Received: by mail.netbsd.org (Postfix, from userid 605) id 04F6587476; Fri, 24 Jan 2020 10:40:39 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 7341387537 for ; Fri, 24 Jan 2020 10:40:38 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.netbsd.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id BWKaqKU3RB4R for ; Fri, 24 Jan 2020 10:40:37 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id 01A8387476 for ; Fri, 24 Jan 2020 10:40:37 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id EEB31FBF4; Fri, 24 Jan 2020 10:40:36 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1579862436147910" MIME-Version: 1.0 Date: Fri, 24 Jan 2020 10:40:36 +0000 From: "Kimmo Suominen" Subject: CVS commit: pkgsrc/textproc/libxml2 To: pkgsrc-changes@NetBSD.org Reply-To: kim@netbsd.org X-Mailer: log_accum Message-Id: <20200124104036.EEB31FBF4@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1579862436147910 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: kim Date: Fri Jan 24 10:40:36 UTC 2020 Modified Files: pkgsrc/textproc/libxml2: Makefile distinfo Added Files: pkgsrc/textproc/libxml2/patches: patch-parser.c patch-xmlschemas.c Log Message: Apply upstream patch for CVE-2020-7595. Apply upstream pull request for CVE-2019-20388. To generate a diff of this commit: cvs rdiff -u -r1.154 -r1.155 pkgsrc/textproc/libxml2/Makefile cvs rdiff -u -r1.131 -r1.132 pkgsrc/textproc/libxml2/distinfo cvs rdiff -u -r0 -r1.7 pkgsrc/textproc/libxml2/patches/patch-parser.c cvs rdiff -u -r0 -r1.1 pkgsrc/textproc/libxml2/patches/patch-xmlschemas.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1579862436147910 Content-Disposition: inline Content-Length: 4779 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/textproc/libxml2/Makefile diff -u pkgsrc/textproc/libxml2/Makefile:1.154 pkgsrc/textproc/libxml2/Makefile:1.155 --- pkgsrc/textproc/libxml2/Makefile:1.154 Mon Nov 4 21:43:38 2019 +++ pkgsrc/textproc/libxml2/Makefile Fri Jan 24 10:40:36 2020 @@ -1,6 +1,7 @@ -# $NetBSD: Makefile,v 1.154 2019/11/04 21:43:38 rillig Exp $ +# $NetBSD: Makefile,v 1.155 2020/01/24 10:40:36 kim Exp $ .include "../../textproc/libxml2/Makefile.common" +PKGREVISION= 1 COMMENT= XML parser library from the GNOME project LICENSE= modified-bsd Index: pkgsrc/textproc/libxml2/distinfo diff -u pkgsrc/textproc/libxml2/distinfo:1.131 pkgsrc/textproc/libxml2/distinfo:1.132 --- pkgsrc/textproc/libxml2/distinfo:1.131 Wed Nov 6 13:19:43 2019 +++ pkgsrc/textproc/libxml2/distinfo Fri Jan 24 10:40:36 2020 @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.131 2019/11/06 13:19:43 wiz Exp $ +$NetBSD: distinfo,v 1.132 2020/01/24 10:40:36 kim Exp $ SHA1 (libxml2-2.9.10.tar.gz) = db6592ec9ca9708c4e71bf6bfd907bbb5cd40644 RMD160 (libxml2-2.9.10.tar.gz) = 455f81e1f121c63dac96802de7f83ce4483f1afe @@ -9,8 +9,10 @@ SHA1 (patch-catalog.c) = 34afe787f6012b4 SHA1 (patch-configure) = f6e9f08377a537657df08deee17a5cc66c60b808 SHA1 (patch-doc_examples_Makefile.in) = 4eede9719724f94402e850ee6d6043a74aaf62b2 SHA1 (patch-encoding.c) = 6cf0a7d421828b9f40a4079ee85adb791c54d096 +SHA1 (patch-parser.c) = 9dcda6b8bc71c1abb095fc2c840ac40c1ae04a33 SHA1 (patch-python_libxml.c) = cfa07b4f3dfddb501c2ba210bb32b8ee14e3df9d SHA1 (patch-python_libxml.py) = 869a72ae5ba2e27e6d46552878890acb22337675 SHA1 (patch-python_libxml2.py) = 209d105b0f3aedb834091390a7c6819705108e34 SHA1 (patch-python_setup.py) = 7771fd02ee6779463f1d3321f099d7e6d19cd1b1 SHA1 (patch-xmlcatalog.c) = d65b7e3be9694147e96ce4bb70a1739e2279ba81 +SHA1 (patch-xmlschemas.c) = edd5be08e7b19ab8e35412b854e95dedbb7befdd Added files: Index: pkgsrc/textproc/libxml2/patches/patch-parser.c diff -u /dev/null pkgsrc/textproc/libxml2/patches/patch-parser.c:1.7 --- /dev/null Fri Jan 24 10:40:36 2020 +++ pkgsrc/textproc/libxml2/patches/patch-parser.c Fri Jan 24 10:40:36 2020 @@ -0,0 +1,38 @@ +$NetBSD: patch-parser.c,v 1.7 2020/01/24 10:40:36 kim Exp $ + +Fix CVE-2020-7595 + +https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076.patch + +From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001 +From: Zhipeng Xie +Date: Thu, 12 Dec 2019 17:30:55 +0800 +Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities + +When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef +return NULL which cause a infinite loop in xmlStringLenDecodeEntities + +Found with libFuzzer. + +Signed-off-by: Zhipeng Xie +--- + parser.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/parser.c b/parser.c +index d1c31963..a34bb6cd 100644 +--- parser.c ++++ parser.c +@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len, + else + c = 0; + while ((c != 0) && (c != end) && /* non input consuming loop */ +- (c != end2) && (c != end3)) { ++ (c != end2) && (c != end3) && ++ (ctxt->instate != XML_PARSER_EOF)) { + + if (c == 0) break; + if ((c == '&') && (str[1] == '#')) { +-- +2.24.1 + Index: pkgsrc/textproc/libxml2/patches/patch-xmlschemas.c diff -u /dev/null pkgsrc/textproc/libxml2/patches/patch-xmlschemas.c:1.1 --- /dev/null Fri Jan 24 10:40:36 2020 +++ pkgsrc/textproc/libxml2/patches/patch-xmlschemas.c Fri Jan 24 10:40:36 2020 @@ -0,0 +1,39 @@ +$NetBSD: patch-xmlschemas.c,v 1.1 2020/01/24 10:40:36 kim Exp $ + +Fix CVE-2019-20388 + +https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68.patch + +From 6088a74bcf7d0c42e24cff4594d804e1d3c9fbca Mon Sep 17 00:00:00 2001 +From: Zhipeng Xie +Date: Tue, 20 Aug 2019 16:33:06 +0800 +Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream + +When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun +alloc a new schema for ctxt->schema and set vctxt->xsiAssemble +to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize +vctxt->xsiAssemble to 0 again which cause the alloced schema +can not be freed anymore. + +Found with libFuzzer. + +Signed-off-by: Zhipeng Xie +--- + xmlschemas.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/xmlschemas.c b/xmlschemas.c +index 301c8449..39d92182 100644 +--- xmlschemas.c ++++ xmlschemas.c +@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) { + vctxt->nberrors = 0; + vctxt->depth = -1; + vctxt->skipDepth = -1; +- vctxt->xsiAssemble = 0; + vctxt->hasKeyrefs = 0; + #ifdef ENABLE_IDC_NODE_TABLES_TEST + vctxt->createIDCNodeTables = 1; +-- +2.24.1 + --_----------=_1579862436147910--