summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
diff options
context:
space:
mode:
authoromkar patil <omkar.patil@kpit.com>2022-06-03 17:47:49 +0530
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-06-11 10:06:09 +0100
commitd3d92d7852e859f41b67132efda42dc6942c1a3f (patch)
tree1de08b2bcab8e130c6623ee8d68371654e26faa7 /meta/recipes-support
parent6be9d793a33a9270275dc123b3d9059de5f58b12 (diff)
downloadpoky-d3d92d7852e859f41b67132efda42dc6942c1a3f.tar.gz
libxslt: Fix CVE-2021-30560
CVE: CVE-2021-30560 (From OE-Core rev: 3e01aa47b85ebeba26443fc3293c341b5ef72817) Signed-off-by: omkar patil <omkar.patil@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-support')
-rw-r--r--meta/recipes-support/libxslt/libxslt/CVE-2021-30560.patch201
-rw-r--r--meta/recipes-support/libxslt/libxslt_1.1.34.bb1
2 files changed, 202 insertions, 0 deletions
diff --git a/meta/recipes-support/libxslt/libxslt/CVE-2021-30560.patch b/meta/recipes-support/libxslt/libxslt/CVE-2021-30560.patch
new file mode 100644
index 0000000000..614047ea7a
--- /dev/null
+++ b/meta/recipes-support/libxslt/libxslt/CVE-2021-30560.patch
@@ -0,0 +1,201 @@
1From 50f9c9cd3b7dfe9b3c8c795247752d1fdcadcac8 Mon Sep 17 00:00:00 2001
2From: Nick Wellnhofer <wellnhofer@aevum.de>
3Date: Sat, 12 Jun 2021 20:02:53 +0200
4Subject: [PATCH] Fix use-after-free in xsltApplyTemplates
5
6xsltApplyTemplates without a select expression could delete nodes in
7the source document.
8
91. Text nodes with strippable whitespace
10
11Whitespace from input documents is already stripped, so there's no
12need to strip it again. Under certain circumstances, xsltApplyTemplates
13could be fooled into deleting text nodes that are still referenced,
14resulting in a use-after-free.
15
162. The DTD
17
18The DTD was only unlinked, but there's no good reason to do this just
19now. Maybe it was meant as a micro-optimization.
20
213. Unknown nodes
22
23Useless and dangerous as well, especially with XInclude nodes.
24See https://gitlab.gnome.org/GNOME/libxml2/-/issues/268
25
26Simply stop trying to uselessly delete nodes when applying a template.
27This part of the code is probably a leftover from a time where
28xsltApplyStripSpaces wasn't implemented yet. Also note that
29xsltApplyTemplates with a select expression never tried to delete
30nodes.
31
32Also stop xsltDefaultProcessOneNode from deleting nodes for the same
33reasons.
34
35This fixes CVE-2021-30560.
36
37CVE: CVE-2021-30560
38Upstream-Status: Backport [https://github.com/GNOME/libxslt/commit/50f9c9cd3b7dfe9b3c8c795247752d1fdcadcac8.patch]
39Comment: No change in any hunk
40Signed-off-by: Omkar Patil <Omkar.Patil@kpit.com>
41
42---
43 libxslt/transform.c | 119 +++-----------------------------------------
44 1 file changed, 7 insertions(+), 112 deletions(-)
45
46diff --git a/libxslt/transform.c b/libxslt/transform.c
47index 04522154..3aba354f 100644
48--- a/libxslt/transform.c
49+++ b/libxslt/transform.c
50@@ -1895,7 +1895,7 @@ static void
51 xsltDefaultProcessOneNode(xsltTransformContextPtr ctxt, xmlNodePtr node,
52 xsltStackElemPtr params) {
53 xmlNodePtr copy;
54- xmlNodePtr delete = NULL, cur;
55+ xmlNodePtr cur;
56 int nbchild = 0, oldSize;
57 int childno = 0, oldPos;
58 xsltTemplatePtr template;
59@@ -1968,54 +1968,13 @@ xsltDefaultProcessOneNode(xsltTransformContextPtr ctxt, xmlNodePtr node,
60 return;
61 }
62 /*
63- * Handling of Elements: first pass, cleanup and counting
64+ * Handling of Elements: first pass, counting
65 */
66 cur = node->children;
67 while (cur != NULL) {
68- switch (cur->type) {
69- case XML_TEXT_NODE:
70- case XML_CDATA_SECTION_NODE:
71- case XML_DOCUMENT_NODE:
72- case XML_HTML_DOCUMENT_NODE:
73- case XML_ELEMENT_NODE:
74- case XML_PI_NODE:
75- case XML_COMMENT_NODE:
76- nbchild++;
77- break;
78- case XML_DTD_NODE:
79- /* Unlink the DTD, it's still reachable using doc->intSubset */
80- if (cur->next != NULL)
81- cur->next->prev = cur->prev;
82- if (cur->prev != NULL)
83- cur->prev->next = cur->next;
84- break;
85- default:
86-#ifdef WITH_XSLT_DEBUG_PROCESS
87- XSLT_TRACE(ctxt,XSLT_TRACE_PROCESS_NODE,xsltGenericDebug(xsltGenericDebugContext,
88- "xsltDefaultProcessOneNode: skipping node type %d\n",
89- cur->type));
90-#endif
91- delete = cur;
92- }
93+ if (IS_XSLT_REAL_NODE(cur))
94+ nbchild++;
95 cur = cur->next;
96- if (delete != NULL) {
97-#ifdef WITH_XSLT_DEBUG_PROCESS
98- XSLT_TRACE(ctxt,XSLT_TRACE_PROCESS_NODE,xsltGenericDebug(xsltGenericDebugContext,
99- "xsltDefaultProcessOneNode: removing ignorable blank node\n"));
100-#endif
101- xmlUnlinkNode(delete);
102- xmlFreeNode(delete);
103- delete = NULL;
104- }
105- }
106- if (delete != NULL) {
107-#ifdef WITH_XSLT_DEBUG_PROCESS
108- XSLT_TRACE(ctxt,XSLT_TRACE_PROCESS_NODE,xsltGenericDebug(xsltGenericDebugContext,
109- "xsltDefaultProcessOneNode: removing ignorable blank node\n"));
110-#endif
111- xmlUnlinkNode(delete);
112- xmlFreeNode(delete);
113- delete = NULL;
114 }
115
116 /*
117@@ -4864,7 +4823,7 @@ xsltApplyTemplates(xsltTransformContextPtr ctxt, xmlNodePtr node,
118 xsltStylePreCompPtr comp = (xsltStylePreCompPtr) castedComp;
119 #endif
120 int i;
121- xmlNodePtr cur, delNode = NULL, oldContextNode;
122+ xmlNodePtr cur, oldContextNode;
123 xmlNodeSetPtr list = NULL, oldList;
124 xsltStackElemPtr withParams = NULL;
125 int oldXPProximityPosition, oldXPContextSize;
126@@ -4998,73 +4957,9 @@ xsltApplyTemplates(xsltTransformContextPtr ctxt, xmlNodePtr node,
127 else
128 cur = NULL;
129 while (cur != NULL) {
130- switch (cur->type) {
131- case XML_TEXT_NODE:
132- if ((IS_BLANK_NODE(cur)) &&
133- (cur->parent != NULL) &&
134- (cur->parent->type == XML_ELEMENT_NODE) &&
135- (ctxt->style->stripSpaces != NULL)) {
136- const xmlChar *val;
137-
138- if (cur->parent->ns != NULL) {
139- val = (const xmlChar *)
140- xmlHashLookup2(ctxt->style->stripSpaces,
141- cur->parent->name,
142- cur->parent->ns->href);
143- if (val == NULL) {
144- val = (const xmlChar *)
145- xmlHashLookup2(ctxt->style->stripSpaces,
146- BAD_CAST "*",
147- cur->parent->ns->href);
148- }
149- } else {
150- val = (const xmlChar *)
151- xmlHashLookup2(ctxt->style->stripSpaces,
152- cur->parent->name, NULL);
153- }
154- if ((val != NULL) &&
155- (xmlStrEqual(val, (xmlChar *) "strip"))) {
156- delNode = cur;
157- break;
158- }
159- }
160- /* Intentional fall-through */
161- case XML_ELEMENT_NODE:
162- case XML_DOCUMENT_NODE:
163- case XML_HTML_DOCUMENT_NODE:
164- case XML_CDATA_SECTION_NODE:
165- case XML_PI_NODE:
166- case XML_COMMENT_NODE:
167- xmlXPathNodeSetAddUnique(list, cur);
168- break;
169- case XML_DTD_NODE:
170- /* Unlink the DTD, it's still reachable
171- * using doc->intSubset */
172- if (cur->next != NULL)
173- cur->next->prev = cur->prev;
174- if (cur->prev != NULL)
175- cur->prev->next = cur->next;
176- break;
177- case XML_NAMESPACE_DECL:
178- break;
179- default:
180-#ifdef WITH_XSLT_DEBUG_PROCESS
181- XSLT_TRACE(ctxt,XSLT_TRACE_APPLY_TEMPLATES,xsltGenericDebug(xsltGenericDebugContext,
182- "xsltApplyTemplates: skipping cur type %d\n",
183- cur->type));
184-#endif
185- delNode = cur;
186- }
187+ if (IS_XSLT_REAL_NODE(cur))
188+ xmlXPathNodeSetAddUnique(list, cur);
189 cur = cur->next;
190- if (delNode != NULL) {
191-#ifdef WITH_XSLT_DEBUG_PROCESS
192- XSLT_TRACE(ctxt,XSLT_TRACE_APPLY_TEMPLATES,xsltGenericDebug(xsltGenericDebugContext,
193- "xsltApplyTemplates: removing ignorable blank cur\n"));
194-#endif
195- xmlUnlinkNode(delNode);
196- xmlFreeNode(delNode);
197- delNode = NULL;
198- }
199 }
200 }
201
diff --git a/meta/recipes-support/libxslt/libxslt_1.1.34.bb b/meta/recipes-support/libxslt/libxslt_1.1.34.bb
index 63cce6fe06..62afec5755 100644
--- a/meta/recipes-support/libxslt/libxslt_1.1.34.bb
+++ b/meta/recipes-support/libxslt/libxslt_1.1.34.bb
@@ -14,6 +14,7 @@ SECTION = "libs"
14DEPENDS = "libxml2" 14DEPENDS = "libxml2"
15 15
16SRC_URI = "http://xmlsoft.org/sources/libxslt-${PV}.tar.gz \ 16SRC_URI = "http://xmlsoft.org/sources/libxslt-${PV}.tar.gz \
17 file://CVE-2021-30560.patch \
17 " 18 "
18 19
19SRC_URI[md5sum] = "db8765c8d076f1b6caafd9f2542a304a" 20SRC_URI[md5sum] = "db8765c8d076f1b6caafd9f2542a304a"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-24 23:39:02 +0000