libxml2: patch CVE-2026-0990

Pick patch which closed [1].

[1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018

(From OE-Core rev: 3af64204dec407546bed8f1dc0cb8b4a1501e471)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>

2 files changed, 77 insertions, 0 deletions

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
new file mode 100644
index 0000000000..e0c1e3c707
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
@@ -0,0 +1,76 @@
+From 1961208e958ca22f80a0b4e4c9d71cfa050aa982 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Wed, 17 Dec 2025 15:24:08 +0100
+Subject: [PATCH] catalog: prevent inf recursion in xmlCatalogXMLResolveURI
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
+
+CVE: CVE-2026-0989
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ catalog.c | 31 +++++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+diff --git a/catalog.c b/catalog.c
+index 76c063a8..46b877e6 100644
+--- a/catalog.c
++++ b/catalog.c
+@@ -2099,12 +2099,21 @@ static xmlChar *
+ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
+     xmlChar *ret = NULL;
+     xmlChar *urnID = NULL;
++    xmlCatalogEntryPtr cur = NULL;
+ 
+     if (catal == NULL)
+         return(NULL);
+     if (URI == NULL)
+        return(NULL);
+ 
++    if (catal->depth > MAX_CATAL_DEPTH) {
++       xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION,
++                     "Detected recursion in catalog %s\n",
++                     catal->name, NULL, NULL);
++       return(NULL);
++    }
++    catal->depth++;
++
+     if (!xmlStrncmp(URI, BAD_CAST XML_URN_PUBID, sizeof(XML_URN_PUBID) - 1)) {
+        urnID = xmlCatalogUnWrapURN(URI);
+        if (xmlDebugCatalogs) {
+@@ -2118,21 +2127,27 @@ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
+        ret = xmlCatalogListXMLResolve(catal, urnID, NULL);
+        if (urnID != NULL)
+            xmlFree(urnID);
++       catal->depth--;
+        return(ret);
+     }
+-    while (catal != NULL) {
+-       if (catal->type == XML_CATA_CATALOG) {
+-           if (catal->children == NULL) {
+-               xmlFetchXMLCatalogFile(catal);
++    cur = catal;
++    while (cur != NULL) {
++       if (cur->type == XML_CATA_CATALOG) {
++           if (cur->children == NULL) {
++               xmlFetchXMLCatalogFile(cur);
+            }
+-           if (catal->children != NULL) {
+-               ret = xmlCatalogXMLResolveURI(catal->children, URI);
+-               if (ret != NULL)
++           if (cur->children != NULL) {
++               ret = xmlCatalogXMLResolveURI(cur->children, URI);
++               if (ret != NULL) {
++                   catal->depth--;
+                    return(ret);
++               }
+            }
+        }
+-       catal = catal->next;
++       cur = cur->next;
+     }
++
++    catal->depth--;
+     return(ret);
+ }
+ 
diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb
index 05a7dce95b..a72aff6c83 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.14.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb
@@ -44,6 +44,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar;subdir=${BP};name=testt
            file://CVE-2025-6170.patch \
            file://CVE-2025-9714.patch \
            file://CVE-2025-7425.patch \
+           file://CVE-2026-0990.patch \
            "
 
 SRC_URI[archive.sha256sum] = "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee"