diff options
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch | 47 | ||||
-rw-r--r-- | meta/recipes-core/libxml/libxml2_2.9.2.bb | 1 |
2 files changed, 48 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch new file mode 100644 index 0000000000..f76bb10e9f --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From b1d34de46a11323fccffa9fadeb33be670d602f5 Mon Sep 17 00:00:00 2001 | ||
2 | From: Daniel Veillard <veillard@redhat.com> | ||
3 | Date: Mon, 14 Mar 2016 17:19:44 +0800 | ||
4 | Subject: [PATCH] Fix inappropriate fetch of entities content | ||
5 | |||
6 | For https://bugzilla.gnome.org/show_bug.cgi?id=761430 | ||
7 | |||
8 | libfuzzer regression testing exposed another case where the parser would | ||
9 | fetch content of an external entity while not in validating mode. | ||
10 | Plug that hole | ||
11 | |||
12 | Upstream-status: Backport | ||
13 | CVE: CVE-2016-4449 | ||
14 | |||
15 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
16 | |||
17 | --- | ||
18 | parser.c | 16 +++++++++++++++- | ||
19 | 1 file changed, 15 insertions(+), 1 deletion(-) | ||
20 | |||
21 | Index: libxml2-2.9.2/parser.c | ||
22 | =================================================================== | ||
23 | --- libxml2-2.9.2.orig/parser.c | ||
24 | +++ libxml2-2.9.2/parser.c | ||
25 | @@ -2873,7 +2873,21 @@ xmlStringLenDecodeEntities(xmlParserCtxt | ||
26 | ctxt->nbentities += ent->checked / 2; | ||
27 | if (ent != NULL) { | ||
28 | if (ent->content == NULL) { | ||
29 | - xmlLoadEntityContent(ctxt, ent); | ||
30 | + /* | ||
31 | + * Note: external parsed entities will not be loaded, | ||
32 | + * it is not required for a non-validating parser to | ||
33 | + * complete external PEreferences coming from the | ||
34 | + * internal subset | ||
35 | + */ | ||
36 | + if (((ctxt->options & XML_PARSE_NOENT) != 0) || | ||
37 | + ((ctxt->options & XML_PARSE_DTDVALID) != 0) || | ||
38 | + (ctxt->validate != 0)) { | ||
39 | + xmlLoadEntityContent(ctxt, ent); | ||
40 | + } else { | ||
41 | + xmlWarningMsg(ctxt, XML_ERR_ENTITY_PROCESSING, | ||
42 | + "not validating will not read content for PE entity %s\n", | ||
43 | + ent->name, NULL); | ||
44 | + } | ||
45 | } | ||
46 | ctxt->depth++; | ||
47 | rep = xmlStringDecodeEntities(ctxt, ent->content, what, | ||
diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb index 798337cb8b..10e4b563f3 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.2.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb | |||
@@ -12,6 +12,7 @@ SRC_URI += "file://CVE-2016-1762.patch \ | |||
12 | file://CVE-2016-1838.patch \ | 12 | file://CVE-2016-1838.patch \ |
13 | file://CVE-2016-1839.patch \ | 13 | file://CVE-2016-1839.patch \ |
14 | file://CVE-2016-1836.patch \ | 14 | file://CVE-2016-1836.patch \ |
15 | file://CVE-2016-4449.patch \ | ||
15 | " | 16 | " |
16 | 17 | ||
17 | SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" | 18 | SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" |