fix for CVE-2012-0876 breaks "xml" default prefix

Bugs item #3500861, was opened at 2012-03-09 18:37
Message generated for change (Comment added) made by kwaclaw
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110127&aid=3500861&group_id=10127

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: Test Required
Status: Open
Resolution: Fixed
Priority: 5
Private: No
Submitted By: Marien Zwart (marienz)
Assigned to: Karl Waclawek (kwaclaw)
Summary: fix for CVE-2012-0876 breaks "xml" default prefix

Initial Comment:
expat-2.1.0-beta2 will fail a namespace-aware parse of a document relying on the "xml" being bound by default, like the following test document:

<?xml version="1.0"?>
<root xml:whitespace="preserve"/>

xmlwf -n on that document returns "2:0: unbound prefix", while xmlwf from expat 2.0.1 succeeds.

This seems to be caused by the call to setContext(parser, implicitContext) adding that default prefix happening too early (before hash_secret_salt is initialized).

----------------------------------------------------------------------

>Comment By: Karl Waclawek (kwaclaw)
Date: 2012-03-10 21:15

Message:
It did but make check failed. I realized that setContextimplicitContext)
must not be called for child parsers.
This is now fixed in xmlparse.c rev 1 170.

----------------------------------------------------------------------

Comment By: Marien Zwart (marienz)
Date: 2012-03-10 10:07

Message:
Yes, that fixed it, thanks!

----------------------------------------------------------------------

Comment By: Samuli Suominen (ssuominen)
Date: 2012-03-10 09:54

Message:
I can verify that pulling in the diff of xmlparse.c 1.168 and 1.169 and
applying it on top of expat-2.1.0-beta2 works for me. Thanks a lot for
quick action!

----------------------------------------------------------------------

Comment By: Karl Waclawek (kwaclaw)
Date: 2012-03-10 09:41

Message:
Fixed in xmlparse.c  rev 1.169. Please test.

----------------------------------------------------------------------

Comment By: Karl Waclawek (kwaclaw)
Date: 2012-03-10 09:31

Message:
Yes, your analysis is correct, the hash function was used before the salt
was set.
I will have to move the setContext() call right after the
generate_hash_secret_salt() call.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110127&aid=3500861&group_id=10127