summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2016-07-09 14:27:44 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-07-27 08:29:58 +0100
commitf2688ed2008c591ed5009371d8e25e95a5891505 (patch)
tree7c7d8698338194a5a7a3a49896d9867dce6dc23e
parentc9e0efd1f7ea808a37e631eba9715c2b59cc102f (diff)
downloadpoky-f2688ed2008c591ed5009371d8e25e95a5891505.tar.gz
libxml2: Security fix for CVE-2016-1762
(From OE-Core rev: 8a59dc853d2870bc33ef3cc5af202e33b3d7c6c2) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-core/libxml/libxml2/CVE-2016-1762.patch84
-rw-r--r--meta/recipes-core/libxml/libxml2_2.9.2.bb2
2 files changed, 86 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-1762.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-1762.patch
new file mode 100644
index 0000000000..8fff179ce9
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2016-1762.patch
@@ -0,0 +1,84 @@
1From a7a94612aa3b16779e2c74e1fa353b5d9786c602 Mon Sep 17 00:00:00 2001
2From: Daniel Veillard <veillard@redhat.com>
3Date: Tue, 9 Feb 2016 12:55:29 +0100
4Subject: [PATCH] Heap-based buffer overread in xmlNextChar
5
6For https://bugzilla.gnome.org/show_bug.cgi?id=759671
7
8when the end of the internal subset isn't properly detected
9xmlParseInternalSubset should just return instead of trying
10to process input further.
11
12Upstream-Status: Backport
13CVE: CVE-2016-1762
14Signed-off-by: Armin Kuster <akuster@mvista.com>
15
16---
17 parser.c | 1 +
18 result/errors/754946.xml.err | 10 +++++-----
19 result/errors/content1.xml.err | 2 +-
20 result/valid/t8.xml.err | 2 +-
21 result/valid/t8a.xml.err | 2 +-
22 5 files changed, 9 insertions(+), 8 deletions(-)
23
24Index: libxml2-2.9.2/parser.c
25===================================================================
26--- libxml2-2.9.2.orig/parser.c
27+++ libxml2-2.9.2/parser.c
28@@ -8480,6 +8480,7 @@ xmlParseInternalSubset(xmlParserCtxtPtr
29 */
30 if (RAW != '>') {
31 xmlFatalErr(ctxt, XML_ERR_DOCTYPE_NOT_FINISHED, NULL);
32+ return;
33 }
34 NEXT;
35 }
36Index: libxml2-2.9.2/result/errors/754946.xml.err
37===================================================================
38--- libxml2-2.9.2.orig/result/errors/754946.xml.err
39+++ libxml2-2.9.2/result/errors/754946.xml.err
40@@ -11,9 +11,9 @@ Entity: line 1: parser error : DOCTYPE i
41 Entity: line 1:
42 A<lbbbbbbbbbbbbbbbbbbb_
43 ^
44-./test/errors/754946.xml:1: parser error : Start tag doesn't start and stop in the same entity
45->%SYSTEM;<![
46- ^
47-./test/errors/754946.xml:1: parser error : Extra content at the end of the document
48->%SYSTEM;<![
49+Entity: line 1: parser error : Start tag expected, '<' not found
50+ %SYSTEM;
51 ^
52+Entity: line 1:
53+A<lbbbbbbbbbbbbbbbbbbb_
54+^
55Index: libxml2-2.9.2/result/errors/content1.xml.err
56===================================================================
57--- libxml2-2.9.2.orig/result/errors/content1.xml.err
58+++ libxml2-2.9.2/result/errors/content1.xml.err
59@@ -13,4 +13,4 @@
60 ^
61 ./test/errors/content1.xml:7: parser error : Start tag expected, '<' not found
62 <!ELEMENT aElement (a |b * >
63- ^
64+ ^
65Index: libxml2-2.9.2/result/valid/t8.xml.err
66===================================================================
67--- libxml2-2.9.2.orig/result/valid/t8.xml.err
68+++ libxml2-2.9.2/result/valid/t8.xml.err
69@@ -16,4 +16,4 @@ Entity: line 1: parser error : Start tag
70 ^
71 Entity: line 1:
72 &lt;!ELEMENT root (middle) >
73- ^
74+^
75Index: libxml2-2.9.2/result/valid/t8a.xml.err
76===================================================================
77--- libxml2-2.9.2.orig/result/valid/t8a.xml.err
78+++ libxml2-2.9.2/result/valid/t8a.xml.err
79@@ -16,4 +16,4 @@ Entity: line 1: parser error : Start tag
80 ^
81 Entity: line 1:
82 &lt;!ELEMENT root (middle) >
83- ^
84+^
diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb
index 79a395cea1..7f2ded76c1 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.2.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb
@@ -4,6 +4,8 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar \
4 file://72a46a519ce7326d9a00f0b6a7f2a8e958cd1675.patch \ 4 file://72a46a519ce7326d9a00f0b6a7f2a8e958cd1675.patch \
5 file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \ 5 file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \
6 " 6 "
7SRC_URI += "file://CVE-2016-1762.patch \
8 "
7 9
8SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" 10SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788"
9SRC_URI[libtar.sha256sum] = "5178c30b151d044aefb1b08bf54c3003a0ac55c59c866763997529d60770d5bc" 11SRC_URI[libtar.sha256sum] = "5178c30b151d044aefb1b08bf54c3003a0ac55c59c866763997529d60770d5bc"