summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorAndrej Valek <andrej.valek@siemens.com>2017-09-06 08:04:59 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-05-03 09:53:47 +0100
commitdf6d284c66326b8148736e9998b5b95856b1f0ba (patch)
treef2b019a8f20b8779d2965847d6e0ce75235fec21 /meta
parentc4f6da78499caaffbc1e2a9007781ee0e3709d30 (diff)
downloadpoky-df6d284c66326b8148736e9998b5b95856b1f0ba.tar.gz
libxml2: 2.9.4 -> 2.9.5
(From OE-Core rev: a0d2427bb86668215d7c9e1be07cb9a2d86f6755) This includes these CVEs: CVE-2017-7376 CVE-2017-7375 CVE-2017-5130 CVE-2017-16932 CVE-2017-16931 see http://xmlsoft.org/news.html for more info. (From OE-Core rev: 6a62f30bcb516f6a5c97f21086ecd13ffbb6f821) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml-m4-use-pkgconfig.patch2
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-4658.patch269
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-5131.patch180
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-0663.patch40
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-5969.patch62
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-8872.patch37
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9047_CVE-2017-9048.patch103
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9049_CVE-2017-9050.patch291
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-fix_NULL_pointer_derefs.patch45
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-fix_and_simplify_xmlParseStartTag2.patch590
-rw-r--r--meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch67
-rw-r--r--meta/recipes-core/libxml/libxml2/runtest.patch34
-rw-r--r--meta/recipes-core/libxml/libxml2_2.9.5.bb (renamed from meta/recipes-core/libxml/libxml2_2.9.4.bb)18
13 files changed, 15 insertions, 1723 deletions
diff --git a/meta/recipes-core/libxml/libxml2/libxml-m4-use-pkgconfig.patch b/meta/recipes-core/libxml/libxml2/libxml-m4-use-pkgconfig.patch
index 3277165618..d9ed1516fe 100644
--- a/meta/recipes-core/libxml/libxml2/libxml-m4-use-pkgconfig.patch
+++ b/meta/recipes-core/libxml/libxml2/libxml-m4-use-pkgconfig.patch
@@ -183,7 +183,7 @@ index 68cd824..5fa0a9b 100644
183- echo "*** If you have an old version installed, it is best to remove it, although" 183- echo "*** If you have an old version installed, it is best to remove it, although"
184- echo "*** you may also be able to get things to work by modifying LD_LIBRARY_PATH" ], 184- echo "*** you may also be able to get things to work by modifying LD_LIBRARY_PATH" ],
185- [ echo "*** The test program failed to compile or link. See the file config.log for the" 185- [ echo "*** The test program failed to compile or link. See the file config.log for the"
186- echo "*** exact error that occured. This usually means LIBXML was incorrectly installed" 186- echo "*** exact error that occurred. This usually means LIBXML was incorrectly installed"
187- echo "*** or that you have moved LIBXML since it was installed. In the latter case, you" 187- echo "*** or that you have moved LIBXML since it was installed. In the latter case, you"
188- echo "*** may want to edit the xml2-config script: $XML2_CONFIG" ]) 188- echo "*** may want to edit the xml2-config script: $XML2_CONFIG" ])
189- CPPFLAGS="$ac_save_CPPFLAGS" 189- CPPFLAGS="$ac_save_CPPFLAGS"
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-4658.patch b/meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-4658.patch
deleted file mode 100644
index bb55eed171..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-4658.patch
+++ /dev/null
@@ -1,269 +0,0 @@
1libxml2-2.9.4: Fix CVE-2016-4658
2
3[No upstream tracking] -- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-4658
4
5xpointer: Disallow namespace nodes in XPointer points and ranges
6
7Namespace nodes must be copied to avoid use-after-free errors.
8But they don't necessarily have a physical representation in a
9document, so simply disallow them in XPointer ranges.
10
11Upstream-Status: Backport
12 - [https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b]
13 - [https://git.gnome.org/browse/libxml2/commit/?id=3f8a91036d338e51c059d54397a42d645f019c65]
14CVE: CVE-2016-4658
15Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
16Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
17
18diff --git a/xpointer.c b/xpointer.c
19index 676c510..911680d 100644
20--- a/xpointer.c
21+++ b/xpointer.c
22@@ -320,6 +320,45 @@ xmlXPtrRangesEqual(xmlXPathObjectPtr range1, xmlXPathObjectPtr range2) {
23 }
24
25 /**
26+ * xmlXPtrNewRangeInternal:
27+ * @start: the starting node
28+ * @startindex: the start index
29+ * @end: the ending point
30+ * @endindex: the ending index
31+ *
32+ * Internal function to create a new xmlXPathObjectPtr of type range
33+ *
34+ * Returns the newly created object.
35+ */
36+static xmlXPathObjectPtr
37+xmlXPtrNewRangeInternal(xmlNodePtr start, int startindex,
38+ xmlNodePtr end, int endindex) {
39+ xmlXPathObjectPtr ret;
40+
41+ /*
42+ * Namespace nodes must be copied (see xmlXPathNodeSetDupNs).
43+ * Disallow them for now.
44+ */
45+ if ((start != NULL) && (start->type == XML_NAMESPACE_DECL))
46+ return(NULL);
47+ if ((end != NULL) && (end->type == XML_NAMESPACE_DECL))
48+ return(NULL);
49+
50+ ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
51+ if (ret == NULL) {
52+ xmlXPtrErrMemory("allocating range");
53+ return(NULL);
54+ }
55+ memset(ret, 0, sizeof(xmlXPathObject));
56+ ret->type = XPATH_RANGE;
57+ ret->user = start;
58+ ret->index = startindex;
59+ ret->user2 = end;
60+ ret->index2 = endindex;
61+ return(ret);
62+}
63+
64+/**
65 * xmlXPtrNewRange:
66 * @start: the starting node
67 * @startindex: the start index
68@@ -344,17 +383,7 @@ xmlXPtrNewRange(xmlNodePtr start, int startindex,
69 if (endindex < 0)
70 return(NULL);
71
72- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
73- if (ret == NULL) {
74- xmlXPtrErrMemory("allocating range");
75- return(NULL);
76- }
77- memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
78- ret->type = XPATH_RANGE;
79- ret->user = start;
80- ret->index = startindex;
81- ret->user2 = end;
82- ret->index2 = endindex;
83+ ret = xmlXPtrNewRangeInternal(start, startindex, end, endindex);
84 xmlXPtrRangeCheckOrder(ret);
85 return(ret);
86 }
87@@ -381,17 +410,8 @@ xmlXPtrNewRangePoints(xmlXPathObjectPtr start, xmlXPathObjectPtr end) {
88 if (end->type != XPATH_POINT)
89 return(NULL);
90
91- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
92- if (ret == NULL) {
93- xmlXPtrErrMemory("allocating range");
94- return(NULL);
95- }
96- memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
97- ret->type = XPATH_RANGE;
98- ret->user = start->user;
99- ret->index = start->index;
100- ret->user2 = end->user;
101- ret->index2 = end->index;
102+ ret = xmlXPtrNewRangeInternal(start->user, start->index, end->user,
103+ end->index);
104 xmlXPtrRangeCheckOrder(ret);
105 return(ret);
106 }
107@@ -416,17 +436,7 @@ xmlXPtrNewRangePointNode(xmlXPathObjectPtr start, xmlNodePtr end) {
108 if (start->type != XPATH_POINT)
109 return(NULL);
110
111- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
112- if (ret == NULL) {
113- xmlXPtrErrMemory("allocating range");
114- return(NULL);
115- }
116- memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
117- ret->type = XPATH_RANGE;
118- ret->user = start->user;
119- ret->index = start->index;
120- ret->user2 = end;
121- ret->index2 = -1;
122+ ret = xmlXPtrNewRangeInternal(start->user, start->index, end, -1);
123 xmlXPtrRangeCheckOrder(ret);
124 return(ret);
125 }
126@@ -453,17 +463,7 @@ xmlXPtrNewRangeNodePoint(xmlNodePtr start, xmlXPathObjectPtr end) {
127 if (end->type != XPATH_POINT)
128 return(NULL);
129
130- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
131- if (ret == NULL) {
132- xmlXPtrErrMemory("allocating range");
133- return(NULL);
134- }
135- memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
136- ret->type = XPATH_RANGE;
137- ret->user = start;
138- ret->index = -1;
139- ret->user2 = end->user;
140- ret->index2 = end->index;
141+ ret = xmlXPtrNewRangeInternal(start, -1, end->user, end->index);
142 xmlXPtrRangeCheckOrder(ret);
143 return(ret);
144 }
145@@ -486,17 +486,7 @@ xmlXPtrNewRangeNodes(xmlNodePtr start, xmlNodePtr end) {
146 if (end == NULL)
147 return(NULL);
148
149- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
150- if (ret == NULL) {
151- xmlXPtrErrMemory("allocating range");
152- return(NULL);
153- }
154- memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
155- ret->type = XPATH_RANGE;
156- ret->user = start;
157- ret->index = -1;
158- ret->user2 = end;
159- ret->index2 = -1;
160+ ret = xmlXPtrNewRangeInternal(start, -1, end, -1);
161 xmlXPtrRangeCheckOrder(ret);
162 return(ret);
163 }
164@@ -516,17 +506,7 @@ xmlXPtrNewCollapsedRange(xmlNodePtr start) {
165 if (start == NULL)
166 return(NULL);
167
168- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
169- if (ret == NULL) {
170- xmlXPtrErrMemory("allocating range");
171- return(NULL);
172- }
173- memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
174- ret->type = XPATH_RANGE;
175- ret->user = start;
176- ret->index = -1;
177- ret->user2 = NULL;
178- ret->index2 = -1;
179+ ret = xmlXPtrNewRangeInternal(start, -1, NULL, -1);
180 return(ret);
181 }
182
183@@ -541,6 +521,8 @@ xmlXPtrNewCollapsedRange(xmlNodePtr start) {
184 */
185 xmlXPathObjectPtr
186 xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) {
187+ xmlNodePtr endNode;
188+ int endIndex;
189 xmlXPathObjectPtr ret;
190
191 if (start == NULL)
192@@ -549,7 +531,12 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) {
193 return(NULL);
194 switch (end->type) {
195 case XPATH_POINT:
196+ endNode = end->user;
197+ endIndex = end->index;
198+ break;
199 case XPATH_RANGE:
200+ endNode = end->user2;
201+ endIndex = end->index2;
202 break;
203 case XPATH_NODESET:
204 /*
205@@ -557,39 +544,15 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) {
206 */
207 if (end->nodesetval->nodeNr <= 0)
208 return(NULL);
209+ endNode = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1];
210+ endIndex = -1;
211 break;
212 default:
213 /* TODO */
214 return(NULL);
215 }
216
217- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
218- if (ret == NULL) {
219- xmlXPtrErrMemory("allocating range");
220- return(NULL);
221- }
222- memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
223- ret->type = XPATH_RANGE;
224- ret->user = start;
225- ret->index = -1;
226- switch (end->type) {
227- case XPATH_POINT:
228- ret->user2 = end->user;
229- ret->index2 = end->index;
230- break;
231- case XPATH_RANGE:
232- ret->user2 = end->user2;
233- ret->index2 = end->index2;
234- break;
235- case XPATH_NODESET: {
236- ret->user2 = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1];
237- ret->index2 = -1;
238- break;
239- }
240- default:
241- STRANGE
242- return(NULL);
243- }
244+ ret = xmlXPtrNewRangeInternal(start, -1, endNode, endIndex);
245 xmlXPtrRangeCheckOrder(ret);
246 return(ret);
247 }
248@@ -1835,8 +1798,8 @@ xmlXPtrStartPointFunction(xmlXPathParserContextPtr ctxt, int nargs) {
249 case XPATH_RANGE: {
250 xmlNodePtr node = tmp->user;
251 if (node != NULL) {
252- if (node->type == XML_ATTRIBUTE_NODE) {
253- /* TODO: Namespace Nodes ??? */
254+ if ((node->type == XML_ATTRIBUTE_NODE) ||
255+ (node->type == XML_NAMESPACE_DECL)) {
256 xmlXPathFreeObject(obj);
257 xmlXPtrFreeLocationSet(newset);
258 XP_ERROR(XPTR_SYNTAX_ERROR);
259@@ -1931,8 +1894,8 @@ xmlXPtrEndPointFunction(xmlXPathParserContextPtr ctxt, int nargs) {
260 case XPATH_RANGE: {
261 xmlNodePtr node = tmp->user2;
262 if (node != NULL) {
263- if (node->type == XML_ATTRIBUTE_NODE) {
264- /* TODO: Namespace Nodes ??? */
265+ if ((node->type == XML_ATTRIBUTE_NODE) ||
266+ (node->type == XML_NAMESPACE_DECL)) {
267 xmlXPathFreeObject(obj);
268 xmlXPtrFreeLocationSet(newset);
269 XP_ERROR(XPTR_SYNTAX_ERROR);
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-5131.patch b/meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-5131.patch
deleted file mode 100644
index 9d47d023a9..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2016-5131.patch
+++ /dev/null
@@ -1,180 +0,0 @@
1From 9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e Mon Sep 17 00:00:00 2001
2From: Nick Wellnhofer <wellnhofer@aevum.de>
3Date: Tue, 28 Jun 2016 14:22:23 +0200
4Subject: [PATCH] Fix XPointer paths beginning with range-to
5
6The old code would invoke the broken xmlXPtrRangeToFunction. range-to
7isn't really a function but a special kind of location step. Remove
8this function and always handle range-to in the XPath code.
9
10The old xmlXPtrRangeToFunction could also be abused to trigger a
11use-after-free error with the potential for remote code execution.
12
13Found with afl-fuzz.
14
15Fixes CVE-2016-5131.
16
17CVE: CVE-2016-5131
18Upstream-Status: Backport
19https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e
20
21Signed-off-by: Yi Zhao <yi.zhao@windirver.com>
22---
23 result/XPath/xptr/vidbase | 13 ++++++++
24 test/XPath/xptr/vidbase | 1 +
25 xpath.c | 7 ++++-
26 xpointer.c | 76 ++++-------------------------------------------
27 4 files changed, 26 insertions(+), 71 deletions(-)
28
29diff --git a/result/XPath/xptr/vidbase b/result/XPath/xptr/vidbase
30index 8b9e92d..f19193e 100644
31--- a/result/XPath/xptr/vidbase
32+++ b/result/XPath/xptr/vidbase
33@@ -17,3 +17,16 @@ Object is a Location Set:
34 To node
35 ELEMENT p
36
37+
38+========================
39+Expression: xpointer(range-to(id('chapter2')))
40+Object is a Location Set:
41+1 : Object is a range :
42+ From node
43+ /
44+ To node
45+ ELEMENT chapter
46+ ATTRIBUTE id
47+ TEXT
48+ content=chapter2
49+
50diff --git a/test/XPath/xptr/vidbase b/test/XPath/xptr/vidbase
51index b146383..884b106 100644
52--- a/test/XPath/xptr/vidbase
53+++ b/test/XPath/xptr/vidbase
54@@ -1,2 +1,3 @@
55 xpointer(id('chapter1')/p)
56 xpointer(id('chapter1')/p[1]/range-to(following-sibling::p[2]))
57+xpointer(range-to(id('chapter2')))
58diff --git a/xpath.c b/xpath.c
59index d992841..5a01b1b 100644
60--- a/xpath.c
61+++ b/xpath.c
62@@ -10691,13 +10691,18 @@ xmlXPathCompPathExpr(xmlXPathParserContextPtr ctxt) {
63 lc = 1;
64 break;
65 } else if ((NXT(len) == '(')) {
66- /* Note Type or Function */
67+ /* Node Type or Function */
68 if (xmlXPathIsNodeType(name)) {
69 #ifdef DEBUG_STEP
70 xmlGenericError(xmlGenericErrorContext,
71 "PathExpr: Type search\n");
72 #endif
73 lc = 1;
74+#ifdef LIBXML_XPTR_ENABLED
75+ } else if (ctxt->xptr &&
76+ xmlStrEqual(name, BAD_CAST "range-to")) {
77+ lc = 1;
78+#endif
79 } else {
80 #ifdef DEBUG_STEP
81 xmlGenericError(xmlGenericErrorContext,
82diff --git a/xpointer.c b/xpointer.c
83index 676c510..d74174a 100644
84--- a/xpointer.c
85+++ b/xpointer.c
86@@ -1332,8 +1332,6 @@ xmlXPtrNewContext(xmlDocPtr doc, xmlNodePtr here, xmlNodePtr origin) {
87 ret->here = here;
88 ret->origin = origin;
89
90- xmlXPathRegisterFunc(ret, (xmlChar *)"range-to",
91- xmlXPtrRangeToFunction);
92 xmlXPathRegisterFunc(ret, (xmlChar *)"range",
93 xmlXPtrRangeFunction);
94 xmlXPathRegisterFunc(ret, (xmlChar *)"range-inside",
95@@ -2243,76 +2241,14 @@ xmlXPtrRangeInsideFunction(xmlXPathParserContextPtr ctxt, int nargs) {
96 * @nargs: the number of args
97 *
98 * Implement the range-to() XPointer function
99+ *
100+ * Obsolete. range-to is not a real function but a special type of location
101+ * step which is handled in xpath.c.
102 */
103 void
104-xmlXPtrRangeToFunction(xmlXPathParserContextPtr ctxt, int nargs) {
105- xmlXPathObjectPtr range;
106- const xmlChar *cur;
107- xmlXPathObjectPtr res, obj;
108- xmlXPathObjectPtr tmp;
109- xmlLocationSetPtr newset = NULL;
110- xmlNodeSetPtr oldset;
111- int i;
112-
113- if (ctxt == NULL) return;
114- CHECK_ARITY(1);
115- /*
116- * Save the expression pointer since we will have to evaluate
117- * it multiple times. Initialize the new set.
118- */
119- CHECK_TYPE(XPATH_NODESET);
120- obj = valuePop(ctxt);
121- oldset = obj->nodesetval;
122- ctxt->context->node = NULL;
123-
124- cur = ctxt->cur;
125- newset = xmlXPtrLocationSetCreate(NULL);
126-
127- for (i = 0; i < oldset->nodeNr; i++) {
128- ctxt->cur = cur;
129-
130- /*
131- * Run the evaluation with a node list made of a single item
132- * in the nodeset.
133- */
134- ctxt->context->node = oldset->nodeTab[i];
135- tmp = xmlXPathNewNodeSet(ctxt->context->node);
136- valuePush(ctxt, tmp);
137-
138- xmlXPathEvalExpr(ctxt);
139- CHECK_ERROR;
140-
141- /*
142- * The result of the evaluation need to be tested to
143- * decided whether the filter succeeded or not
144- */
145- res = valuePop(ctxt);
146- range = xmlXPtrNewRangeNodeObject(oldset->nodeTab[i], res);
147- if (range != NULL) {
148- xmlXPtrLocationSetAdd(newset, range);
149- }
150-
151- /*
152- * Cleanup
153- */
154- if (res != NULL)
155- xmlXPathFreeObject(res);
156- if (ctxt->value == tmp) {
157- res = valuePop(ctxt);
158- xmlXPathFreeObject(res);
159- }
160-
161- ctxt->context->node = NULL;
162- }
163-
164- /*
165- * The result is used as the new evaluation set.
166- */
167- xmlXPathFreeObject(obj);
168- ctxt->context->node = NULL;
169- ctxt->context->contextSize = -1;
170- ctxt->context->proximityPosition = -1;
171- valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
172+xmlXPtrRangeToFunction(xmlXPathParserContextPtr ctxt,
173+ int nargs ATTRIBUTE_UNUSED) {
174+ XP_ERROR(XPATH_EXPR_ERROR);
175 }
176
177 /**
178--
1792.7.4
180
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-0663.patch b/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-0663.patch
deleted file mode 100644
index 0108265855..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-0663.patch
+++ /dev/null
@@ -1,40 +0,0 @@
1libxml2: Fix CVE-2017-0663
2
3[No upstream tracking] -- https://bugzilla.gnome.org/show_bug.cgi?id=780228
4
5valid: Fix type confusion in xmlValidateOneNamespace
6
7Comment out code that casts xmlNsPtr to xmlAttrPtr. ID types
8on namespace declarations make no practical sense anyway.
9
10Fixes bug 780228
11
12Upstream-Status: Backport [https://git.gnome.org/browse/libxml2/commit/?id=92b9e8c8b3787068565a1820ba575d042f9eec66]
13CVE: CVE-2017-0663
14Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
15
16diff --git a/valid.c b/valid.c
17index 19f84b8..e03d35e 100644
18--- a/valid.c
19+++ b/valid.c
20@@ -4621,6 +4621,12 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
21 }
22 }
23
24+ /*
25+ * Casting ns to xmlAttrPtr is wrong. We'd need separate functions
26+ * xmlAddID and xmlAddRef for namespace declarations, but it makes
27+ * no practical sense to use ID types anyway.
28+ */
29+#if 0
30 /* Validity Constraint: ID uniqueness */
31 if (attrDecl->atype == XML_ATTRIBUTE_ID) {
32 if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
33@@ -4632,6 +4638,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
34 if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
35 ret = 0;
36 }
37+#endif
38
39 /* Validity Constraint: Notation Attributes */
40 if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-5969.patch b/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-5969.patch
deleted file mode 100644
index 571b05c087..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-5969.patch
+++ /dev/null
@@ -1,62 +0,0 @@
1libxml2-2.9.4: Fix CVE-2017-5969
2
3[No upstream tracking] -- https://bugzilla.gnome.org/show_bug.cgi?id=758422
4
5valid: Fix NULL pointer deref in xmlDumpElementContent
6
7Can only be triggered in recovery mode.
8
9Fixes bug 758422
10
11Upstream-Status: Backport - [https://git.gnome.org/browse/libxml2/commit/?id=94691dc884d1a8ada39f073408b4bb92fe7fe882]
12CVE: CVE-2017-5969
13Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
14
15diff --git a/valid.c b/valid.c
16index 19f84b8..0a8e58a 100644
17--- a/valid.c
18+++ b/valid.c
19@@ -1172,29 +1172,33 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementContentPtr content, int glob)
20 xmlBufferWriteCHAR(buf, content->name);
21 break;
22 case XML_ELEMENT_CONTENT_SEQ:
23- if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
24- (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
25+ if ((content->c1 != NULL) &&
26+ ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
27+ (content->c1->type == XML_ELEMENT_CONTENT_SEQ)))
28 xmlDumpElementContent(buf, content->c1, 1);
29 else
30 xmlDumpElementContent(buf, content->c1, 0);
31 xmlBufferWriteChar(buf, " , ");
32- if ((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
33- ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&
34- (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
35+ if ((content->c2 != NULL) &&
36+ ((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
37+ ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&
38+ (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE))))
39 xmlDumpElementContent(buf, content->c2, 1);
40 else
41 xmlDumpElementContent(buf, content->c2, 0);
42 break;
43 case XML_ELEMENT_CONTENT_OR:
44- if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
45- (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
46+ if ((content->c1 != NULL) &&
47+ ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
48+ (content->c1->type == XML_ELEMENT_CONTENT_SEQ)))
49 xmlDumpElementContent(buf, content->c1, 1);
50 else
51 xmlDumpElementContent(buf, content->c1, 0);
52 xmlBufferWriteChar(buf, " | ");
53- if ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
54- ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&
55- (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
56+ if ((content->c2 != NULL) &&
57+ ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
58+ ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&
59+ (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE))))
60 xmlDumpElementContent(buf, content->c2, 1);
61 else
62 xmlDumpElementContent(buf, content->c2, 0);
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-8872.patch b/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-8872.patch
deleted file mode 100644
index 26779aa572..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-8872.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1From d2f873a541c72b0f67e15562819bf98b884b30b7 Mon Sep 17 00:00:00 2001
2From: Hongxu Jia <hongxu.jia@windriver.com>
3Date: Wed, 23 Aug 2017 16:04:49 +0800
4Subject: [PATCH] fix CVE-2017-8872
5
6this makes xmlHaltParser "empty" the buffer, as it resets cur and ava
7il too here.
8
9this seems to cure this specific issue, and also passes the testsuite
10
11Signed-off-by: Marcus Meissner <meissner@suse.de>
12
13https://bugzilla.gnome.org/show_bug.cgi?id=775200
14Upstream-Status: Backport [https://bugzilla.gnome.org/attachment.cgi?id=355527&action=diff]
15Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
16---
17 parser.c | 4 ++++
18 1 file changed, 4 insertions(+)
19
20diff --git a/parser.c b/parser.c
21index 9506ead..6c07ffd 100644
22--- a/parser.c
23+++ b/parser.c
24@@ -12664,6 +12664,10 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) {
25 }
26 ctxt->input->cur = BAD_CAST"";
27 ctxt->input->base = ctxt->input->cur;
28+ if (ctxt->input->buf) {
29+ xmlBufEmpty (ctxt->input->buf->buffer);
30+ } else
31+ ctxt->input->length = 0;
32 }
33 }
34
35--
362.7.4
37
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9047_CVE-2017-9048.patch b/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9047_CVE-2017-9048.patch
deleted file mode 100644
index 8b034560fa..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9047_CVE-2017-9048.patch
+++ /dev/null
@@ -1,103 +0,0 @@
1libxml2-2.9.4: Fix CVE-2017-9047 and CVE-2017-9048
2
3[No upstream tracking] -- https://bugzilla.gnome.org/show_bug.cgi?id=781333
4 -- https://bugzilla.gnome.org/show_bug.cgi?id=781701
5
6valid: Fix buffer size checks in xmlSnprintfElementContent
7
8xmlSnprintfElementContent failed to correctly check the available
9buffer space in two locations.
10
11Fixes bug 781333 and bug 781701
12
13Upstream-Status: Backport [https://git.gnome.org/browse/libxml2/commit/?id=932cc9896ab41475d4aa429c27d9afd175959d74]
14CVE: CVE-2017-9047 CVE-2017-9048
15Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
16
17diff --git a/result/valid/781333.xml b/result/valid/781333.xml
18new file mode 100644
19index 0000000..01baf11
20--- /dev/null
21+++ b/result/valid/781333.xml
22@@ -0,0 +1,5 @@
23+<?xml version="1.0"?>
24+<!DOCTYPE a [
25+<!ELEMENT a (pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp:llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll)>
26+]>
27+<a/>
28diff --git a/result/valid/781333.xml.err b/result/valid/781333.xml.err
29new file mode 100644
30index 0000000..2176200
31--- /dev/null
32+++ b/result/valid/781333.xml.err
33@@ -0,0 +1,3 @@
34+./test/valid/781333.xml:4: element a: validity error : Element a content does not follow the DTD, expecting ( ..., got
35+<a/>
36+ ^
37diff --git a/result/valid/781333.xml.err.rdr b/result/valid/781333.xml.err.rdr
38new file mode 100644
39index 0000000..1195a04
40--- /dev/null
41+++ b/result/valid/781333.xml.err.rdr
42@@ -0,0 +1,6 @@
43+./test/valid/781333.xml:4: element a: validity error : Element a content does not follow the DTD, expecting ( ..., got
44+<a/>
45+ ^
46+./test/valid/781333.xml:5: element a: validity error : Element a content does not follow the DTD, Expecting more child
47+
48+^
49diff --git a/test/valid/781333.xml b/test/valid/781333.xml
50new file mode 100644
51index 0000000..bceac9c
52--- /dev/null
53+++ b/test/valid/781333.xml
54@@ -0,0 +1,4 @@
55+<!DOCTYPE a [
56+ <!ELEMENT a (pppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp:llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll)>
57+]>
58+<a/>
59diff --git a/valid.c b/valid.c
60index 19f84b8..aaa30f6 100644
61--- a/valid.c
62+++ b/valid.c
63@@ -1262,22 +1262,23 @@ xmlSnprintfElementContent(char *buf, int size, xmlElementContentPtr content, int
64 case XML_ELEMENT_CONTENT_PCDATA:
65 strcat(buf, "#PCDATA");
66 break;
67- case XML_ELEMENT_CONTENT_ELEMENT:
68+ case XML_ELEMENT_CONTENT_ELEMENT: {
69+ int qnameLen = xmlStrlen(content->name);
70+
71+ if (content->prefix != NULL)
72+ qnameLen += xmlStrlen(content->prefix) + 1;
73+ if (size - len < qnameLen + 10) {
74+ strcat(buf, " ...");
75+ return;
76+ }
77 if (content->prefix != NULL) {
78- if (size - len < xmlStrlen(content->prefix) + 10) {
79- strcat(buf, " ...");
80- return;
81- }
82 strcat(buf, (char *) content->prefix);
83 strcat(buf, ":");
84 }
85- if (size - len < xmlStrlen(content->name) + 10) {
86- strcat(buf, " ...");
87- return;
88- }
89 if (content->name != NULL)
90 strcat(buf, (char *) content->name);
91 break;
92+ }
93 case XML_ELEMENT_CONTENT_SEQ:
94 if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
95 (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
96@@ -1319,6 +1320,7 @@ xmlSnprintfElementContent(char *buf, int size, xmlElementContentPtr content, int
97 xmlSnprintfElementContent(buf, size, content->c2, 0);
98 break;
99 }
100+ if (size - strlen(buf) <= 2) return;
101 if (englob)
102 strcat(buf, ")");
103 switch (content->ocur) {
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9049_CVE-2017-9050.patch b/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9049_CVE-2017-9050.patch
deleted file mode 100644
index 591075de3c..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-CVE-2017-9049_CVE-2017-9050.patch
+++ /dev/null
@@ -1,291 +0,0 @@
1libxml2-2.9.4: Fix CVE-2017-9049 and CVE-2017-9050
2
3[No upstream tracking] -- https://bugzilla.gnome.org/show_bug.cgi?id=781205
4 -- https://bugzilla.gnome.org/show_bug.cgi?id=781361
5
6parser: Fix handling of parameter-entity references
7
8There were two bugs where parameter-entity references could lead to an
9unexpected change of the input buffer in xmlParseNameComplex and
10xmlDictLookup being called with an invalid pointer.
11
12Percent sign in DTD Names
13=========================
14
15The NEXTL macro used to call xmlParserHandlePEReference. When parsing
16"complex" names inside the DTD, this could result in entity expansion
17which created a new input buffer. The fix is to simply remove the call
18to xmlParserHandlePEReference from the NEXTL macro. This is safe because
19no users of the macro require expansion of parameter entities.
20
21- xmlParseNameComplex
22- xmlParseNCNameComplex
23- xmlParseNmtoken
24
25The percent sign is not allowed in names, which are grammatical tokens.
26
27- xmlParseEntityValue
28
29Parameter-entity references in entity values are expanded but this
30happens in a separate step in this function.
31
32- xmlParseSystemLiteral
33
34Parameter-entity references are ignored in the system literal.
35
36- xmlParseAttValueComplex
37- xmlParseCharDataComplex
38- xmlParseCommentComplex
39- xmlParsePI
40- xmlParseCDSect
41
42Parameter-entity references are ignored outside the DTD.
43
44- xmlLoadEntityContent
45
46This function is only called from xmlStringLenDecodeEntities and
47entities are replaced in a separate step immediately after the function
48call.
49
50This bug could also be triggered with an internal subset and double
51entity expansion.
52
53This fixes bug 766956 initially reported by Wei Lei and independently by
54Chromium's ClusterFuzz, Hanno Böck, and Marco Grassi. Thanks to everyone
55involved.
56
57xmlParseNameComplex with XML_PARSE_OLD10
58========================================
59
60When parsing Names inside an expanded parameter entity with the
61XML_PARSE_OLD10 option, xmlParseNameComplex would call xmlGROW via the
62GROW macro if the input buffer was exhausted. At the end of the
63parameter entity's replacement text, this function would then call
64xmlPopInput which invalidated the input buffer.
65
66There should be no need to invoke GROW in this situation because the
67buffer is grown periodically every XML_PARSER_CHUNK_SIZE characters and,
68at least for UTF-8, in xmlCurrentChar. This also matches the code path
69executed when XML_PARSE_OLD10 is not set.
70
71This fixes bugs 781205 (CVE-2017-9049) and 781361 (CVE-2017-9050).
72Thanks to Marcel Böhme and Thuan Pham for the report.
73
74Additional hardening
75====================
76
77A separate check was added in xmlParseNameComplex to validate the
78buffer size.
79
80Fixes bug 781205 and bug 781361
81
82Upstream-Status: Backport [https://git.gnome.org/browse/libxml2/commit/?id=932cc9896ab41475d4aa429c27d9afd175959d74]
83CVE: CVE-2017-9049 CVE-2017-9050
84Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
85
86diff --git a/Makefile.am b/Makefile.am
87index 9f988b0..dab15a4 100644
88--- a/Makefile.am
89+++ b/Makefile.am
90@@ -422,6 +422,24 @@ Errtests : xmllint$(EXEEXT)
91 if [ -n "$$log" ] ; then echo $$name result ; echo $$log ; fi ; \
92 rm result.$$name error.$$name ; \
93 fi ; fi ; done)
94+ @echo "## Error cases regression tests (old 1.0)"
95+ -@(for i in $(srcdir)/test/errors10/*.xml ; do \
96+ name=`basename $$i`; \
97+ if [ ! -d $$i ] ; then \
98+ if [ ! -f $(srcdir)/result/errors10/$$name ] ; then \
99+ echo New test file $$name ; \
100+ $(CHECKER) $(top_builddir)/xmllint --oldxml10 $$i \
101+ 2> $(srcdir)/result/errors10/$$name.err \
102+ > $(srcdir)/result/errors10/$$name ; \
103+ grep "MORY ALLO" .memdump | grep -v "MEMORY ALLOCATED : 0"; \
104+ else \
105+ log=`$(CHECKER) $(top_builddir)/xmllint --oldxml10 $$i 2> error.$$name > result.$$name ; \
106+ grep "MORY ALLO" .memdump | grep -v "MEMORY ALLOCATED : 0"; \
107+ diff $(srcdir)/result/errors10/$$name result.$$name ; \
108+ diff $(srcdir)/result/errors10/$$name.err error.$$name` ; \
109+ if [ -n "$$log" ] ; then echo $$name result ; echo "$$log" ; fi ; \
110+ rm result.$$name error.$$name ; \
111+ fi ; fi ; done)
112 @echo "## Error cases stream regression tests"
113 -@(for i in $(srcdir)/test/errors/*.xml ; do \
114 name=`basename $$i`; \
115diff --git a/parser.c b/parser.c
116index 609a270..8e11c12 100644
117--- a/parser.c
118+++ b/parser.c
119@@ -2115,7 +2115,6 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
120 ctxt->input->line++; ctxt->input->col = 1; \
121 } else ctxt->input->col++; \
122 ctxt->input->cur += l; \
123- if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt); \
124 } while (0)
125
126 #define CUR_CHAR(l) xmlCurrentChar(ctxt, &l)
127@@ -3406,13 +3405,6 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
128 len += l;
129 NEXTL(l);
130 c = CUR_CHAR(l);
131- if (c == 0) {
132- count = 0;
133- GROW;
134- if (ctxt->instate == XML_PARSER_EOF)
135- return(NULL);
136- c = CUR_CHAR(l);
137- }
138 }
139 }
140 if ((len > XML_MAX_NAME_LENGTH) &&
141@@ -3420,6 +3412,16 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
142 xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");
143 return(NULL);
144 }
145+ if (ctxt->input->cur - ctxt->input->base < len) {
146+ /*
147+ * There were a couple of bugs where PERefs lead to to a change
148+ * of the buffer. Check the buffer size to avoid passing an invalid
149+ * pointer to xmlDictLookup.
150+ */
151+ xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
152+ "unexpected change of input buffer");
153+ return (NULL);
154+ }
155 if ((*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r'))
156 return(xmlDictLookup(ctxt->dict, ctxt->input->cur - (len + 1), len));
157 return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
158diff --git a/result/errors10/781205.xml b/result/errors10/781205.xml
159new file mode 100644
160index 0000000..e69de29
161diff --git a/result/errors10/781205.xml.err b/result/errors10/781205.xml.err
162new file mode 100644
163index 0000000..da15c3f
164--- /dev/null
165+++ b/result/errors10/781205.xml.err
166@@ -0,0 +1,21 @@
167+Entity: line 1: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration
168+
169+ %a;
170+ ^
171+Entity: line 1:
172+<:0000
173+^
174+Entity: line 1: parser error : DOCTYPE improperly terminated
175+ %a;
176+ ^
177+Entity: line 1:
178+<:0000
179+^
180+namespace error : Failed to parse QName ':0000'
181+ %a;
182+ ^
183+<:0000
184+ ^
185+./test/errors10/781205.xml:4: parser error : Couldn't find end of Start Tag :0000 line 1
186+
187+^
188diff --git a/result/errors10/781361.xml b/result/errors10/781361.xml
189new file mode 100644
190index 0000000..e69de29
191diff --git a/result/errors10/781361.xml.err b/result/errors10/781361.xml.err
192new file mode 100644
193index 0000000..655f41a
194--- /dev/null
195+++ b/result/errors10/781361.xml.err
196@@ -0,0 +1,13 @@
197+./test/errors10/781361.xml:4: parser error : xmlParseElementDecl: 'EMPTY', 'ANY' or '(' expected
198+
199+^
200+./test/errors10/781361.xml:4: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration
201+
202+
203+^
204+./test/errors10/781361.xml:4: parser error : DOCTYPE improperly terminated
205+
206+^
207+./test/errors10/781361.xml:4: parser error : Start tag expected, '<' not found
208+
209+^
210diff --git a/result/valid/766956.xml b/result/valid/766956.xml
211new file mode 100644
212index 0000000..e69de29
213diff --git a/result/valid/766956.xml.err b/result/valid/766956.xml.err
214new file mode 100644
215index 0000000..34b1dae
216--- /dev/null
217+++ b/result/valid/766956.xml.err
218@@ -0,0 +1,9 @@
219+test/valid/dtds/766956.dtd:2: parser error : PEReference: expecting ';'
220+%ä%ent;
221+ ^
222+Entity: line 1: parser error : Content error in the external subset
223+ %ent;
224+ ^
225+Entity: line 1:
226+value
227+^
228diff --git a/result/valid/766956.xml.err.rdr b/result/valid/766956.xml.err.rdr
229new file mode 100644
230index 0000000..7760346
231--- /dev/null
232+++ b/result/valid/766956.xml.err.rdr
233@@ -0,0 +1,10 @@
234+test/valid/dtds/766956.dtd:2: parser error : PEReference: expecting ';'
235+%ä%ent;
236+ ^
237+Entity: line 1: parser error : Content error in the external subset
238+ %ent;
239+ ^
240+Entity: line 1:
241+value
242+^
243+./test/valid/766956.xml : failed to parse
244diff --git a/runtest.c b/runtest.c
245index bb74d2a..63e8c20 100644
246--- a/runtest.c
247+++ b/runtest.c
248@@ -4202,6 +4202,9 @@ testDesc testDescriptions[] = {
249 { "Error cases regression tests",
250 errParseTest, "./test/errors/*.xml", "result/errors/", "", ".err",
251 0 },
252+ { "Error cases regression tests (old 1.0)",
253+ errParseTest, "./test/errors10/*.xml", "result/errors10/", "", ".err",
254+ XML_PARSE_OLD10 },
255 #ifdef LIBXML_READER_ENABLED
256 { "Error cases stream regression tests",
257 streamParseTest, "./test/errors/*.xml", "result/errors/", NULL, ".str",
258diff --git a/test/errors10/781205.xml b/test/errors10/781205.xml
259new file mode 100644
260index 0000000..d9e9e83
261--- /dev/null
262+++ b/test/errors10/781205.xml
263@@ -0,0 +1,3 @@
264+<!DOCTYPE D [
265+ <!ENTITY % a "<:0000">
266+ %a;
267diff --git a/test/errors10/781361.xml b/test/errors10/781361.xml
268new file mode 100644
269index 0000000..67476bc
270--- /dev/null
271+++ b/test/errors10/781361.xml
272@@ -0,0 +1,3 @@
273+<!DOCTYPE doc [
274+ <!ENTITY % elem "<!ELEMENT e0000000000">
275+ %elem;
276diff --git a/test/valid/766956.xml b/test/valid/766956.xml
277new file mode 100644
278index 0000000..19a95a0
279--- /dev/null
280+++ b/test/valid/766956.xml
281@@ -0,0 +1,2 @@
282+<!DOCTYPE test SYSTEM "dtds/766956.dtd">
283+<test/>
284diff --git a/test/valid/dtds/766956.dtd b/test/valid/dtds/766956.dtd
285new file mode 100644
286index 0000000..dddde68
287--- /dev/null
288+++ b/test/valid/dtds/766956.dtd
289@@ -0,0 +1,2 @@
290+<!ENTITY % ent "value">
291+%ä%ent;
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-fix_NULL_pointer_derefs.patch b/meta/recipes-core/libxml/libxml2/libxml2-fix_NULL_pointer_derefs.patch
deleted file mode 100644
index c60e32f656..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-fix_NULL_pointer_derefs.patch
+++ /dev/null
@@ -1,45 +0,0 @@
1libxml2-2.9.4: Fix more NULL pointer derefs
2
3xpointer: Fix more NULL pointer derefs
4
5Upstream-Status: Backport [https://git.gnome.org/browse/libxml2/commit/?id=e905f08123e4a6e7731549e6f09dadff4cab65bd]
6Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
7Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
8
9diff --git a/xpointer.c b/xpointer.c
10index 676c510..074db24 100644
11--- a/xpointer.c
12+++ b/xpointer.c
13@@ -555,7 +555,7 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) {
14 /*
15 * Empty set ...
16 */
17- if (end->nodesetval->nodeNr <= 0)
18+ if ((end->nodesetval == NULL) || (end->nodesetval->nodeNr <= 0))
19 return(NULL);
20 break;
21 default:
22@@ -1400,7 +1400,7 @@ xmlXPtrEval(const xmlChar *str, xmlXPathContextPtr ctx) {
23 */
24 xmlNodeSetPtr set;
25 set = tmp->nodesetval;
26- if ((set->nodeNr != 1) ||
27+ if ((set == NULL) || (set->nodeNr != 1) ||
28 (set->nodeTab[0] != (xmlNodePtr) ctx->doc))
29 stack++;
30 } else
31@@ -2073,9 +2073,11 @@ xmlXPtrRangeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
32 xmlXPathFreeObject(set);
33 XP_ERROR(XPATH_MEMORY_ERROR);
34 }
35- for (i = 0;i < oldset->locNr;i++) {
36- xmlXPtrLocationSetAdd(newset,
37- xmlXPtrCoveringRange(ctxt, oldset->locTab[i]));
38+ if (oldset != NULL) {
39+ for (i = 0;i < oldset->locNr;i++) {
40+ xmlXPtrLocationSetAdd(newset,
41+ xmlXPtrCoveringRange(ctxt, oldset->locTab[i]));
42+ }
43 }
44
45 /*
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-fix_and_simplify_xmlParseStartTag2.patch b/meta/recipes-core/libxml/libxml2/libxml2-fix_and_simplify_xmlParseStartTag2.patch
deleted file mode 100644
index faa57701f5..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-fix_and_simplify_xmlParseStartTag2.patch
+++ /dev/null
@@ -1,590 +0,0 @@
1libxml2-2.9.4: Avoid reparsing and simplify control flow in xmlParseStartTag2
2
3[No upstream tracking]
4
5parser: Avoid reparsing in xmlParseStartTag2
6
7The code in xmlParseStartTag2 must handle the case that the input
8buffer was grown and reallocated which can invalidate pointers to
9attribute values. Before, this was handled by detecting changes of
10the input buffer "base" pointer and, in case of a change, jumping
11back to the beginning of the function and reparsing the start tag.
12
13The major problem of this approach is that whether an input buffer is
14reallocated is nondeterministic, resulting in seemingly random test
15failures. See the mailing list thread "runtest mystery bug: name2.xml
16error case regression test" from 2012, for example.
17
18If a reallocation was detected, the code also made no attempts to
19continue parsing in case of errors which makes a difference in
20the lax "recover" mode.
21
22Now we store the current input buffer "base" pointer for each (not
23separately allocated) attribute in the namespace URI field, which isn't
24used until later. After the whole start tag was parsed, the pointers to
25the attribute values are reconstructed using the offset between the
26new and the old input buffer. This relies on arithmetic on dangling
27pointers which is technically undefined behavior. But it seems like
28the easiest and most efficient fix and a similar approach is used in
29xmlParserInputGrow.
30
31This changes the error output of several tests, typically making it
32more verbose because we try harder to continue parsing in case of errors.
33
34(Another possible solution is to check not only the "base" pointer
35but the size of the input buffer as well. But this would result in
36even more reparsing.)
37
38Remove some goto labels and deduplicate a bit of code after handling
39namespaces.
40
41There were two bugs where parameter-entity references could lead to an
42unexpected change of the input buffer in xmlParseNameComplex and
43xmlDictLookup being called with an invalid pointer.
44
45
46Upstream-Status: Backport
47 - [https://git.gnome.org/browse/libxml2/commit/?id=07b7428b69c368611d215a140fe630b2d1e61349]
48 - [https://git.gnome.org/browse/libxml2/commit/?id=855c19efb7cd30d927d673b3658563c4959ca6f0]
49Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
50
51diff --git a/parser.c b/parser.c
52index 609a270..74016e3 100644
53--- a/parser.c
54+++ b/parser.c
55@@ -43,6 +43,7 @@
56 #include <limits.h>
57 #include <string.h>
58 #include <stdarg.h>
59+#include <stddef.h>
60 #include <libxml/xmlmemory.h>
61 #include <libxml/threads.h>
62 #include <libxml/globals.h>
63@@ -9377,8 +9378,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
64 const xmlChar **atts = ctxt->atts;
65 int maxatts = ctxt->maxatts;
66 int nratts, nbatts, nbdef;
67- int i, j, nbNs, attval, oldline, oldcol, inputNr;
68- const xmlChar *base;
69+ int i, j, nbNs, attval;
70 unsigned long cur;
71 int nsNr = ctxt->nsNr;
72
73@@ -9392,13 +9392,8 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
74 * The Shrinking is only possible once the full set of attribute
75 * callbacks have been done.
76 */
77-reparse:
78 SHRINK;
79- base = ctxt->input->base;
80 cur = ctxt->input->cur - ctxt->input->base;
81- inputNr = ctxt->inputNr;
82- oldline = ctxt->input->line;
83- oldcol = ctxt->input->col;
84 nbatts = 0;
85 nratts = 0;
86 nbdef = 0;
87@@ -9422,8 +9417,6 @@ reparse:
88 */
89 SKIP_BLANKS;
90 GROW;
91- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
92- goto base_changed;
93
94 while (((RAW != '>') &&
95 ((RAW != '/') || (NXT(1) != '>')) &&
96@@ -9434,203 +9427,174 @@ reparse:
97
98 attname = xmlParseAttribute2(ctxt, prefix, localname,
99 &aprefix, &attvalue, &len, &alloc);
100- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
101- if ((attvalue != NULL) && (alloc != 0))
102- xmlFree(attvalue);
103- attvalue = NULL;
104- goto base_changed;
105- }
106- if ((attname != NULL) && (attvalue != NULL)) {
107- if (len < 0) len = xmlStrlen(attvalue);
108- if ((attname == ctxt->str_xmlns) && (aprefix == NULL)) {
109- const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
110- xmlURIPtr uri;
111-
112- if (URL == NULL) {
113- xmlErrMemory(ctxt, "dictionary allocation failure");
114- if ((attvalue != NULL) && (alloc != 0))
115- xmlFree(attvalue);
116- return(NULL);
117- }
118- if (*URL != 0) {
119- uri = xmlParseURI((const char *) URL);
120- if (uri == NULL) {
121- xmlNsErr(ctxt, XML_WAR_NS_URI,
122- "xmlns: '%s' is not a valid URI\n",
123- URL, NULL, NULL);
124- } else {
125- if (uri->scheme == NULL) {
126- xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,
127- "xmlns: URI %s is not absolute\n",
128- URL, NULL, NULL);
129- }
130- xmlFreeURI(uri);
131- }
132- if (URL == ctxt->str_xml_ns) {
133- if (attname != ctxt->str_xml) {
134- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
135- "xml namespace URI cannot be the default namespace\n",
136- NULL, NULL, NULL);
137- }
138- goto skip_default_ns;
139- }
140- if ((len == 29) &&
141- (xmlStrEqual(URL,
142- BAD_CAST "http://www.w3.org/2000/xmlns/"))) {
143- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
144- "reuse of the xmlns namespace name is forbidden\n",
145- NULL, NULL, NULL);
146- goto skip_default_ns;
147- }
148- }
149- /*
150- * check that it's not a defined namespace
151- */
152- for (j = 1;j <= nbNs;j++)
153- if (ctxt->nsTab[ctxt->nsNr - 2 * j] == NULL)
154- break;
155- if (j <= nbNs)
156- xmlErrAttributeDup(ctxt, NULL, attname);
157- else
158- if (nsPush(ctxt, NULL, URL) > 0) nbNs++;
159-skip_default_ns:
160- if ((attvalue != NULL) && (alloc != 0)) {
161- xmlFree(attvalue);
162- attvalue = NULL;
163- }
164- if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
165- break;
166- if (!IS_BLANK_CH(RAW)) {
167- xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
168- "attributes construct error\n");
169- break;
170- }
171- SKIP_BLANKS;
172- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
173- goto base_changed;
174- continue;
175- }
176- if (aprefix == ctxt->str_xmlns) {
177- const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
178- xmlURIPtr uri;
179-
180- if (attname == ctxt->str_xml) {
181- if (URL != ctxt->str_xml_ns) {
182- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
183- "xml namespace prefix mapped to wrong URI\n",
184- NULL, NULL, NULL);
185- }
186- /*
187- * Do not keep a namespace definition node
188- */
189- goto skip_ns;
190- }
191+ if ((attname == NULL) || (attvalue == NULL))
192+ goto next_attr;
193+ if (len < 0) len = xmlStrlen(attvalue);
194+
195+ if ((attname == ctxt->str_xmlns) && (aprefix == NULL)) {
196+ const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
197+ xmlURIPtr uri;
198+
199+ if (URL == NULL) {
200+ xmlErrMemory(ctxt, "dictionary allocation failure");
201+ if ((attvalue != NULL) && (alloc != 0))
202+ xmlFree(attvalue);
203+ return(NULL);
204+ }
205+ if (*URL != 0) {
206+ uri = xmlParseURI((const char *) URL);
207+ if (uri == NULL) {
208+ xmlNsErr(ctxt, XML_WAR_NS_URI,
209+ "xmlns: '%s' is not a valid URI\n",
210+ URL, NULL, NULL);
211+ } else {
212+ if (uri->scheme == NULL) {
213+ xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,
214+ "xmlns: URI %s is not absolute\n",
215+ URL, NULL, NULL);
216+ }
217+ xmlFreeURI(uri);
218+ }
219 if (URL == ctxt->str_xml_ns) {
220- if (attname != ctxt->str_xml) {
221- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
222- "xml namespace URI mapped to wrong prefix\n",
223- NULL, NULL, NULL);
224- }
225- goto skip_ns;
226- }
227- if (attname == ctxt->str_xmlns) {
228- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
229- "redefinition of the xmlns prefix is forbidden\n",
230- NULL, NULL, NULL);
231- goto skip_ns;
232- }
233- if ((len == 29) &&
234- (xmlStrEqual(URL,
235- BAD_CAST "http://www.w3.org/2000/xmlns/"))) {
236- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
237- "reuse of the xmlns namespace name is forbidden\n",
238- NULL, NULL, NULL);
239- goto skip_ns;
240- }
241- if ((URL == NULL) || (URL[0] == 0)) {
242- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
243- "xmlns:%s: Empty XML namespace is not allowed\n",
244- attname, NULL, NULL);
245- goto skip_ns;
246- } else {
247- uri = xmlParseURI((const char *) URL);
248- if (uri == NULL) {
249- xmlNsErr(ctxt, XML_WAR_NS_URI,
250- "xmlns:%s: '%s' is not a valid URI\n",
251- attname, URL, NULL);
252- } else {
253- if ((ctxt->pedantic) && (uri->scheme == NULL)) {
254- xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,
255- "xmlns:%s: URI %s is not absolute\n",
256- attname, URL, NULL);
257- }
258- xmlFreeURI(uri);
259- }
260- }
261-
262- /*
263- * check that it's not a defined namespace
264- */
265- for (j = 1;j <= nbNs;j++)
266- if (ctxt->nsTab[ctxt->nsNr - 2 * j] == attname)
267- break;
268- if (j <= nbNs)
269- xmlErrAttributeDup(ctxt, aprefix, attname);
270- else
271- if (nsPush(ctxt, attname, URL) > 0) nbNs++;
272-skip_ns:
273- if ((attvalue != NULL) && (alloc != 0)) {
274- xmlFree(attvalue);
275- attvalue = NULL;
276- }
277- if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
278- break;
279- if (!IS_BLANK_CH(RAW)) {
280- xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
281- "attributes construct error\n");
282- break;
283- }
284- SKIP_BLANKS;
285- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
286- goto base_changed;
287- continue;
288- }
289+ if (attname != ctxt->str_xml) {
290+ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
291+ "xml namespace URI cannot be the default namespace\n",
292+ NULL, NULL, NULL);
293+ }
294+ goto next_attr;
295+ }
296+ if ((len == 29) &&
297+ (xmlStrEqual(URL,
298+ BAD_CAST "http://www.w3.org/2000/xmlns/"))) {
299+ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
300+ "reuse of the xmlns namespace name is forbidden\n",
301+ NULL, NULL, NULL);
302+ goto next_attr;
303+ }
304+ }
305+ /*
306+ * check that it's not a defined namespace
307+ */
308+ for (j = 1;j <= nbNs;j++)
309+ if (ctxt->nsTab[ctxt->nsNr - 2 * j] == NULL)
310+ break;
311+ if (j <= nbNs)
312+ xmlErrAttributeDup(ctxt, NULL, attname);
313+ else
314+ if (nsPush(ctxt, NULL, URL) > 0) nbNs++;
315+
316+ } else if (aprefix == ctxt->str_xmlns) {
317+ const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
318+ xmlURIPtr uri;
319+
320+ if (attname == ctxt->str_xml) {
321+ if (URL != ctxt->str_xml_ns) {
322+ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
323+ "xml namespace prefix mapped to wrong URI\n",
324+ NULL, NULL, NULL);
325+ }
326+ /*
327+ * Do not keep a namespace definition node
328+ */
329+ goto next_attr;
330+ }
331+ if (URL == ctxt->str_xml_ns) {
332+ if (attname != ctxt->str_xml) {
333+ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
334+ "xml namespace URI mapped to wrong prefix\n",
335+ NULL, NULL, NULL);
336+ }
337+ goto next_attr;
338+ }
339+ if (attname == ctxt->str_xmlns) {
340+ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
341+ "redefinition of the xmlns prefix is forbidden\n",
342+ NULL, NULL, NULL);
343+ goto next_attr;
344+ }
345+ if ((len == 29) &&
346+ (xmlStrEqual(URL,
347+ BAD_CAST "http://www.w3.org/2000/xmlns/"))) {
348+ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
349+ "reuse of the xmlns namespace name is forbidden\n",
350+ NULL, NULL, NULL);
351+ goto next_attr;
352+ }
353+ if ((URL == NULL) || (URL[0] == 0)) {
354+ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
355+ "xmlns:%s: Empty XML namespace is not allowed\n",
356+ attname, NULL, NULL);
357+ goto next_attr;
358+ } else {
359+ uri = xmlParseURI((const char *) URL);
360+ if (uri == NULL) {
361+ xmlNsErr(ctxt, XML_WAR_NS_URI,
362+ "xmlns:%s: '%s' is not a valid URI\n",
363+ attname, URL, NULL);
364+ } else {
365+ if ((ctxt->pedantic) && (uri->scheme == NULL)) {
366+ xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,
367+ "xmlns:%s: URI %s is not absolute\n",
368+ attname, URL, NULL);
369+ }
370+ xmlFreeURI(uri);
371+ }
372+ }
373
374- /*
375- * Add the pair to atts
376- */
377- if ((atts == NULL) || (nbatts + 5 > maxatts)) {
378- if (xmlCtxtGrowAttrs(ctxt, nbatts + 5) < 0) {
379- if (attvalue[len] == 0)
380- xmlFree(attvalue);
381- goto failed;
382- }
383- maxatts = ctxt->maxatts;
384- atts = ctxt->atts;
385- }
386- ctxt->attallocs[nratts++] = alloc;
387- atts[nbatts++] = attname;
388- atts[nbatts++] = aprefix;
389- atts[nbatts++] = NULL; /* the URI will be fetched later */
390- atts[nbatts++] = attvalue;
391- attvalue += len;
392- atts[nbatts++] = attvalue;
393- /*
394- * tag if some deallocation is needed
395- */
396- if (alloc != 0) attval = 1;
397- } else {
398- if ((attvalue != NULL) && (attvalue[len] == 0))
399- xmlFree(attvalue);
400- }
401+ /*
402+ * check that it's not a defined namespace
403+ */
404+ for (j = 1;j <= nbNs;j++)
405+ if (ctxt->nsTab[ctxt->nsNr - 2 * j] == attname)
406+ break;
407+ if (j <= nbNs)
408+ xmlErrAttributeDup(ctxt, aprefix, attname);
409+ else
410+ if (nsPush(ctxt, attname, URL) > 0) nbNs++;
411+
412+ } else {
413+ /*
414+ * Add the pair to atts
415+ */
416+ if ((atts == NULL) || (nbatts + 5 > maxatts)) {
417+ if (xmlCtxtGrowAttrs(ctxt, nbatts + 5) < 0) {
418+ goto next_attr;
419+ }
420+ maxatts = ctxt->maxatts;
421+ atts = ctxt->atts;
422+ }
423+ ctxt->attallocs[nratts++] = alloc;
424+ atts[nbatts++] = attname;
425+ atts[nbatts++] = aprefix;
426+ /*
427+ * The namespace URI field is used temporarily to point at the
428+ * base of the current input buffer for non-alloced attributes.
429+ * When the input buffer is reallocated, all the pointers become
430+ * invalid, but they can be reconstructed later.
431+ */
432+ if (alloc)
433+ atts[nbatts++] = NULL;
434+ else
435+ atts[nbatts++] = ctxt->input->base;
436+ atts[nbatts++] = attvalue;
437+ attvalue += len;
438+ atts[nbatts++] = attvalue;
439+ /*
440+ * tag if some deallocation is needed
441+ */
442+ if (alloc != 0) attval = 1;
443+ attvalue = NULL; /* moved into atts */
444+ }
445
446-failed:
447+next_attr:
448+ if ((attvalue != NULL) && (alloc != 0)) {
449+ xmlFree(attvalue);
450+ attvalue = NULL;
451+ }
452
453 GROW
454 if (ctxt->instate == XML_PARSER_EOF)
455 break;
456- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
457- goto base_changed;
458 if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
459 break;
460 if (!IS_BLANK_CH(RAW)) {
461@@ -9646,8 +9610,20 @@ failed:
462 break;
463 }
464 GROW;
465- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
466- goto base_changed;
467+ }
468+
469+ /* Reconstruct attribute value pointers. */
470+ for (i = 0, j = 0; j < nratts; i += 5, j++) {
471+ if (atts[i+2] != NULL) {
472+ /*
473+ * Arithmetic on dangling pointers is technically undefined
474+ * behavior, but well...
475+ */
476+ ptrdiff_t offset = ctxt->input->base - atts[i+2];
477+ atts[i+2] = NULL; /* Reset repurposed namespace URI */
478+ atts[i+3] += offset; /* value */
479+ atts[i+4] += offset; /* valuend */
480+ }
481 }
482
483 /*
484@@ -9804,34 +9780,6 @@ failed:
485 }
486
487 return(localname);
488-
489-base_changed:
490- /*
491- * the attribute strings are valid iif the base didn't changed
492- */
493- if (attval != 0) {
494- for (i = 3,j = 0; j < nratts;i += 5,j++)
495- if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
496- xmlFree((xmlChar *) atts[i]);
497- }
498-
499- /*
500- * We can't switch from one entity to another in the middle
501- * of a start tag
502- */
503- if (inputNr != ctxt->inputNr) {
504- xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
505- "Start tag doesn't start and stop in the same entity\n");
506- return(NULL);
507- }
508-
509- ctxt->input->cur = ctxt->input->base + cur;
510- ctxt->input->line = oldline;
511- ctxt->input->col = oldcol;
512- if (ctxt->wellFormed == 1) {
513- goto reparse;
514- }
515- return(NULL);
516 }
517
518 /**
519diff --git a/result/errors/759398.xml.err b/result/errors/759398.xml.err
520index e08d9bf..f6036a3 100644
521--- a/result/errors/759398.xml.err
522+++ b/result/errors/759398.xml.err
523@@ -1,9 +1,12 @@
524 ./test/errors/759398.xml:210: parser error : StartTag: invalid element name
525 need to worry about parsers whi<! don't expand PErefs finding
526 ^
527-./test/errors/759398.xml:309: parser error : Opening and ending tag mismatch: spec line 50 and termdef
528+./test/errors/759398.xml:309: parser error : Opening and ending tag mismatch: №№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№m line 308 and termdef
529 and provide access to their content and structure.</termdef> <termdef
530 ^
531-./test/errors/759398.xml:309: parser error : Extra content at the end of the document
532-and provide access to their content and structure.</termdef> <termdef
533- ^
534+./test/errors/759398.xml:314: parser error : Opening and ending tag mismatch: spec line 50 and p
535+data and the information it must provide to the application.</p>
536+ ^
537+./test/errors/759398.xml:316: parser error : Extra content at the end of the document
538+<div2 id='sec-origin-goals'>
539+^
540diff --git a/result/errors/attr1.xml.err b/result/errors/attr1.xml.err
541index 4f08538..c4c4fc8 100644
542--- a/result/errors/attr1.xml.err
543+++ b/result/errors/attr1.xml.err
544@@ -1,6 +1,9 @@
545 ./test/errors/attr1.xml:2: parser error : AttValue: ' expected
546
547 ^
548-./test/errors/attr1.xml:1: parser error : Extra content at the end of the document
549-<foo foo="oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
550- ^
551+./test/errors/attr1.xml:2: parser error : attributes construct error
552+
553+^
554+./test/errors/attr1.xml:2: parser error : Couldn't find end of Start Tag foo line 1
555+
556+^
557diff --git a/result/errors/attr2.xml.err b/result/errors/attr2.xml.err
558index c8a9c7d..77e342e 100644
559--- a/result/errors/attr2.xml.err
560+++ b/result/errors/attr2.xml.err
561@@ -1,6 +1,9 @@
562 ./test/errors/attr2.xml:2: parser error : AttValue: ' expected
563
564 ^
565-./test/errors/attr2.xml:1: parser error : Extra content at the end of the document
566-<foo foo=">ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
567- ^
568+./test/errors/attr2.xml:2: parser error : attributes construct error
569+
570+^
571+./test/errors/attr2.xml:2: parser error : Couldn't find end of Start Tag foo line 1
572+
573+^
574diff --git a/result/errors/name2.xml.err b/result/errors/name2.xml.err
575index a6649a1..8a6acee 100644
576--- a/result/errors/name2.xml.err
577+++ b/result/errors/name2.xml.err
578@@ -1,6 +1,9 @@
579 ./test/errors/name2.xml:2: parser error : Specification mandate value for attribute foooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
580
581 ^
582-./test/errors/name2.xml:1: parser error : Extra content at the end of the document
583-<foo foooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
584- ^
585+./test/errors/name2.xml:2: parser error : attributes construct error
586+
587+^
588+./test/errors/name2.xml:2: parser error : Couldn't find end of Start Tag foo line 1
589+
590+^
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch b/meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch
deleted file mode 100644
index 65f6bef1e6..0000000000
--- a/meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch
+++ /dev/null
@@ -1,67 +0,0 @@
1libxml2-2.9.4: Fix comparison with root node in xmlXPathCmpNodes and NULL pointer deref in XPointer
2
3xpath:
4 - Check for errors after evaluating first operand.
5 - Add sanity check for empty stack.
6 - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes
7
8Upstream-Status: Backport
9 - [https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b]
10 - [https://git.gnome.org/browse/libxml2/commit/?id=a005199330b86dada19d162cae15ef9bdcb6baa8]
11CVE: CVE-2016-5131
12Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
13Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
14
15diff --git a/result/XPath/xptr/viderror b/result/XPath/xptr/viderror
16new file mode 100644
17index 0000000..d589882
18--- /dev/null
19+++ b/result/XPath/xptr/viderror
20@@ -0,0 +1,4 @@
21+
22+========================
23+Expression: xpointer(non-existing-fn()/range-to(id('chapter2')))
24+Object is empty (NULL)
25diff --git a/test/XPath/xptr/viderror b/test/XPath/xptr/viderror
26new file mode 100644
27index 0000000..da8c53b
28--- /dev/null
29+++ b/test/XPath/xptr/viderror
30@@ -0,0 +1 @@
31+xpointer(non-existing-fn()/range-to(id('chapter2')))
32diff --git a/xpath.c b/xpath.c
33index 113bce6..d992841 100644
34--- a/xpath.c
35+++ b/xpath.c
36@@ -3342,13 +3342,13 @@ xmlXPathCmpNodes(xmlNodePtr node1, xmlNodePtr node2) {
37 * compute depth to root
38 */
39 for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {
40- if (cur == node1)
41+ if (cur->parent == node1)
42 return(1);
43 depth2++;
44 }
45 root = cur;
46 for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {
47- if (cur == node2)
48+ if (cur->parent == node2)
49 return(-1);
50 depth1++;
51 }
52@@ -14005,9 +14005,14 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
53 xmlNodeSetPtr oldset;
54 int i, j;
55
56- if (op->ch1 != -1)
57+ if (op->ch1 != -1) {
58 total +=
59 xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);
60+ CHECK_ERROR0;
61+ }
62+ if (ctxt->value == NULL) {
63+ XP_ERROR0(XPATH_INVALID_OPERAND);
64+ }
65 if (op->ch2 == -1)
66 return (total);
67
diff --git a/meta/recipes-core/libxml/libxml2/runtest.patch b/meta/recipes-core/libxml/libxml2/runtest.patch
index 6e56857caf..cb171d5b36 100644
--- a/meta/recipes-core/libxml/libxml2/runtest.patch
+++ b/meta/recipes-core/libxml/libxml2/runtest.patch
@@ -2,47 +2,29 @@ Add 'install-ptest' rule.
2Print a standard result line for each test. 2Print a standard result line for each test.
3 3
4Signed-off-by: Mihaela Sendrea <mihaela.sendrea@enea.com> 4Signed-off-by: Mihaela Sendrea <mihaela.sendrea@enea.com>
5Signed-off-by: Andrej Valek <andrej.valek@enea.com> 5Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
6Upstream-Status: Backport 6Upstream-Status: Backport
7 7
8diff -uNr a/Makefile.am b/Makefile.am 8diff -uNr a/Makefile.am b/Makefile.am
9--- a/Makefile.am 2016-05-22 03:49:02.000000000 +0200 9--- a/Makefile.am 2017-08-28 15:01:14.000000000 +0200
10+++ b/Makefile.am 2017-06-14 10:38:43.381305385 +0200 10+++ b/Makefile.am 2017-09-05 08:06:05.752287323 +0200
11@@ -202,10 +202,24 @@ 11@@ -202,6 +202,15 @@
12 #testOOM_DEPENDENCIES = $(DEPS) 12 #testOOM_DEPENDENCIES = $(DEPS)
13 #testOOM_LDADD= $(LDADDS) 13 #testOOM_LDADD= $(LDADDS)
14 14
15+install-ptest: 15+install-ptest:
16+ @(if [ -d .libs ] ; then cd .libs; fi; \ 16+ @(if [ -d .libs ] ; then cd .libs; fi; \
17+ install $(noinst_PROGRAMS) $(DESTDIR)) 17+ install $(check_PROGRAMS) $(DESTDIR))
18+ cp -r $(srcdir)/test $(DESTDIR) 18+ cp -r $(srcdir)/test $(DESTDIR)
19+ cp -r $(srcdir)/result $(DESTDIR) 19+ cp -r $(srcdir)/result $(DESTDIR)
20+ cp -r $(srcdir)/python $(DESTDIR) 20+ cp -r $(srcdir)/python $(DESTDIR)
21+ cp Makefile $(DESTDIR) 21+ cp Makefile $(DESTDIR)
22+ sed -i -e 's|^Makefile:|_Makefile:|' $(DESTDIR)/Makefile 22+ sed -i -e 's|^Makefile:|_Makefile:|' $(DESTDIR)/Makefile
23+ 23+
24 runtests: 24 runtests: runtest$(EXEEXT) testrecurse$(EXEEXT) testapi$(EXEEXT) \
25 testchar$(EXEEXT) testdict$(EXEEXT) runxmlconf$(EXEEXT)
25 [ -d test ] || $(LN_S) $(srcdir)/test . 26 [ -d test ] || $(LN_S) $(srcdir)/test .
26 [ -d result ] || $(LN_S) $(srcdir)/result . 27
27- $(CHECKER) ./runtest$(EXEEXT) && $(CHECKER) ./testrecurse$(EXEEXT) &&$(CHECKER) ./testapi$(EXEEXT) && $(CHECKER) ./testchar$(EXEEXT)&& $(CHECKER) ./testdict$(EXEEXT) && $(CHECKER) ./runxmlconf$(EXEEXT)
28+ $(CHECKER) ./runtest$(EXEEXT) && \
29+ $(CHECKER) ./testrecurse$(EXEEXT) && \
30+ ASAN_OPTIONS="$$ASAN_OPTIONS:detect_leaks=0" $(CHECKER) ./testapi$(EXEEXT) && \
31+ $(CHECKER) ./testchar$(EXEEXT) && \
32+ $(CHECKER) ./testdict$(EXEEXT) && \
33+ $(CHECKER) ./runxmlconf$(EXEEXT)
34 @(if [ "$(PYTHON_SUBDIR)" != "" ] ; then cd python ; \
35 $(MAKE) tests ; fi)
36
37@@ -229,7 +243,7 @@
38
39 APItests: testapi$(EXEEXT)
40 @echo "## Running the API regression tests this may take a little while"
41- -@($(CHECKER) $(top_builddir)/testapi -q)
42+ -@(ASAN_OPTIONS="$$ASAN_OPTIONS:detect_leaks=0" $(CHECKER) $(top_builddir)/testapi -q)
43
44 HTMLtests : testHTML$(EXEEXT)
45 @(echo > .memdump)
46diff -uNr a/runsuite.c b/runsuite.c 28diff -uNr a/runsuite.c b/runsuite.c
47--- a/runsuite.c 2013-04-12 16:17:11.462823238 +0200 29--- a/runsuite.c 2013-04-12 16:17:11.462823238 +0200
48+++ b/runsuite.c 2013-04-17 14:07:24.352693211 +0200 30+++ b/runsuite.c 2013-04-17 14:07:24.352693211 +0200
diff --git a/meta/recipes-core/libxml/libxml2_2.9.4.bb b/meta/recipes-core/libxml/libxml2_2.9.5.bb
index 9adb29cfdd..df060d7266 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.4.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.5.bb
@@ -19,21 +19,11 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
19 file://run-ptest \ 19 file://run-ptest \
20 file://python-sitepackages-dir.patch \ 20 file://python-sitepackages-dir.patch \
21 file://libxml-m4-use-pkgconfig.patch \ 21 file://libxml-m4-use-pkgconfig.patch \
22 file://libxml2-fix_node_comparison.patch \
23 file://libxml2-CVE-2016-5131.patch \
24 file://libxml2-CVE-2016-4658.patch \
25 file://libxml2-fix_NULL_pointer_derefs.patch \
26 file://libxml2-fix_and_simplify_xmlParseStartTag2.patch \
27 file://libxml2-CVE-2017-9047_CVE-2017-9048.patch \
28 file://libxml2-CVE-2017-9049_CVE-2017-9050.patch \
29 file://libxml2-CVE-2017-5969.patch \
30 file://libxml2-CVE-2017-0663.patch \
31 file://libxml2-CVE-2017-8872.patch \
32 file://0001-Make-ptest-run-the-python-tests-if-python-is-enabled.patch \ 22 file://0001-Make-ptest-run-the-python-tests-if-python-is-enabled.patch \
33 " 23 "
34 24
35SRC_URI[libtar.md5sum] = "ae249165c173b1ff386ee8ad676815f5" 25SRC_URI[libtar.md5sum] = "5ce0da9bdaa267b40c4ca36d35363b8b"
36SRC_URI[libtar.sha256sum] = "ffb911191e509b966deb55de705387f14156e1a56b21824357cdf0053233633c" 26SRC_URI[libtar.sha256sum] = "4031c1ecee9ce7ba4f313e91ef6284164885cdb69937a123f6a83bb6a72dcd38"
37SRC_URI[testtar.md5sum] = "ae3d1ebe000a3972afa104ca7f0e1b4a" 27SRC_URI[testtar.md5sum] = "ae3d1ebe000a3972afa104ca7f0e1b4a"
38SRC_URI[testtar.sha256sum] = "96151685cec997e1f9f3387e3626d61e6284d4d6e66e0e440c209286c03e9cc7" 28SRC_URI[testtar.sha256sum] = "96151685cec997e1f9f3387e3626d61e6284d4d6e66e0e440c209286c03e9cc7"
39 29
@@ -81,6 +71,10 @@ do_configure_prepend () {
81 find ${WORKDIR}/xmlconf/ -type f -exec chmod -x {} \+ 71 find ${WORKDIR}/xmlconf/ -type f -exec chmod -x {} \+
82} 72}
83 73
74do_compile_ptest() {
75 oe_runmake check-am
76}
77
84do_install_ptest () { 78do_install_ptest () {
85 cp -r ${WORKDIR}/xmlconf ${D}${PTEST_PATH} 79 cp -r ${WORKDIR}/xmlconf ${D}${PTEST_PATH}
86 if [ "${@bb.utils.filter('PACKAGECONFIG', 'python', d)}" ]; then 80 if [ "${@bb.utils.filter('PACKAGECONFIG', 'python', d)}" ]; then
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-03 14:12:16 +0000