-
Notifications
You must be signed in to change notification settings - Fork 564
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Co-authored-by: kavyasree <[email protected]> Co-authored-by: jslobodzian <[email protected]>
- Loading branch information
3 people
authored
Jan 26, 2025
1 parent
b7dce41
commit dee5b0b
Showing
7 changed files
with
118 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001 | ||
| From: Nick Wellnhofer <[email protected]> | ||
| Date: Wed, 23 Aug 2023 20:24:24 +0200 | ||
| Subject: [PATCH] tree: Fix copying of DTDs | ||
|
|
||
| - Don't create multiple DTD nodes. | ||
| - Fix UAF if malloc fails. | ||
| - Skip DTD nodes if tree module is disabled. | ||
|
|
||
| Fixes #583. | ||
| --- | ||
| tree.c | 31 ++++++++++++++++--------------- | ||
| 1 file changed, 16 insertions(+), 15 deletions(-) | ||
|
|
||
| diff --git a/tree.c b/tree.c | ||
| index 6c8a875b9..02c1b5791 100644 | ||
| --- a/tree.c | ||
| +++ b/tree.c | ||
| @@ -4471,29 +4471,28 @@ xmlNodePtr | ||
| xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { | ||
| xmlNodePtr ret = NULL; | ||
| xmlNodePtr p = NULL,q; | ||
| + xmlDtdPtr newSubset = NULL; | ||
|
|
||
| while (node != NULL) { | ||
| -#ifdef LIBXML_TREE_ENABLED | ||
| if (node->type == XML_DTD_NODE ) { | ||
| - if (doc == NULL) { | ||
| +#ifdef LIBXML_TREE_ENABLED | ||
| + if ((doc == NULL) || (doc->intSubset != NULL)) { | ||
| node = node->next; | ||
| continue; | ||
| } | ||
| - if (doc->intSubset == NULL) { | ||
| - q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); | ||
| - if (q == NULL) goto error; | ||
| - q->doc = doc; | ||
| - q->parent = parent; | ||
| - doc->intSubset = (xmlDtdPtr) q; | ||
| - xmlAddChild(parent, q); | ||
| - } else { | ||
| - q = (xmlNodePtr) doc->intSubset; | ||
| - xmlAddChild(parent, q); | ||
| - } | ||
| - } else | ||
| + q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); | ||
| + if (q == NULL) goto error; | ||
| + q->doc = doc; | ||
| + q->parent = parent; | ||
| + newSubset = (xmlDtdPtr) q; | ||
| +#else | ||
| + node = node->next; | ||
| + continue; | ||
| #endif /* LIBXML_TREE_ENABLED */ | ||
| + } else { | ||
| q = xmlStaticCopyNode(node, doc, parent, 1); | ||
| - if (q == NULL) goto error; | ||
| + if (q == NULL) goto error; | ||
| + } | ||
| if (ret == NULL) { | ||
| q->prev = NULL; | ||
| ret = p = q; | ||
| @@ -4505,6 +4504,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { | ||
| } | ||
| node = node->next; | ||
| } | ||
| + if (newSubset != NULL) | ||
| + doc->intSubset = newSubset; | ||
| return(ret); | ||
| error: | ||
| xmlFreeNodeList(ret); | ||
| -- | ||
| GitLab | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| From 8ddc7f13337c9fe7c6b6e616f404b0fffb8a5145 Mon Sep 17 00:00:00 2001 | ||
| From: Nick Wellnhofer <[email protected]> | ||
| Date: Wed, 8 May 2024 11:49:31 +0200 | ||
| Subject: [PATCH] [CVE-2024-34459] Fix buffer overread with `xmllint --htmlout` | ||
|
|
||
| Add a missing bounds check. | ||
| --- | ||
| xmllint.c | 2 +- | ||
| 1 file changed, 1 insertion(+), 1 deletion(-) | ||
|
|
||
| diff --git a/xmllint.c b/xmllint.c | ||
| index 0e433b721..62f6b0273 100644 | ||
| --- a/xmllint.c | ||
| +++ b/xmllint.c | ||
| @@ -559,7 +559,7 @@ xmlHTMLPrintFileContext(xmlParserInputPtr input) { | ||
| len = strlen(buffer); | ||
| snprintf(&buffer[len], sizeof(buffer) - len, "\n"); | ||
| cur = input->cur; | ||
| - while ((*cur == '\n') || (*cur == '\r')) | ||
| + while ((cur > base) && ((*cur == '\n') || (*cur == '\r'))) | ||
| cur--; | ||
| n = 0; | ||
| while ((cur != base) && (n++ < 80)) { | ||
| -- | ||
| GitLab | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,14 +1,16 @@ | ||
| Summary: Libxml2 | ||
| Name: libxml2 | ||
| Version: 2.11.5 | ||
| Release: 2%{?dist} | ||
| Release: 3%{?dist} | ||
| License: MIT | ||
| Vendor: Microsoft Corporation | ||
| Distribution: Azure Linux | ||
| Group: System Environment/General Libraries | ||
| URL: https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home | ||
| Source0: https://gitlab.gnome.org/GNOME/%{name}/-/archive/v%{version}/%{name}-v%{version}.tar.gz | ||
| Patch0: CVE-2024-40896.patch | ||
| Patch1: CVE-2023-45322.patch | ||
| Patch2: CVE-2024-34459.patch | ||
| BuildRequires: python3-devel | ||
| BuildRequires: python3-xml | ||
| Provides: %{name}-tools = %{version}-%{release} | ||
|
|
@@ -79,6 +81,9 @@ find %{buildroot} -type f -name "*.la" -delete -print | |
| %{_libdir}/cmake/libxml2/libxml2-config.cmake | ||
|
|
||
| %changelog | ||
| * Fri Jan 24 2025 Kavya Sree Kaitepalli <[email protected]> -2.11.5-3 | ||
| - Fix CVE-2023-45322 & CVE-2024-34459 | ||
|
|
||
| * Thu Dec 26 2024 Muhammad Falak <[email protected]> - 2.11.5-2 | ||
| - Patch CVE-2024-40896 | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters