diff options
author | Vijay Anusuri <vanusuri@mvista.com> | 2024-01-12 08:34:06 +0530 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2024-01-21 08:33:19 -1000 |
commit | 2f7e1a230e17860dfc8fb735d4778510600a42db (patch) | |
tree | c75f12ee4494f38d95458123a5a7f80141043fd8 /meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch | |
parent | 0948746aac0197b97fd4b6063a30b1bcda2c6436 (diff) | |
download | poky-2f7e1a230e17860dfc8fb735d4778510600a42db.tar.gz |
libxml2: Fix for CVE-2023-45322
Backport patch for gitlab issue mentioned in NVD CVE report.
* https://gitlab.gnome.org/GNOME/libxml2/-/issues/583
Backport also one of 14 patches for older issue with similar errors
to have clean cherry-pick without patch fuzz.
* https://gitlab.gnome.org/GNOME/libxml2/-/issues/344
The CVE is disputed because the maintainer does not think that
errors after memory allocation failures are not critical enough
to warrant a CVE ID.
This patch will formally fix reported error case, trying to backport
another 13 patches and resolve conflicts would be probably overkill
due to disputed state.
This CVE was ignored on master branch (as diputed).
(From OE-Core rev: 03b766e42beb42a2085285308acbcf941f346b06)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch')
-rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch | 80 |
1 files changed, 80 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch b/meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch new file mode 100644 index 0000000000..c7e9681e6a --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2023-45322-2.patch | |||
@@ -0,0 +1,80 @@ | |||
1 | From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Nick Wellnhofer <wellnhofer@aevum.de> | ||
3 | Date: Wed, 23 Aug 2023 20:24:24 +0200 | ||
4 | Subject: [PATCH] tree: Fix copying of DTDs | ||
5 | |||
6 | - Don't create multiple DTD nodes. | ||
7 | - Fix UAF if malloc fails. | ||
8 | - Skip DTD nodes if tree module is disabled. | ||
9 | |||
10 | Fixes #583. | ||
11 | |||
12 | CVE: CVE-2023-45322 | ||
13 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/d39f78069dff496ec865c73aa44d7110e429bce9] | ||
14 | |||
15 | Signed-off-by: Peter Marko <peter.marko@siemens.com> | ||
16 | Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> | ||
17 | --- | ||
18 | tree.c | 31 ++++++++++++++++--------------- | ||
19 | 1 file changed, 16 insertions(+), 15 deletions(-) | ||
20 | |||
21 | diff --git a/tree.c b/tree.c | ||
22 | index 6c8a875b9..02c1b5791 100644 | ||
23 | --- a/tree.c | ||
24 | +++ b/tree.c | ||
25 | @@ -4471,29 +4471,28 @@ xmlNodePtr | ||
26 | xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { | ||
27 | xmlNodePtr ret = NULL; | ||
28 | xmlNodePtr p = NULL,q; | ||
29 | + xmlDtdPtr newSubset = NULL; | ||
30 | |||
31 | while (node != NULL) { | ||
32 | -#ifdef LIBXML_TREE_ENABLED | ||
33 | if (node->type == XML_DTD_NODE ) { | ||
34 | - if (doc == NULL) { | ||
35 | +#ifdef LIBXML_TREE_ENABLED | ||
36 | + if ((doc == NULL) || (doc->intSubset != NULL)) { | ||
37 | node = node->next; | ||
38 | continue; | ||
39 | } | ||
40 | - if (doc->intSubset == NULL) { | ||
41 | - q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); | ||
42 | - if (q == NULL) goto error; | ||
43 | - q->doc = doc; | ||
44 | - q->parent = parent; | ||
45 | - doc->intSubset = (xmlDtdPtr) q; | ||
46 | - xmlAddChild(parent, q); | ||
47 | - } else { | ||
48 | - q = (xmlNodePtr) doc->intSubset; | ||
49 | - xmlAddChild(parent, q); | ||
50 | - } | ||
51 | - } else | ||
52 | + q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); | ||
53 | + if (q == NULL) goto error; | ||
54 | + q->doc = doc; | ||
55 | + q->parent = parent; | ||
56 | + newSubset = (xmlDtdPtr) q; | ||
57 | +#else | ||
58 | + node = node->next; | ||
59 | + continue; | ||
60 | #endif /* LIBXML_TREE_ENABLED */ | ||
61 | + } else { | ||
62 | q = xmlStaticCopyNode(node, doc, parent, 1); | ||
63 | - if (q == NULL) goto error; | ||
64 | + if (q == NULL) goto error; | ||
65 | + } | ||
66 | if (ret == NULL) { | ||
67 | q->prev = NULL; | ||
68 | ret = p = q; | ||
69 | @@ -4505,6 +4504,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { | ||
70 | } | ||
71 | node = node->next; | ||
72 | } | ||
73 | + if (newSubset != NULL) | ||
74 | + doc->intSubset = newSubset; | ||
75 | return(ret); | ||
76 | error: | ||
77 | xmlFreeNodeList(ret); | ||
78 | -- | ||
79 | GitLab | ||
80 | |||