libxml2: Fix CVEs

CVE: CVE-2017-16932 CVE-2017-5130 CVE-2017-7375 CVE-2017-7376

Libxml2 in the upstream pyro is 2.9.4
CVE-2017-7376: For the stable distribution (stretch), these problems
have been fixed in version 2.9.4+dfsg1-2.2+deb9u1
CVE-2017-7375: stretch (security) 2.9.4+dfsg1-2.2+deb9u2

Reference:
CVE-2017-16932 https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961
CVE-2017-5130 https://gitlab.gnome.org/GNOME/libxml2/commit/897dffbae322b46b83f99a607d527058a72c51ed
CVE-2017-7375 https://gitlab.gnome.org/GNOME/libxml2/commit/90ccb58242866b0ba3edbef8fe44214a101c2b3e
CVE-2017-7376 https://gitlab.gnome.org/GNOME/libxml2/commit/5dca9eea1bd4263bfa4d037ab2443de1cd730f7e

Change-Id: Icf68eea8e0916be2bc9f3e844f7d38f6fae75300
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
Signed-off-by: Adrian Mangeac <adrian.mangeac@enea.com>

1 files changed, 66 insertions, 0 deletions

diff --git a/recipes-core/libxml/libxml2/CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch b/recipes-core/libxml/libxml2/CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch
new file mode 100644
index 0000000..e072ef1
--- /dev/null
+++ b/recipes-core/libxml/libxml2/CVE-2017-5130-check-for-integer-overflow-in-memory-debug-code.patch
@@ -0,0 +1,66 @@
+From 897dffbae322b46b83f99a607d527058a72c51ed Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 6 Jun 2017 13:21:14 +0200
+Subject: [PATCH] Check for integer overflow in memory debug code
+
+Fixes bug 783026.
+
+Thanks to Pranjal Jumde for the report.
+
+CVE: CVE-2017-5130
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/897dffbae322b46b83f99a607d527058a72c51ed]
+
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ xmlmemory.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/xmlmemory.c b/xmlmemory.c
+index f08c8c3..c53141f 100644
+--- a/xmlmemory.c
++++ b/xmlmemory.c
+@@ -172,6 +172,13 @@ xmlMallocLoc(size_t size, const char * file, int line)
+ 
+     TEST_POINT
+ 
++    if (size > (MAX_SIZE_T - RESERVE_SIZE)) {
++       xmlGenericError(xmlGenericErrorContext,
++               "xmlMallocLoc : Unsigned overflow\n");
++       xmlMemoryDump();
++       return(NULL);
++    }
++
+     p = (MEMHDR *) malloc(RESERVE_SIZE+size);
+ 
+     if (!p) {
+@@ -352,6 +359,13 @@ xmlReallocLoc(void *ptr,size_t size, const char * file, int line)
+ #endif
+     xmlMutexUnlock(xmlMemMutex);
+ 
++    if (size > (MAX_SIZE_T - RESERVE_SIZE)) {
++       xmlGenericError(xmlGenericErrorContext,
++               "xmlMallocLoc : Unsigned overflow\n");
++       xmlMemoryDump();
++       return(NULL);
++    }
++
+     tmp = (MEMHDR *) realloc(p,RESERVE_SIZE+size);
+     if (!tmp) {
+         free(p);
+@@ -499,6 +513,13 @@ xmlMemStrdupLoc(const char *str, const char *file, int line)
+     if (!xmlMemInitialized) xmlInitMemory();
+     TEST_POINT
+ 
++    if (size > (MAX_SIZE_T - RESERVE_SIZE)) {
++       xmlGenericError(xmlGenericErrorContext,
++               "xmlMallocLoc : Unsigned overflow\n");
++       xmlMemoryDump();
++       return(NULL);
++    }
++
+     p = (MEMHDR *) malloc(RESERVE_SIZE+size);
+     if (!p) {
+       goto error;
+-- 
+2.7.4
+