summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2015-12-05 11:00:24 -0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-01-14 15:18:28 +0000
commit53f0290658256f57c6e5d24459763eb96db2c1c1 (patch)
tree72418d928f1be8f357fea8334a5a64462ccd5874 /meta
parentf4b0c49145450a97166ba341afaf708f1ac4d6d3 (diff)
downloadpoky-53f0290658256f57c6e5d24459763eb96db2c1c1.tar.gz
libxml2: security fix CVE-2015-5312
(From OE-Core rev: 8546fada29f2c8ec0111a15fe50d90d3f2518d52) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-core/libxml/libxml2.inc1
-rw-r--r--meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch39
2 files changed, 40 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2.inc b/meta/recipes-core/libxml/libxml2.inc
index a30f0b687e..b9ce0f0359 100644
--- a/meta/recipes-core/libxml/libxml2.inc
+++ b/meta/recipes-core/libxml/libxml2.inc
@@ -34,6 +34,7 @@ SRC_URI = "ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar \
34 file://0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch \ 34 file://0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch \
35 file://0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch \ 35 file://0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch \
36 file://0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch \ 36 file://0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch \
37 file://0001-CVE-2015-5312-Another-entity-expansion-issue.patch \
37 " 38 "
38 39
39BINCONFIG = "${bindir}/xml2-config" 40BINCONFIG = "${bindir}/xml2-config"
diff --git a/meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch b/meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch
new file mode 100644
index 0000000000..979618d2c4
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch
@@ -0,0 +1,39 @@
1From 69030714cde66d525a8884bda01b9e8f0abf8e1e Mon Sep 17 00:00:00 2001
2From: David Drysdale <drysdale@google.com>
3Date: Fri, 20 Nov 2015 11:13:45 +0800
4Subject: [PATCH] CVE-2015-5312 Another entity expansion issue
5
6For https://bugzilla.gnome.org/show_bug.cgi?id=756733
7It is one case where the code in place to detect entities expansions
8failed to exit when the situation was detected, leading to DoS
9Problem reported by Kostya Serebryany @ Google
10Patch provided by David Drysdale @ Google
11
12Upstream-Status: Backport
13
14CVE-2015-5312
15
16Signed-off-by: Armin Kuster <akuster@mvista.com>
17
18---
19 parser.c | 4 ++++
20 1 file changed, 4 insertions(+)
21
22diff --git a/parser.c b/parser.c
23index b7b6668..da6e729 100644
24--- a/parser.c
25+++ b/parser.c
26@@ -2806,6 +2806,10 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
27 0, 0, 0);
28 ctxt->depth--;
29
30+ if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
31+ (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
32+ goto int_error;
33+
34 if (rep != NULL) {
35 current = rep;
36 while (*current != 0) { /* non input consuming loop */
37--
382.3.5
39