linux/poky.git/meta/recipes-core/libxml/libxml2, branch thud-20.0.4

libxml2: refresh CVE-2017-8872

2018-10-04T22:00:55+00:00

The patch associated with the CVE-2017-8872 report was never merged into libxml2, but a slightly different patch for the same problem was. Cherry-pick that as a backport, which also fixes the failing test suite. (From OE-Core rev: 512869aea6dde1bb2374601f7c4d793ac9edaa42) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libxml2: fix CVE-2018-9251 and CVE-2018-14567

2018-08-20T16:38:23+00:00

(From OE-Core rev: b91b276696fb5e0b633b73be408bd750ac4e28ce) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

libxml2: Fix CVE-2018-14404

2018-08-14T10:36:31+00:00

Fix nullptr deref with XPath logic ops If the XPath stack is corrupted, for example by a misbehaving extension function, the "and" and "or" XPath operators could dereference NULL pointers. Check that the XPath stack isn't empty and optimize the logic operators slightly. CVE: CVE-2018-14404 (From OE-Core rev: 69315177732a1d260a3315fe8c4c4c44653ae0c8) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: fix CVE-2017-8872

2018-07-05T10:39:06+00:00

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure. https://bugzilla.gnome.org/show_bug.cgi?id=775200 (From OE-Core rev: dac867dc63af70ae992c50697d2be95c3e7b58bb) Signed-off-by: Hongxu Jia Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libxml2: 2.9.7 -> 2.9.8

2018-05-04T12:28:01+00:00

(From OE-Core rev: de24ead63802523daa19ce8528ac95d9e041eaf8) Signed-off-by: Andrej Valek Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libxml: refresh patches

2018-03-07T14:34:50+00:00

The patch tool will apply patches by default with "fuzz", which is where if the hunk context isn't present but what is there is close enough, it will force the patch in. Whilst this is useful when there's just whitespace changes, when applied to source it is possible for a patch applied with fuzz to produce broken code which still compiles (see #10450). This is obviously bad. We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For that to be realistic the existing patches with fuzz need to be rebased and reviewed. (From OE-Core rev: d71d6854fadc96fc3c75617af3beba02952fdef6) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libxml2: fix makefile for ptests

2018-01-14T09:11:57+00:00

Changes to Makefile in latest version mean when "make -k runtests" is executed, it leads to errors like: | make: *** No rule to make target 'runtest.c', needed by 'runtest.o'. | make: *** No rule to make target 'SAX.c', needed by 'SAX.lo'. | make: *** No rule to make target 'entities.c', needed by 'entities.lo'. | make: *** No rule to make target 'encoding.c', needed by 'encoding.lo'. Make sure that we don't try to check and compile the tests again on the target. (From OE-Core rev: 5cf92ca436e1a1ba60fec8b30b6cb3cfd4842bc8) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

libxml2: 2.9.4 -> 2.9.5

2017-11-05T22:33:20+00:00

(From OE-Core rev: a0d2427bb86668215d7c9e1be07cb9a2d86f6755) Signed-off-by: Andrej Valek Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libxml2-ptest: set LC_ALL=en_US.UTF-8

2017-10-07T22:20:40+00:00

We need to specify UTF-8 in the environment to avoid an error such as: UnicodeEncodeError: 'ascii' codec can't encode character '\xe4' (From OE-Core rev: d7f1fe6c8419b8c59e601c56245373d094cae298) Signed-off-by: Juro Bystricky Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libxml2: Fix CVE-2017-8872

2017-08-27T21:30:06+00:00

fix global-buffer-overflow in htmlParseTryOrFinish (HTMLparser.c:5403) https://bugzilla.gnome.org/show_bug.cgi?id=775200 Here is the reproduce steps on ubuntu 16.04, use clang with "-fsanitize=address" ... export CC="clang" export CFLAGS="-fsanitize=address" ./configure --disable-shared make clean all -j wget https://bugzilla.gnome.org/attachment.cgi?id=340871 -O poc ./xmllint --html --push poc ==2785==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000a0de21 at pc 0x0000006a7f6e bp 0x7ffdfe940c10 sp 0x7ffdfe940c08 READ of size 1 at 0x000000a0de21 thread T0 #0 0x6a7f6d (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x6a7f6d) #1 0x6a7356 (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x6a7356) #2 0x4f4504 (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x4f4504) #3 0x4f045e (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x4f045e) #4 0x7f81977d682f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #5 0x419ad8 (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x419ad8) ... (From OE-Core rev: a615b0825927a09a0aa8312d131c9acbaef8956d) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie