mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
* [ptxdist] [PATCH 0/4] libxml2: Upgrade and add some fixes
@ 2020-03-18 13:27 Alexander Dahl
  2020-03-18 13:27 ` [ptxdist] [PATCH 1/4] libxml2: Fix license and add license file hashes Alexander Dahl
                   ` (3 more replies)
  0 siblings, 4 replies; 9+ messages in thread
From: Alexander Dahl @ 2020-03-18 13:27 UTC (permalink / raw)
  To: ptxdist

Hei hei,

this series starts with a follow up to my license update series from
last year. As you might have already noticed in the dropbear series
from last week, I took the remaining license related patches and put
them to new package related series, where I touch it anyway.

The second patch is the ordinary version bump, the other two patches
add fixes for two post release CVEs one by one.

Greets
Alex

Alexander Dahl (4):
  libxml2: Fix license and add license file hashes
  libxml2: version bump 2.9.9 -> 2.9.10
  libxml2: Add upstream patch fixing CVE-2020-7595
  libxml2: Add upstream patch fixing CVE-2019-20388

 ...e-loop-in-xmlStringLenDecodeEntities.patch | 28 ++++++++++++++++++
 ...mory-leak-in-xmlSchemaValidateStream.patch | 29 +++++++++++++++++++
 ...200-xml2-config-is-not-SYSROOT-aware.patch |  2 +-
 patches/libxml2-2.9.10/series                 |  8 +++++
 patches/libxml2-2.9.9/series                  |  5 ----
 rules/libxml2.make                            | 10 +++++--
 6 files changed, 73 insertions(+), 9 deletions(-)
 create mode 100644 patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
 create mode 100644 patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
 rename patches/{libxml2-2.9.9 => libxml2-2.9.10}/0200-xml2-config-is-not-SYSROOT-aware.patch (93%)
 create mode 100644 patches/libxml2-2.9.10/series
 delete mode 100644 patches/libxml2-2.9.9/series

-- 
2.20.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* [ptxdist] [PATCH 1/4] libxml2: Fix license and add license file hashes
  2020-03-18 13:27 [ptxdist] [PATCH 0/4] libxml2: Upgrade and add some fixes Alexander Dahl
@ 2020-03-18 13:27 ` Alexander Dahl
  2020-03-27  9:52   ` [ptxdist] [1/4] " Michael Olbrich
  2020-03-18 13:27 ` [ptxdist] [PATCH 2/4] libxml2: version bump 2.9.9 -> 2.9.10 Alexander Dahl
                   ` (2 subsequent siblings)
  3 siblings, 1 reply; 9+ messages in thread
From: Alexander Dahl @ 2020-03-18 13:27 UTC (permalink / raw)
  To: ptxdist

The 'Copyright' file says:

> Except where otherwise noted in the source code (e.g. the files hash.c,
> list.c and the trio files, which are covered by a similar licence but
> with different Copyright notices) all the files are:

According to comparison with the license text at SPDX and what Debian
found out, those files are put under ISC license.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---

Notes:
    + Changes since 2019-05-29 (Message-Id <20190510092434.15019-22-ada@thorsis.com>):
      - Added hash.c to license files to get the ISC license text (Michael Olbrich)

 rules/libxml2.make | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/rules/libxml2.make b/rules/libxml2.make
index 85089547c..dea3616f5 100644
--- a/rules/libxml2.make
+++ b/rules/libxml2.make
@@ -22,7 +22,11 @@ LIBXML2		:= libxml2-$(LIBXML2_VERSION)
 LIBXML2_SUFFIX	:= tar.gz
 LIBXML2_SOURCE	:= $(SRCDIR)/$(LIBXML2).$(LIBXML2_SUFFIX)
 LIBXML2_DIR	:= $(BUILDDIR)/$(LIBXML2)
-LIBXML2_LICENSE	:= MIT
+LIBXML2_LICENSE	:= MIT AND ISC
+# The file 'COPYING' is just a symlink on the file 'Copyright'
+LIBXML2_LICENSE_FILES := \
+	file://Copyright;md5=2044417e2e5006b65a8b9067b683fcf1 \
+	file://hash.c;startline=6;endline=15;md5=96f7296605eae807670fb08947829969
 
 LIBXML2_URL := \
 	ftp://xmlsoft.org/libxml2/$(LIBXML2).$(LIBXML2_SUFFIX) \
-- 
2.20.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* [ptxdist] [PATCH 2/4] libxml2: version bump 2.9.9 -> 2.9.10
  2020-03-18 13:27 [ptxdist] [PATCH 0/4] libxml2: Upgrade and add some fixes Alexander Dahl
  2020-03-18 13:27 ` [ptxdist] [PATCH 1/4] libxml2: Fix license and add license file hashes Alexander Dahl
@ 2020-03-18 13:27 ` Alexander Dahl
  2020-03-27  9:52   ` [ptxdist] [2/4] " Michael Olbrich
  2020-03-18 13:27 ` [ptxdist] [PATCH 3/4] libxml2: Add upstream patch fixing CVE-2020-7595 Alexander Dahl
  2020-03-18 13:27 ` [ptxdist] [PATCH 4/4] libxml2: Add upstream patch fixing CVE-2019-20388 Alexander Dahl
  3 siblings, 1 reply; 9+ messages in thread
From: Alexander Dahl @ 2020-03-18 13:27 UTC (permalink / raw)
  To: ptxdist

This fixes quite a few possible memory leaks, overflows, use-after-free,
null-pointer-dereferences, and other flaws. See announcement for
details: https://mail.gnome.org/archives/xml/2019-October/msg00014.html

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 .../0200-xml2-config-is-not-SYSROOT-aware.patch               | 2 +-
 patches/{libxml2-2.9.9 => libxml2-2.9.10}/series              | 0
 rules/libxml2.make                                            | 4 ++--
 3 files changed, 3 insertions(+), 3 deletions(-)
 rename patches/{libxml2-2.9.9 => libxml2-2.9.10}/0200-xml2-config-is-not-SYSROOT-aware.patch (93%)
 rename patches/{libxml2-2.9.9 => libxml2-2.9.10}/series (100%)

diff --git a/patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch b/patches/libxml2-2.9.10/0200-xml2-config-is-not-SYSROOT-aware.patch
similarity index 93%
rename from patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch
rename to patches/libxml2-2.9.10/0200-xml2-config-is-not-SYSROOT-aware.patch
index 81a76383b..7204497b3 100644
--- a/patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch
+++ b/patches/libxml2-2.9.10/0200-xml2-config-is-not-SYSROOT-aware.patch
@@ -10,7 +10,7 @@ Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/xml2-config.in b/xml2-config.in
-index 19574864cb6a..ee1949ce9542 100644
+index cb4aa613a68c..31f9e67a999b 100644
 --- a/xml2-config.in
 +++ b/xml2-config.in
 @@ -1,6 +1,6 @@
diff --git a/patches/libxml2-2.9.9/series b/patches/libxml2-2.9.10/series
similarity index 100%
rename from patches/libxml2-2.9.9/series
rename to patches/libxml2-2.9.10/series
diff --git a/rules/libxml2.make b/rules/libxml2.make
index dea3616f5..ed8112f30 100644
--- a/rules/libxml2.make
+++ b/rules/libxml2.make
@@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_LIBXML2) += libxml2
 #
 # Paths and names
 #
-LIBXML2_VERSION	:= 2.9.9
-LIBXML2_MD5	:= c04a5a0a042eaa157e8e8c9eabe76bd6
+LIBXML2_VERSION	:= 2.9.10
+LIBXML2_MD5	:= 10942a1dc23137a8aa07f0639cbfece5
 LIBXML2		:= libxml2-$(LIBXML2_VERSION)
 LIBXML2_SUFFIX	:= tar.gz
 LIBXML2_SOURCE	:= $(SRCDIR)/$(LIBXML2).$(LIBXML2_SUFFIX)
-- 
2.20.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* [ptxdist] [PATCH 3/4] libxml2: Add upstream patch fixing CVE-2020-7595
  2020-03-18 13:27 [ptxdist] [PATCH 0/4] libxml2: Upgrade and add some fixes Alexander Dahl
  2020-03-18 13:27 ` [ptxdist] [PATCH 1/4] libxml2: Fix license and add license file hashes Alexander Dahl
  2020-03-18 13:27 ` [ptxdist] [PATCH 2/4] libxml2: version bump 2.9.9 -> 2.9.10 Alexander Dahl
@ 2020-03-18 13:27 ` Alexander Dahl
  2020-03-27  9:52   ` [ptxdist] [3/4] " Michael Olbrich
  2020-03-18 13:27 ` [ptxdist] [PATCH 4/4] libxml2: Add upstream patch fixing CVE-2019-20388 Alexander Dahl
  3 siblings, 1 reply; 9+ messages in thread
From: Alexander Dahl @ 2020-03-18 13:27 UTC (permalink / raw)
  To: ptxdist

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 ...e-loop-in-xmlStringLenDecodeEntities.patch | 28 +++++++++++++++++++
 patches/libxml2-2.9.10/series                 |  4 ++-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch

diff --git a/patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch b/patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
new file mode 100644
index 000000000..59c864731
--- /dev/null
+++ b/patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
@@ -0,0 +1,28 @@
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Thu, 12 Dec 2019 17:30:55 +0800
+Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
+
+When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
+return NULL which cause a infinite loop in xmlStringLenDecodeEntities
+
+Found with libFuzzer.
+
+Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
+---
+ parser.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index d1c319631fc9..a34bb6cdd81b 100644
+--- a/parser.c
++++ b/parser.c
+@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
+     else
+         c = 0;
+     while ((c != 0) && (c != end) && /* non input consuming loop */
+-	   (c != end2) && (c != end3)) {
++           (c != end2) && (c != end3) &&
++           (ctxt->instate != XML_PARSER_EOF)) {
+ 
+ 	if (c == 0) break;
+         if ((c == '&') && (str[1] == '#')) {
diff --git a/patches/libxml2-2.9.10/series b/patches/libxml2-2.9.10/series
index 198075fbf..b8e92fb7a 100644
--- a/patches/libxml2-2.9.10/series
+++ b/patches/libxml2-2.9.10/series
@@ -1,5 +1,7 @@
 # generated by git-ptx-patches
 #tag:base --start-number 1
+#tag:upstream --start-number 1
+0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
 #tag:ptx --start-number 200
 0200-xml2-config-is-not-SYSROOT-aware.patch
-# 9a7de85eef8cb30919e83bc9b2e42cd9  - git-ptx-patches magic
+# 0a9081f5db07b8cbb593bc669a7603c7  - git-ptx-patches magic
-- 
2.20.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* [ptxdist] [PATCH 4/4] libxml2: Add upstream patch fixing CVE-2019-20388
  2020-03-18 13:27 [ptxdist] [PATCH 0/4] libxml2: Upgrade and add some fixes Alexander Dahl
                   ` (2 preceding siblings ...)
  2020-03-18 13:27 ` [ptxdist] [PATCH 3/4] libxml2: Add upstream patch fixing CVE-2020-7595 Alexander Dahl
@ 2020-03-18 13:27 ` Alexander Dahl
  2020-03-27  9:52   ` [ptxdist] [4/4] " Michael Olbrich
  3 siblings, 1 reply; 9+ messages in thread
From: Alexander Dahl @ 2020-03-18 13:27 UTC (permalink / raw)
  To: ptxdist

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 ...mory-leak-in-xmlSchemaValidateStream.patch | 29 +++++++++++++++++++
 patches/libxml2-2.9.10/series                 |  3 +-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch

diff --git a/patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch b/patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
new file mode 100644
index 000000000..1ca086217
--- /dev/null
+++ b/patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
@@ -0,0 +1,29 @@
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Tue, 20 Aug 2019 16:33:06 +0800
+Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream
+
+When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
+alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
+to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
+vctxt->xsiAssemble to 0 again which cause the alloced schema
+can not be freed anymore.
+
+Found with libFuzzer.
+
+Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
+---
+ xmlschemas.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/xmlschemas.c b/xmlschemas.c
+index d19de6df5f50..59495c2738ab 100644
+--- a/xmlschemas.c
++++ b/xmlschemas.c
+@@ -28095,7 +28095,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) {
+     vctxt->nberrors = 0;
+     vctxt->depth = -1;
+     vctxt->skipDepth = -1;
+-    vctxt->xsiAssemble = 0;
+     vctxt->hasKeyrefs = 0;
+ #ifdef ENABLE_IDC_NODE_TABLES_TEST
+     vctxt->createIDCNodeTables = 1;
diff --git a/patches/libxml2-2.9.10/series b/patches/libxml2-2.9.10/series
index b8e92fb7a..fed72960d 100644
--- a/patches/libxml2-2.9.10/series
+++ b/patches/libxml2-2.9.10/series
@@ -2,6 +2,7 @@
 #tag:base --start-number 1
 #tag:upstream --start-number 1
 0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
+0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
 #tag:ptx --start-number 200
 0200-xml2-config-is-not-SYSROOT-aware.patch
-# 0a9081f5db07b8cbb593bc669a7603c7  - git-ptx-patches magic
+# d6f49636e8813a3a9e46758f352fc667  - git-ptx-patches magic
-- 
2.20.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [ptxdist] [1/4] libxml2: Fix license and add license file hashes
  2020-03-18 13:27 ` [ptxdist] [PATCH 1/4] libxml2: Fix license and add license file hashes Alexander Dahl
@ 2020-03-27  9:52   ` Michael Olbrich
  0 siblings, 0 replies; 9+ messages in thread
From: Michael Olbrich @ 2020-03-27  9:52 UTC (permalink / raw)
  To: ptxdist; +Cc: Alexander Dahl

Thanks, applied.

Michael

[sent from post-receive hook]

On Fri, 27 Mar 2020 10:52:23 +0100, Alexander Dahl <ada@thorsis.com> wrote:
> The 'Copyright' file says:
> 
> > Except where otherwise noted in the source code (e.g. the files hash.c,
> > list.c and the trio files, which are covered by a similar licence but
> > with different Copyright notices) all the files are:
> 
> According to comparison with the license text at SPDX and what Debian
> found out, those files are put under ISC license.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
> 
> Notes:
>     + Changes since 2019-05-29 (Message-Id <20190510092434.15019-22-ada@thorsis.com>):
>       - Added hash.c to license files to get the ISC license text (Michael Olbrich)
> 
>  rules/libxml2.make | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/rules/libxml2.make b/rules/libxml2.make
> index 85089547c..dea3616f5 100644
> --- a/rules/libxml2.make
> +++ b/rules/libxml2.make
> @@ -22,7 +22,11 @@ LIBXML2		:= libxml2-$(LIBXML2_VERSION)
>  LIBXML2_SUFFIX	:= tar.gz
>  LIBXML2_SOURCE	:= $(SRCDIR)/$(LIBXML2).$(LIBXML2_SUFFIX)
>  LIBXML2_DIR	:= $(BUILDDIR)/$(LIBXML2)
> -LIBXML2_LICENSE	:= MIT
> +LIBXML2_LICENSE	:= MIT AND ISC
> +# The file 'COPYING' is just a symlink on the file 'Copyright'
> +LIBXML2_LICENSE_FILES := \
> +	file://Copyright;md5=2044417e2e5006b65a8b9067b683fcf1 \
> +	file://hash.c;startline=6;endline=15;md5=96f7296605eae807670fb08947829969
>  
>  LIBXML2_URL := \
>  	ftp://xmlsoft.org/libxml2/$(LIBXML2).$(LIBXML2_SUFFIX) \
> 

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [ptxdist] [2/4] libxml2: version bump 2.9.9 -> 2.9.10
  2020-03-18 13:27 ` [ptxdist] [PATCH 2/4] libxml2: version bump 2.9.9 -> 2.9.10 Alexander Dahl
@ 2020-03-27  9:52   ` Michael Olbrich
  0 siblings, 0 replies; 9+ messages in thread
From: Michael Olbrich @ 2020-03-27  9:52 UTC (permalink / raw)
  To: ptxdist; +Cc: Alexander Dahl

Thanks, applied.

Michael

[sent from post-receive hook]

On Fri, 27 Mar 2020 10:52:24 +0100, Alexander Dahl <ada@thorsis.com> wrote:
> This fixes quite a few possible memory leaks, overflows, use-after-free,
> null-pointer-dereferences, and other flaws. See announcement for
> details: https://mail.gnome.org/archives/xml/2019-October/msg00014.html
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  .../0200-xml2-config-is-not-SYSROOT-aware.patch               | 2 +-
>  patches/{libxml2-2.9.9 => libxml2-2.9.10}/series              | 0
>  rules/libxml2.make                                            | 4 ++--
>  3 files changed, 3 insertions(+), 3 deletions(-)
>  rename patches/{libxml2-2.9.9 => libxml2-2.9.10}/0200-xml2-config-is-not-SYSROOT-aware.patch (93%)
>  rename patches/{libxml2-2.9.9 => libxml2-2.9.10}/series (100%)
> 
> diff --git a/patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch b/patches/libxml2-2.9.10/0200-xml2-config-is-not-SYSROOT-aware.patch
> similarity index 93%
> rename from patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch
> rename to patches/libxml2-2.9.10/0200-xml2-config-is-not-SYSROOT-aware.patch
> index 81a76383b..7204497b3 100644
> --- a/patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch
> +++ b/patches/libxml2-2.9.10/0200-xml2-config-is-not-SYSROOT-aware.patch
> @@ -10,7 +10,7 @@ Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
>   1 file changed, 1 insertion(+), 1 deletion(-)
>  
>  diff --git a/xml2-config.in b/xml2-config.in
> -index 19574864cb6a..ee1949ce9542 100644
> +index cb4aa613a68c..31f9e67a999b 100644
>  --- a/xml2-config.in
>  +++ b/xml2-config.in
>  @@ -1,6 +1,6 @@
> diff --git a/patches/libxml2-2.9.9/series b/patches/libxml2-2.9.10/series
> similarity index 100%
> rename from patches/libxml2-2.9.9/series
> rename to patches/libxml2-2.9.10/series
> diff --git a/rules/libxml2.make b/rules/libxml2.make
> index dea3616f5..ed8112f30 100644
> --- a/rules/libxml2.make
> +++ b/rules/libxml2.make
> @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_LIBXML2) += libxml2
>  #
>  # Paths and names
>  #
> -LIBXML2_VERSION	:= 2.9.9
> -LIBXML2_MD5	:= c04a5a0a042eaa157e8e8c9eabe76bd6
> +LIBXML2_VERSION	:= 2.9.10
> +LIBXML2_MD5	:= 10942a1dc23137a8aa07f0639cbfece5
>  LIBXML2		:= libxml2-$(LIBXML2_VERSION)
>  LIBXML2_SUFFIX	:= tar.gz
>  LIBXML2_SOURCE	:= $(SRCDIR)/$(LIBXML2).$(LIBXML2_SUFFIX)
> 

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [ptxdist] [3/4] libxml2: Add upstream patch fixing CVE-2020-7595
  2020-03-18 13:27 ` [ptxdist] [PATCH 3/4] libxml2: Add upstream patch fixing CVE-2020-7595 Alexander Dahl
@ 2020-03-27  9:52   ` Michael Olbrich
  0 siblings, 0 replies; 9+ messages in thread
From: Michael Olbrich @ 2020-03-27  9:52 UTC (permalink / raw)
  To: ptxdist; +Cc: Alexander Dahl

Thanks, applied.

Michael

[sent from post-receive hook]

On Fri, 27 Mar 2020 10:52:25 +0100, Alexander Dahl <ada@thorsis.com> wrote:
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  ...e-loop-in-xmlStringLenDecodeEntities.patch | 28 +++++++++++++++++++
>  patches/libxml2-2.9.10/series                 |  4 ++-
>  2 files changed, 31 insertions(+), 1 deletion(-)
>  create mode 100644 patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
> 
> diff --git a/patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch b/patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
> new file mode 100644
> index 000000000..59c864731
> --- /dev/null
> +++ b/patches/libxml2-2.9.10/0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
> @@ -0,0 +1,28 @@
> +From: Zhipeng Xie <xiezhipeng1@huawei.com>
> +Date: Thu, 12 Dec 2019 17:30:55 +0800
> +Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
> +
> +When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
> +return NULL which cause a infinite loop in xmlStringLenDecodeEntities
> +
> +Found with libFuzzer.
> +
> +Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
> +---
> + parser.c | 3 ++-
> + 1 file changed, 2 insertions(+), 1 deletion(-)
> +
> +diff --git a/parser.c b/parser.c
> +index d1c319631fc9..a34bb6cdd81b 100644
> +--- a/parser.c
> ++++ b/parser.c
> +@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
> +     else
> +         c = 0;
> +     while ((c != 0) && (c != end) && /* non input consuming loop */
> +-	   (c != end2) && (c != end3)) {
> ++           (c != end2) && (c != end3) &&
> ++           (ctxt->instate != XML_PARSER_EOF)) {
> + 
> + 	if (c == 0) break;
> +         if ((c == '&') && (str[1] == '#')) {
> diff --git a/patches/libxml2-2.9.10/series b/patches/libxml2-2.9.10/series
> index 198075fbf..b8e92fb7a 100644
> --- a/patches/libxml2-2.9.10/series
> +++ b/patches/libxml2-2.9.10/series
> @@ -1,5 +1,7 @@
>  # generated by git-ptx-patches
>  #tag:base --start-number 1
> +#tag:upstream --start-number 1
> +0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
>  #tag:ptx --start-number 200
>  0200-xml2-config-is-not-SYSROOT-aware.patch
> -# 9a7de85eef8cb30919e83bc9b2e42cd9  - git-ptx-patches magic
> +# 0a9081f5db07b8cbb593bc669a7603c7  - git-ptx-patches magic
> 

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [ptxdist] [4/4] libxml2: Add upstream patch fixing CVE-2019-20388
  2020-03-18 13:27 ` [ptxdist] [PATCH 4/4] libxml2: Add upstream patch fixing CVE-2019-20388 Alexander Dahl
@ 2020-03-27  9:52   ` Michael Olbrich
  0 siblings, 0 replies; 9+ messages in thread
From: Michael Olbrich @ 2020-03-27  9:52 UTC (permalink / raw)
  To: ptxdist; +Cc: Alexander Dahl

Thanks, applied.

Michael

[sent from post-receive hook]

On Fri, 27 Mar 2020 10:52:26 +0100, Alexander Dahl <ada@thorsis.com> wrote:
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
>  ...mory-leak-in-xmlSchemaValidateStream.patch | 29 +++++++++++++++++++
>  patches/libxml2-2.9.10/series                 |  3 +-
>  2 files changed, 31 insertions(+), 1 deletion(-)
>  create mode 100644 patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
> 
> diff --git a/patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch b/patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
> new file mode 100644
> index 000000000..1ca086217
> --- /dev/null
> +++ b/patches/libxml2-2.9.10/0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
> @@ -0,0 +1,29 @@
> +From: Zhipeng Xie <xiezhipeng1@huawei.com>
> +Date: Tue, 20 Aug 2019 16:33:06 +0800
> +Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream
> +
> +When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
> +alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
> +to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
> +vctxt->xsiAssemble to 0 again which cause the alloced schema
> +can not be freed anymore.
> +
> +Found with libFuzzer.
> +
> +Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
> +---
> + xmlschemas.c | 1 -
> + 1 file changed, 1 deletion(-)
> +
> +diff --git a/xmlschemas.c b/xmlschemas.c
> +index d19de6df5f50..59495c2738ab 100644
> +--- a/xmlschemas.c
> ++++ b/xmlschemas.c
> +@@ -28095,7 +28095,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) {
> +     vctxt->nberrors = 0;
> +     vctxt->depth = -1;
> +     vctxt->skipDepth = -1;
> +-    vctxt->xsiAssemble = 0;
> +     vctxt->hasKeyrefs = 0;
> + #ifdef ENABLE_IDC_NODE_TABLES_TEST
> +     vctxt->createIDCNodeTables = 1;
> diff --git a/patches/libxml2-2.9.10/series b/patches/libxml2-2.9.10/series
> index b8e92fb7a..fed72960d 100644
> --- a/patches/libxml2-2.9.10/series
> +++ b/patches/libxml2-2.9.10/series
> @@ -2,6 +2,7 @@
>  #tag:base --start-number 1
>  #tag:upstream --start-number 1
>  0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
> +0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
>  #tag:ptx --start-number 200
>  0200-xml2-config-is-not-SYSROOT-aware.patch
> -# 0a9081f5db07b8cbb593bc669a7603c7  - git-ptx-patches magic
> +# d6f49636e8813a3a9e46758f352fc667  - git-ptx-patches magic
> 

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2020-03-27  9:52 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-18 13:27 [ptxdist] [PATCH 0/4] libxml2: Upgrade and add some fixes Alexander Dahl
2020-03-18 13:27 ` [ptxdist] [PATCH 1/4] libxml2: Fix license and add license file hashes Alexander Dahl
2020-03-27  9:52   ` [ptxdist] [1/4] " Michael Olbrich
2020-03-18 13:27 ` [ptxdist] [PATCH 2/4] libxml2: version bump 2.9.9 -> 2.9.10 Alexander Dahl
2020-03-27  9:52   ` [ptxdist] [2/4] " Michael Olbrich
2020-03-18 13:27 ` [ptxdist] [PATCH 3/4] libxml2: Add upstream patch fixing CVE-2020-7595 Alexander Dahl
2020-03-27  9:52   ` [ptxdist] [3/4] " Michael Olbrich
2020-03-18 13:27 ` [ptxdist] [PATCH 4/4] libxml2: Add upstream patch fixing CVE-2019-20388 Alexander Dahl
2020-03-27  9:52   ` [ptxdist] [4/4] " Michael Olbrich

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox