summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRahul Chauhan <rahulchauhankitps@gmail.com>2020-02-07 03:06:22 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-02-21 09:44:05 (GMT)
commit26ef016a3c3a2c61c0f0ed1cec5809512d5d7980 (patch)
treef37f3164267f32ef8ecc0c9a4a9cb2582710e03e
parent2ce6c7b190fc418a5653085f83016b29d52a2ae5 (diff)
downloadpoky-26ef016a3c3a2c61c0f0ed1cec5809512d5d7980.tar.gz
libxml2: Fix CVE-2019-19956
(From OE-Core rev: 2be6ab4249c4f49c9ffcd9bb8fea964c8c5d449c) Signed-off-by: Rahul Chauhan <rahulk@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-core/libxml/libxml2/fix-CVE-2019-19956.patch38
-rw-r--r--meta/recipes-core/libxml/libxml2_2.9.8.bb1
2 files changed, 39 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/fix-CVE-2019-19956.patch b/meta/recipes-core/libxml/libxml2/fix-CVE-2019-19956.patch
new file mode 100644
index 0000000..43c3589
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/fix-CVE-2019-19956.patch
@@ -0,0 +1,38 @@
1From 3cd2b25ddb04740be2880cfd78d60038452228b1 Mon Sep 17 00:00:00 2001
2From: Zhipeng Xie <xiezhipeng1@huawei.com>
3Date: Wed, 7 Aug 2019 17:39:17 +0800
4Subject: [PATCH] Fix memory leak in xmlParseBalancedChunkMemoryRecover
5
6When doc is NULL, namespace created in xmlTreeEnsureXMLDecl
7is bind to newDoc->oldNs, in this case, set newDoc->oldNs to
8NULL and free newDoc will cause a memory leak.
9
10Found with libFuzzer.
11
12Closes #82.
13
14Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549]
15CVE: CVE-2019-19956
16
17Signed-off-by: Rahul Chauhan <rahulk@mvista.com>
18---
19 parser.c | 3 ++-
20 1 file changed, 2 insertions(+), 1 deletion(-)
21
22diff --git a/parser.c b/parser.c
23index b7ecd65..491f5c9 100644
24--- a/parser.c
25+++ b/parser.c
26@@ -13899,7 +13899,8 @@ xmlParseBalancedChunkMemoryRecover(xmlDocPtr doc, xmlSAXHandlerPtr sax,
27 xmlFreeParserCtxt(ctxt);
28 newDoc->intSubset = NULL;
29 newDoc->extSubset = NULL;
30- newDoc->oldNs = NULL;
31+ if(doc != NULL)
32+ newDoc->oldNs = NULL;
33 xmlFreeDoc(newDoc);
34
35 return(ret);
36--
372.7.4
38
diff --git a/meta/recipes-core/libxml/libxml2_2.9.8.bb b/meta/recipes-core/libxml/libxml2_2.9.8.bb
index 62643bc..67c2d4f 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.8.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.8.bb
@@ -23,6 +23,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
23 file://fix-CVE-2017-8872.patch \ 23 file://fix-CVE-2017-8872.patch \
24 file://fix-CVE-2018-14404.patch \ 24 file://fix-CVE-2018-14404.patch \
25 file://0001-Fix-infinite-loop-in-LZMA-decompression.patch \ 25 file://0001-Fix-infinite-loop-in-LZMA-decompression.patch \
26 file://fix-CVE-2019-19956.patch \
26 " 27 "
27 28
28SRC_URI[libtar.md5sum] = "b786e353e2aa1b872d70d5d1ca0c740d" 29SRC_URI[libtar.md5sum] = "b786e353e2aa1b872d70d5d1ca0c740d"