libxml2: update to 2.9.12
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
This commit is contained in:
parent
80e6e0bcbe
commit
6b932d3ff7
4 changed files with 3 additions and 89 deletions
|
@ -8,12 +8,12 @@
|
|||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=libxml2
|
||||
PKG_VERSION:=2.9.10
|
||||
PKG_RELEASE:=3
|
||||
PKG_VERSION:=2.9.12
|
||||
PKG_RELEASE:=1
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
||||
PKG_SOURCE_URL:=http://xmlsoft.org/sources/
|
||||
PKG_HASH:=aafee193ffb8fe0c82d4afef6ef91972cbaf5feea100edc2f262750611b4be1f
|
||||
PKG_HASH:=c8d6681e38c56f172892c85ddc0852e1fd4b53b4209e7f4ebf17f7e2eae71d92
|
||||
|
||||
PKG_LICENSE:=MIT
|
||||
PKG_LICENSE_FILES:=COPYING
|
||||
|
|
|
@ -1,28 +0,0 @@
|
|||
From 6088a74bcf7d0c42e24cff4594d804e1d3c9fbca Mon Sep 17 00:00:00 2001
|
||||
From: Zhipeng Xie <xiezhipeng1@huawei.com>
|
||||
Date: Tue, 20 Aug 2019 16:33:06 +0800
|
||||
Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream
|
||||
|
||||
When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
|
||||
alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
|
||||
to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
|
||||
vctxt->xsiAssemble to 0 again which cause the alloced schema
|
||||
can not be freed anymore.
|
||||
|
||||
Found with libFuzzer.
|
||||
|
||||
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
|
||||
---
|
||||
xmlschemas.c | 1 -
|
||||
1 file changed, 1 deletion(-)
|
||||
|
||||
--- a/xmlschemas.c
|
||||
+++ b/xmlschemas.c
|
||||
@@ -28095,7 +28095,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vc
|
||||
vctxt->nberrors = 0;
|
||||
vctxt->depth = -1;
|
||||
vctxt->skipDepth = -1;
|
||||
- vctxt->xsiAssemble = 0;
|
||||
vctxt->hasKeyrefs = 0;
|
||||
#ifdef ENABLE_IDC_NODE_TABLES_TEST
|
||||
vctxt->createIDCNodeTables = 1;
|
|
@ -1,31 +0,0 @@
|
|||
From 50f06b3efb638efb0abd95dc62dca05ae67882c2 Mon Sep 17 00:00:00 2001
|
||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
||||
Date: Fri, 7 Aug 2020 21:54:27 +0200
|
||||
Subject: [PATCH] Fix out-of-bounds read with 'xmllint --htmlout'
|
||||
|
||||
Make sure that truncated UTF-8 sequences don't cause an out-of-bounds
|
||||
array access.
|
||||
|
||||
Thanks to @SuhwanSong and the Agency for Defense Development (ADD) for
|
||||
the report.
|
||||
|
||||
Fixes #178.
|
||||
---
|
||||
xmllint.c | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
--- a/xmllint.c
|
||||
+++ b/xmllint.c
|
||||
@@ -528,6 +528,12 @@ static void
|
||||
xmlHTMLEncodeSend(void) {
|
||||
char *result;
|
||||
|
||||
+ /*
|
||||
+ * xmlEncodeEntitiesReentrant assumes valid UTF-8, but the buffer might
|
||||
+ * end with a truncated UTF-8 sequence. This is a hack to at least avoid
|
||||
+ * an out-of-bounds read.
|
||||
+ */
|
||||
+ memset(&buffer[sizeof(buffer)-4], 0, 4);
|
||||
result = (char *) xmlEncodeEntitiesReentrant(NULL, BAD_CAST buffer);
|
||||
if (result) {
|
||||
xmlGenericError(xmlGenericErrorContext, "%s", result);
|
|
@ -1,27 +0,0 @@
|
|||
From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001
|
||||
From: Zhipeng Xie <xiezhipeng1@huawei.com>
|
||||
Date: Thu, 12 Dec 2019 17:30:55 +0800
|
||||
Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
|
||||
|
||||
When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
|
||||
return NULL which cause a infinite loop in xmlStringLenDecodeEntities
|
||||
|
||||
Found with libFuzzer.
|
||||
|
||||
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
|
||||
---
|
||||
parser.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/parser.c
|
||||
+++ b/parser.c
|
||||
@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxt
|
||||
else
|
||||
c = 0;
|
||||
while ((c != 0) && (c != end) && /* non input consuming loop */
|
||||
- (c != end2) && (c != end3)) {
|
||||
+ (c != end2) && (c != end3) &&
|
||||
+ (ctxt->instate != XML_PARSER_EOF)) {
|
||||
|
||||
if (c == 0) break;
|
||||
if ((c == '&') && (str[1] == '#')) {
|
Loading…
Reference in a new issue