1 |
commit: 060503be258912e25b6da77ca79d450553ed0be3 |
2 |
Author: Aaron Bauman <bman <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Jan 2 06:40:16 2017 +0000 |
4 |
Commit: Aaron Bauman <bman <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Jan 2 06:40:59 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=060503be |
7 |
|
8 |
dev-libs/libxml2: security bump to -r1 wrt bugs 589816, 597112, 597114, 597116 in coordination with leio |
9 |
|
10 |
.../files/libxml2-2.9.4-CVE-2016-4658.patch | 249 +++++++++++++++++++++ |
11 |
.../files/libxml2-2.9.4-CVE-2016-5131.patch | 174 ++++++++++++++ |
12 |
.../libxml2/files/libxml2-2.9.4-nullptrderef.patch | 50 +++++ |
13 |
.../files/libxml2-2.9.4-nullptrderef2.patch | 57 +++++ |
14 |
dev-libs/libxml2/libxml2-2.9.4-r1.ebuild | 220 ++++++++++++++++++ |
15 |
5 files changed, 750 insertions(+) |
16 |
|
17 |
diff --git a/dev-libs/libxml2/files/libxml2-2.9.4-CVE-2016-4658.patch b/dev-libs/libxml2/files/libxml2-2.9.4-CVE-2016-4658.patch |
18 |
new file mode 100644 |
19 |
index 00000000..2ef22ce |
20 |
--- /dev/null |
21 |
+++ b/dev-libs/libxml2/files/libxml2-2.9.4-CVE-2016-4658.patch |
22 |
@@ -0,0 +1,249 @@ |
23 |
+From c1d1f7121194036608bf555f08d3062a36fd344b Mon Sep 17 00:00:00 2001 |
24 |
+From: Nick Wellnhofer <wellnhofer@×××××.de> |
25 |
+Date: Tue, 28 Jun 2016 18:34:52 +0200 |
26 |
+Subject: Disallow namespace nodes in XPointer ranges |
27 |
+ |
28 |
+Namespace nodes must be copied to avoid use-after-free errors. |
29 |
+But they don't necessarily have a physical representation in a |
30 |
+document, so simply disallow them in XPointer ranges. |
31 |
+ |
32 |
+Found with afl-fuzz. |
33 |
+ |
34 |
+Fixes CVE-2016-4658. |
35 |
+--- |
36 |
+ xpointer.c | 149 +++++++++++++++++++++++-------------------------------------- |
37 |
+ 1 file changed, 56 insertions(+), 93 deletions(-) |
38 |
+ |
39 |
+diff --git a/xpointer.c b/xpointer.c |
40 |
+index a7b03fb..694d120 100644 |
41 |
+--- a/xpointer.c |
42 |
++++ b/xpointer.c |
43 |
+@@ -320,6 +320,45 @@ xmlXPtrRangesEqual(xmlXPathObjectPtr range1, xmlXPathObjectPtr range2) { |
44 |
+ } |
45 |
+ |
46 |
+ /** |
47 |
++ * xmlXPtrNewRangeInternal: |
48 |
++ * @start: the starting node |
49 |
++ * @startindex: the start index |
50 |
++ * @end: the ending point |
51 |
++ * @endindex: the ending index |
52 |
++ * |
53 |
++ * Internal function to create a new xmlXPathObjectPtr of type range |
54 |
++ * |
55 |
++ * Returns the newly created object. |
56 |
++ */ |
57 |
++static xmlXPathObjectPtr |
58 |
++xmlXPtrNewRangeInternal(xmlNodePtr start, int startindex, |
59 |
++ xmlNodePtr end, int endindex) { |
60 |
++ xmlXPathObjectPtr ret; |
61 |
++ |
62 |
++ /* |
63 |
++ * Namespace nodes must be copied (see xmlXPathNodeSetDupNs). |
64 |
++ * Disallow them for now. |
65 |
++ */ |
66 |
++ if ((start != NULL) && (start->type == XML_NAMESPACE_DECL)) |
67 |
++ return(NULL); |
68 |
++ if ((end != NULL) && (end->type == XML_NAMESPACE_DECL)) |
69 |
++ return(NULL); |
70 |
++ |
71 |
++ ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
72 |
++ if (ret == NULL) { |
73 |
++ xmlXPtrErrMemory("allocating range"); |
74 |
++ return(NULL); |
75 |
++ } |
76 |
++ memset(ret, 0, sizeof(xmlXPathObject)); |
77 |
++ ret->type = XPATH_RANGE; |
78 |
++ ret->user = start; |
79 |
++ ret->index = startindex; |
80 |
++ ret->user2 = end; |
81 |
++ ret->index2 = endindex; |
82 |
++ return(ret); |
83 |
++} |
84 |
++ |
85 |
++/** |
86 |
+ * xmlXPtrNewRange: |
87 |
+ * @start: the starting node |
88 |
+ * @startindex: the start index |
89 |
+@@ -344,17 +383,7 @@ xmlXPtrNewRange(xmlNodePtr start, int startindex, |
90 |
+ if (endindex < 0) |
91 |
+ return(NULL); |
92 |
+ |
93 |
+- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
94 |
+- if (ret == NULL) { |
95 |
+- xmlXPtrErrMemory("allocating range"); |
96 |
+- return(NULL); |
97 |
+- } |
98 |
+- memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); |
99 |
+- ret->type = XPATH_RANGE; |
100 |
+- ret->user = start; |
101 |
+- ret->index = startindex; |
102 |
+- ret->user2 = end; |
103 |
+- ret->index2 = endindex; |
104 |
++ ret = xmlXPtrNewRangeInternal(start, startindex, end, endindex); |
105 |
+ xmlXPtrRangeCheckOrder(ret); |
106 |
+ return(ret); |
107 |
+ } |
108 |
+@@ -381,17 +410,8 @@ xmlXPtrNewRangePoints(xmlXPathObjectPtr start, xmlXPathObjectPtr end) { |
109 |
+ if (end->type != XPATH_POINT) |
110 |
+ return(NULL); |
111 |
+ |
112 |
+- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
113 |
+- if (ret == NULL) { |
114 |
+- xmlXPtrErrMemory("allocating range"); |
115 |
+- return(NULL); |
116 |
+- } |
117 |
+- memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); |
118 |
+- ret->type = XPATH_RANGE; |
119 |
+- ret->user = start->user; |
120 |
+- ret->index = start->index; |
121 |
+- ret->user2 = end->user; |
122 |
+- ret->index2 = end->index; |
123 |
++ ret = xmlXPtrNewRangeInternal(start->user, start->index, end->user, |
124 |
++ end->index); |
125 |
+ xmlXPtrRangeCheckOrder(ret); |
126 |
+ return(ret); |
127 |
+ } |
128 |
+@@ -416,17 +436,7 @@ xmlXPtrNewRangePointNode(xmlXPathObjectPtr start, xmlNodePtr end) { |
129 |
+ if (start->type != XPATH_POINT) |
130 |
+ return(NULL); |
131 |
+ |
132 |
+- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
133 |
+- if (ret == NULL) { |
134 |
+- xmlXPtrErrMemory("allocating range"); |
135 |
+- return(NULL); |
136 |
+- } |
137 |
+- memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); |
138 |
+- ret->type = XPATH_RANGE; |
139 |
+- ret->user = start->user; |
140 |
+- ret->index = start->index; |
141 |
+- ret->user2 = end; |
142 |
+- ret->index2 = -1; |
143 |
++ ret = xmlXPtrNewRangeInternal(start->user, start->index, end, -1); |
144 |
+ xmlXPtrRangeCheckOrder(ret); |
145 |
+ return(ret); |
146 |
+ } |
147 |
+@@ -453,17 +463,7 @@ xmlXPtrNewRangeNodePoint(xmlNodePtr start, xmlXPathObjectPtr end) { |
148 |
+ if (end->type != XPATH_POINT) |
149 |
+ return(NULL); |
150 |
+ |
151 |
+- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
152 |
+- if (ret == NULL) { |
153 |
+- xmlXPtrErrMemory("allocating range"); |
154 |
+- return(NULL); |
155 |
+- } |
156 |
+- memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); |
157 |
+- ret->type = XPATH_RANGE; |
158 |
+- ret->user = start; |
159 |
+- ret->index = -1; |
160 |
+- ret->user2 = end->user; |
161 |
+- ret->index2 = end->index; |
162 |
++ ret = xmlXPtrNewRangeInternal(start, -1, end->user, end->index); |
163 |
+ xmlXPtrRangeCheckOrder(ret); |
164 |
+ return(ret); |
165 |
+ } |
166 |
+@@ -486,17 +486,7 @@ xmlXPtrNewRangeNodes(xmlNodePtr start, xmlNodePtr end) { |
167 |
+ if (end == NULL) |
168 |
+ return(NULL); |
169 |
+ |
170 |
+- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
171 |
+- if (ret == NULL) { |
172 |
+- xmlXPtrErrMemory("allocating range"); |
173 |
+- return(NULL); |
174 |
+- } |
175 |
+- memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); |
176 |
+- ret->type = XPATH_RANGE; |
177 |
+- ret->user = start; |
178 |
+- ret->index = -1; |
179 |
+- ret->user2 = end; |
180 |
+- ret->index2 = -1; |
181 |
++ ret = xmlXPtrNewRangeInternal(start, -1, end, -1); |
182 |
+ xmlXPtrRangeCheckOrder(ret); |
183 |
+ return(ret); |
184 |
+ } |
185 |
+@@ -516,17 +506,7 @@ xmlXPtrNewCollapsedRange(xmlNodePtr start) { |
186 |
+ if (start == NULL) |
187 |
+ return(NULL); |
188 |
+ |
189 |
+- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
190 |
+- if (ret == NULL) { |
191 |
+- xmlXPtrErrMemory("allocating range"); |
192 |
+- return(NULL); |
193 |
+- } |
194 |
+- memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); |
195 |
+- ret->type = XPATH_RANGE; |
196 |
+- ret->user = start; |
197 |
+- ret->index = -1; |
198 |
+- ret->user2 = NULL; |
199 |
+- ret->index2 = -1; |
200 |
++ ret = xmlXPtrNewRangeInternal(start, -1, NULL, -1); |
201 |
+ return(ret); |
202 |
+ } |
203 |
+ |
204 |
+@@ -541,6 +521,8 @@ xmlXPtrNewCollapsedRange(xmlNodePtr start) { |
205 |
+ */ |
206 |
+ xmlXPathObjectPtr |
207 |
+ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) { |
208 |
++ xmlNodePtr endNode; |
209 |
++ int endIndex; |
210 |
+ xmlXPathObjectPtr ret; |
211 |
+ |
212 |
+ if (start == NULL) |
213 |
+@@ -549,7 +531,12 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) { |
214 |
+ return(NULL); |
215 |
+ switch (end->type) { |
216 |
+ case XPATH_POINT: |
217 |
++ endNode = end->user; |
218 |
++ endIndex = end->index; |
219 |
++ break; |
220 |
+ case XPATH_RANGE: |
221 |
++ endNode = end->user2; |
222 |
++ endIndex = end->index2; |
223 |
+ break; |
224 |
+ case XPATH_NODESET: |
225 |
+ /* |
226 |
+@@ -557,39 +544,15 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) { |
227 |
+ */ |
228 |
+ if (end->nodesetval->nodeNr <= 0) |
229 |
+ return(NULL); |
230 |
++ endNode = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1]; |
231 |
++ endIndex = -1; |
232 |
+ break; |
233 |
+ default: |
234 |
+ /* TODO */ |
235 |
+ return(NULL); |
236 |
+ } |
237 |
+ |
238 |
+- ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject)); |
239 |
+- if (ret == NULL) { |
240 |
+- xmlXPtrErrMemory("allocating range"); |
241 |
+- return(NULL); |
242 |
+- } |
243 |
+- memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); |
244 |
+- ret->type = XPATH_RANGE; |
245 |
+- ret->user = start; |
246 |
+- ret->index = -1; |
247 |
+- switch (end->type) { |
248 |
+- case XPATH_POINT: |
249 |
+- ret->user2 = end->user; |
250 |
+- ret->index2 = end->index; |
251 |
+- break; |
252 |
+- case XPATH_RANGE: |
253 |
+- ret->user2 = end->user2; |
254 |
+- ret->index2 = end->index2; |
255 |
+- break; |
256 |
+- case XPATH_NODESET: { |
257 |
+- ret->user2 = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1]; |
258 |
+- ret->index2 = -1; |
259 |
+- break; |
260 |
+- } |
261 |
+- default: |
262 |
+- STRANGE |
263 |
+- return(NULL); |
264 |
+- } |
265 |
++ ret = xmlXPtrNewRangeInternal(start, -1, endNode, endIndex); |
266 |
+ xmlXPtrRangeCheckOrder(ret); |
267 |
+ return(ret); |
268 |
+ } |
269 |
+-- |
270 |
+cgit v0.12 |
271 |
+ |
272 |
|
273 |
diff --git a/dev-libs/libxml2/files/libxml2-2.9.4-CVE-2016-5131.patch b/dev-libs/libxml2/files/libxml2-2.9.4-CVE-2016-5131.patch |
274 |
new file mode 100644 |
275 |
index 00000000..9ce3fb9 |
276 |
--- /dev/null |
277 |
+++ b/dev-libs/libxml2/files/libxml2-2.9.4-CVE-2016-5131.patch |
278 |
@@ -0,0 +1,174 @@ |
279 |
+From 9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e Mon Sep 17 00:00:00 2001 |
280 |
+From: Nick Wellnhofer <wellnhofer@×××××.de> |
281 |
+Date: Tue, 28 Jun 2016 14:22:23 +0200 |
282 |
+Subject: Fix XPointer paths beginning with range-to |
283 |
+ |
284 |
+The old code would invoke the broken xmlXPtrRangeToFunction. range-to |
285 |
+isn't really a function but a special kind of location step. Remove |
286 |
+this function and always handle range-to in the XPath code. |
287 |
+ |
288 |
+The old xmlXPtrRangeToFunction could also be abused to trigger a |
289 |
+use-after-free error with the potential for remote code execution. |
290 |
+ |
291 |
+Found with afl-fuzz. |
292 |
+ |
293 |
+Fixes CVE-2016-5131. |
294 |
+--- |
295 |
+ result/XPath/xptr/vidbase | 13 ++++++++ |
296 |
+ test/XPath/xptr/vidbase | 1 + |
297 |
+ xpath.c | 7 ++++- |
298 |
+ xpointer.c | 76 ++++------------------------------------------- |
299 |
+ 4 files changed, 26 insertions(+), 71 deletions(-) |
300 |
+ |
301 |
+diff --git a/result/XPath/xptr/vidbase b/result/XPath/xptr/vidbase |
302 |
+index 8b9e92d..f19193e 100644 |
303 |
+--- a/result/XPath/xptr/vidbase |
304 |
++++ b/result/XPath/xptr/vidbase |
305 |
+@@ -17,3 +17,16 @@ Object is a Location Set: |
306 |
+ To node |
307 |
+ ELEMENT p |
308 |
+ |
309 |
++ |
310 |
++======================== |
311 |
++Expression: xpointer(range-to(id('chapter2'))) |
312 |
++Object is a Location Set: |
313 |
++1 : Object is a range : |
314 |
++ From node |
315 |
++ / |
316 |
++ To node |
317 |
++ ELEMENT chapter |
318 |
++ ATTRIBUTE id |
319 |
++ TEXT |
320 |
++ content=chapter2 |
321 |
++ |
322 |
+diff --git a/test/XPath/xptr/vidbase b/test/XPath/xptr/vidbase |
323 |
+index b146383..884b106 100644 |
324 |
+--- a/test/XPath/xptr/vidbase |
325 |
++++ b/test/XPath/xptr/vidbase |
326 |
+@@ -1,2 +1,3 @@ |
327 |
+ xpointer(id('chapter1')/p) |
328 |
+ xpointer(id('chapter1')/p[1]/range-to(following-sibling::p[2])) |
329 |
++xpointer(range-to(id('chapter2'))) |
330 |
+diff --git a/xpath.c b/xpath.c |
331 |
+index d992841..5a01b1b 100644 |
332 |
+--- a/xpath.c |
333 |
++++ b/xpath.c |
334 |
+@@ -10691,13 +10691,18 @@ xmlXPathCompPathExpr(xmlXPathParserContextPtr ctxt) { |
335 |
+ lc = 1; |
336 |
+ break; |
337 |
+ } else if ((NXT(len) == '(')) { |
338 |
+- /* Note Type or Function */ |
339 |
++ /* Node Type or Function */ |
340 |
+ if (xmlXPathIsNodeType(name)) { |
341 |
+ #ifdef DEBUG_STEP |
342 |
+ xmlGenericError(xmlGenericErrorContext, |
343 |
+ "PathExpr: Type search\n"); |
344 |
+ #endif |
345 |
+ lc = 1; |
346 |
++#ifdef LIBXML_XPTR_ENABLED |
347 |
++ } else if (ctxt->xptr && |
348 |
++ xmlStrEqual(name, BAD_CAST "range-to")) { |
349 |
++ lc = 1; |
350 |
++#endif |
351 |
+ } else { |
352 |
+ #ifdef DEBUG_STEP |
353 |
+ xmlGenericError(xmlGenericErrorContext, |
354 |
+diff --git a/xpointer.c b/xpointer.c |
355 |
+index 676c510..d74174a 100644 |
356 |
+--- a/xpointer.c |
357 |
++++ b/xpointer.c |
358 |
+@@ -1332,8 +1332,6 @@ xmlXPtrNewContext(xmlDocPtr doc, xmlNodePtr here, xmlNodePtr origin) { |
359 |
+ ret->here = here; |
360 |
+ ret->origin = origin; |
361 |
+ |
362 |
+- xmlXPathRegisterFunc(ret, (xmlChar *)"range-to", |
363 |
+- xmlXPtrRangeToFunction); |
364 |
+ xmlXPathRegisterFunc(ret, (xmlChar *)"range", |
365 |
+ xmlXPtrRangeFunction); |
366 |
+ xmlXPathRegisterFunc(ret, (xmlChar *)"range-inside", |
367 |
+@@ -2243,76 +2241,14 @@ xmlXPtrRangeInsideFunction(xmlXPathParserContextPtr ctxt, int nargs) { |
368 |
+ * @nargs: the number of args |
369 |
+ * |
370 |
+ * Implement the range-to() XPointer function |
371 |
++ * |
372 |
++ * Obsolete. range-to is not a real function but a special type of location |
373 |
++ * step which is handled in xpath.c. |
374 |
+ */ |
375 |
+ void |
376 |
+-xmlXPtrRangeToFunction(xmlXPathParserContextPtr ctxt, int nargs) { |
377 |
+- xmlXPathObjectPtr range; |
378 |
+- const xmlChar *cur; |
379 |
+- xmlXPathObjectPtr res, obj; |
380 |
+- xmlXPathObjectPtr tmp; |
381 |
+- xmlLocationSetPtr newset = NULL; |
382 |
+- xmlNodeSetPtr oldset; |
383 |
+- int i; |
384 |
+- |
385 |
+- if (ctxt == NULL) return; |
386 |
+- CHECK_ARITY(1); |
387 |
+- /* |
388 |
+- * Save the expression pointer since we will have to evaluate |
389 |
+- * it multiple times. Initialize the new set. |
390 |
+- */ |
391 |
+- CHECK_TYPE(XPATH_NODESET); |
392 |
+- obj = valuePop(ctxt); |
393 |
+- oldset = obj->nodesetval; |
394 |
+- ctxt->context->node = NULL; |
395 |
+- |
396 |
+- cur = ctxt->cur; |
397 |
+- newset = xmlXPtrLocationSetCreate(NULL); |
398 |
+- |
399 |
+- for (i = 0; i < oldset->nodeNr; i++) { |
400 |
+- ctxt->cur = cur; |
401 |
+- |
402 |
+- /* |
403 |
+- * Run the evaluation with a node list made of a single item |
404 |
+- * in the nodeset. |
405 |
+- */ |
406 |
+- ctxt->context->node = oldset->nodeTab[i]; |
407 |
+- tmp = xmlXPathNewNodeSet(ctxt->context->node); |
408 |
+- valuePush(ctxt, tmp); |
409 |
+- |
410 |
+- xmlXPathEvalExpr(ctxt); |
411 |
+- CHECK_ERROR; |
412 |
+- |
413 |
+- /* |
414 |
+- * The result of the evaluation need to be tested to |
415 |
+- * decided whether the filter succeeded or not |
416 |
+- */ |
417 |
+- res = valuePop(ctxt); |
418 |
+- range = xmlXPtrNewRangeNodeObject(oldset->nodeTab[i], res); |
419 |
+- if (range != NULL) { |
420 |
+- xmlXPtrLocationSetAdd(newset, range); |
421 |
+- } |
422 |
+- |
423 |
+- /* |
424 |
+- * Cleanup |
425 |
+- */ |
426 |
+- if (res != NULL) |
427 |
+- xmlXPathFreeObject(res); |
428 |
+- if (ctxt->value == tmp) { |
429 |
+- res = valuePop(ctxt); |
430 |
+- xmlXPathFreeObject(res); |
431 |
+- } |
432 |
+- |
433 |
+- ctxt->context->node = NULL; |
434 |
+- } |
435 |
+- |
436 |
+- /* |
437 |
+- * The result is used as the new evaluation set. |
438 |
+- */ |
439 |
+- xmlXPathFreeObject(obj); |
440 |
+- ctxt->context->node = NULL; |
441 |
+- ctxt->context->contextSize = -1; |
442 |
+- ctxt->context->proximityPosition = -1; |
443 |
+- valuePush(ctxt, xmlXPtrWrapLocationSet(newset)); |
444 |
++xmlXPtrRangeToFunction(xmlXPathParserContextPtr ctxt, |
445 |
++ int nargs ATTRIBUTE_UNUSED) { |
446 |
++ XP_ERROR(XPATH_EXPR_ERROR); |
447 |
+ } |
448 |
+ |
449 |
+ /** |
450 |
+-- |
451 |
+cgit v0.12 |
452 |
+ |
453 |
|
454 |
diff --git a/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef.patch b/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef.patch |
455 |
new file mode 100644 |
456 |
index 00000000..d2a9c3e |
457 |
--- /dev/null |
458 |
+++ b/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef.patch |
459 |
@@ -0,0 +1,50 @@ |
460 |
+From e905f08123e4a6e7731549e6f09dadff4cab65bd Mon Sep 17 00:00:00 2001 |
461 |
+From: Nick Wellnhofer <wellnhofer@×××××.de> |
462 |
+Date: Sun, 26 Jun 2016 12:38:28 +0200 |
463 |
+Subject: Fix more NULL pointer derefs in xpointer.c |
464 |
+ |
465 |
+Found with afl-fuzz. |
466 |
+--- |
467 |
+ xpointer.c | 12 +++++++----- |
468 |
+ 1 file changed, 7 insertions(+), 5 deletions(-) |
469 |
+ |
470 |
+diff --git a/xpointer.c b/xpointer.c |
471 |
+index 694d120..e643ee9 100644 |
472 |
+--- a/xpointer.c |
473 |
++++ b/xpointer.c |
474 |
+@@ -542,7 +542,7 @@ xmlXPtrNewRangeNodeObject(xmlNodePtr start, xmlXPathObjectPtr end) { |
475 |
+ /* |
476 |
+ * Empty set ... |
477 |
+ */ |
478 |
+- if (end->nodesetval->nodeNr <= 0) |
479 |
++ if ((end->nodesetval == NULL) || (end->nodesetval->nodeNr <= 0)) |
480 |
+ return(NULL); |
481 |
+ endNode = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1]; |
482 |
+ endIndex = -1; |
483 |
+@@ -1361,7 +1361,7 @@ xmlXPtrEval(const xmlChar *str, xmlXPathContextPtr ctx) { |
484 |
+ */ |
485 |
+ xmlNodeSetPtr set; |
486 |
+ set = tmp->nodesetval; |
487 |
+- if ((set->nodeNr != 1) || |
488 |
++ if ((set == NULL) || (set->nodeNr != 1) || |
489 |
+ (set->nodeTab[0] != (xmlNodePtr) ctx->doc)) |
490 |
+ stack++; |
491 |
+ } else |
492 |
+@@ -2034,9 +2034,11 @@ xmlXPtrRangeFunction(xmlXPathParserContextPtr ctxt, int nargs) { |
493 |
+ xmlXPathFreeObject(set); |
494 |
+ XP_ERROR(XPATH_MEMORY_ERROR); |
495 |
+ } |
496 |
+- for (i = 0;i < oldset->locNr;i++) { |
497 |
+- xmlXPtrLocationSetAdd(newset, |
498 |
+- xmlXPtrCoveringRange(ctxt, oldset->locTab[i])); |
499 |
++ if (oldset != NULL) { |
500 |
++ for (i = 0;i < oldset->locNr;i++) { |
501 |
++ xmlXPtrLocationSetAdd(newset, |
502 |
++ xmlXPtrCoveringRange(ctxt, oldset->locTab[i])); |
503 |
++ } |
504 |
+ } |
505 |
+ |
506 |
+ /* |
507 |
+-- |
508 |
+cgit v0.12 |
509 |
+ |
510 |
|
511 |
diff --git a/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch b/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch |
512 |
new file mode 100644 |
513 |
index 00000000..2484f76 |
514 |
--- /dev/null |
515 |
+++ b/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch |
516 |
@@ -0,0 +1,57 @@ |
517 |
+From d8083bf77955b7879c1290f0c0a24ab8cc70f7fb Mon Sep 17 00:00:00 2001 |
518 |
+From: Nick Wellnhofer <wellnhofer@×××××.de> |
519 |
+Date: Sat, 25 Jun 2016 12:35:50 +0200 |
520 |
+Subject: Fix NULL pointer deref in XPointer range-to |
521 |
+ |
522 |
+- Check for errors after evaluating first operand. |
523 |
+- Add sanity check for empty stack. |
524 |
+ |
525 |
+Found with afl-fuzz. |
526 |
+--- |
527 |
+ result/XPath/xptr/viderror | 4 ++++ |
528 |
+ test/XPath/xptr/viderror | 1 + |
529 |
+ xpath.c | 7 ++++++- |
530 |
+ 3 files changed, 11 insertions(+), 1 deletion(-) |
531 |
+ create mode 100644 result/XPath/xptr/viderror |
532 |
+ create mode 100644 test/XPath/xptr/viderror |
533 |
+ |
534 |
+diff --git a/result/XPath/xptr/viderror b/result/XPath/xptr/viderror |
535 |
+new file mode 100644 |
536 |
+index 0000000..d589882 |
537 |
+--- /dev/null |
538 |
++++ b/result/XPath/xptr/viderror |
539 |
+@@ -0,0 +1,4 @@ |
540 |
++ |
541 |
++======================== |
542 |
++Expression: xpointer(non-existing-fn()/range-to(id('chapter2'))) |
543 |
++Object is empty (NULL) |
544 |
+diff --git a/test/XPath/xptr/viderror b/test/XPath/xptr/viderror |
545 |
+new file mode 100644 |
546 |
+index 0000000..da8c53b |
547 |
+--- /dev/null |
548 |
++++ b/test/XPath/xptr/viderror |
549 |
+@@ -0,0 +1 @@ |
550 |
++xpointer(non-existing-fn()/range-to(id('chapter2'))) |
551 |
+diff --git a/xpath.c b/xpath.c |
552 |
+index 113bce6..751665b 100644 |
553 |
+--- a/xpath.c |
554 |
++++ b/xpath.c |
555 |
+@@ -14005,9 +14005,14 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) |
556 |
+ xmlNodeSetPtr oldset; |
557 |
+ int i, j; |
558 |
+ |
559 |
+- if (op->ch1 != -1) |
560 |
++ if (op->ch1 != -1) { |
561 |
+ total += |
562 |
+ xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); |
563 |
++ CHECK_ERROR0; |
564 |
++ } |
565 |
++ if (ctxt->value == NULL) { |
566 |
++ XP_ERROR0(XPATH_INVALID_OPERAND); |
567 |
++ } |
568 |
+ if (op->ch2 == -1) |
569 |
+ return (total); |
570 |
+ |
571 |
+-- |
572 |
+cgit v0.12 |
573 |
+ |
574 |
|
575 |
diff --git a/dev-libs/libxml2/libxml2-2.9.4-r1.ebuild b/dev-libs/libxml2/libxml2-2.9.4-r1.ebuild |
576 |
new file mode 100644 |
577 |
index 00000000..642f22d |
578 |
--- /dev/null |
579 |
+++ b/dev-libs/libxml2/libxml2-2.9.4-r1.ebuild |
580 |
@@ -0,0 +1,220 @@ |
581 |
+# Copyright 1999-2017 Gentoo Foundation |
582 |
+# Distributed under the terms of the GNU General Public License v2 |
583 |
+# $Id$ |
584 |
+ |
585 |
+EAPI=6 |
586 |
+PYTHON_COMPAT=( python2_7 python3_{4,5} ) |
587 |
+PYTHON_REQ_USE="xml" |
588 |
+ |
589 |
+inherit libtool flag-o-matic eutils python-r1 autotools prefix multilib-minimal |
590 |
+ |
591 |
+DESCRIPTION="Version 2 of the library to manipulate XML files" |
592 |
+HOMEPAGE="http://www.xmlsoft.org/" |
593 |
+ |
594 |
+LICENSE="MIT" |
595 |
+SLOT="2" |
596 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt" |
597 |
+IUSE="debug examples icu ipv6 lzma python readline static-libs test" |
598 |
+ |
599 |
+XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite" |
600 |
+XSTS_NAME_1="xmlschema2002-01-16" |
601 |
+XSTS_NAME_2="xmlschema2004-01-14" |
602 |
+XSTS_TARBALL_1="xsts-2002-01-16.tar.gz" |
603 |
+XSTS_TARBALL_2="xsts-2004-01-14.tar.gz" |
604 |
+XMLCONF_TARBALL="xmlts20080827.tar.gz" |
605 |
+ |
606 |
+SRC_URI="ftp://xmlsoft.org/${PN}/${PN}-${PV/_rc/-rc}.tar.gz |
607 |
+ test? ( |
608 |
+ ${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1} |
609 |
+ ${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2} |
610 |
+ http://www.w3.org/XML/Test/${XMLCONF_TARBALL} )" |
611 |
+ |
612 |
+RDEPEND=" |
613 |
+ >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] |
614 |
+ icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] ) |
615 |
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] ) |
616 |
+ python? ( ${PYTHON_DEPS} ) |
617 |
+ readline? ( sys-libs/readline:= ) |
618 |
+" |
619 |
+DEPEND="${EDEPEND} |
620 |
+ dev-util/gtk-doc-am |
621 |
+ virtual/pkgconfig |
622 |
+ hppa? ( >=sys-devel/binutils-2.15.92.0.2 ) |
623 |
+" |
624 |
+ |
625 |
+S="${WORKDIR}/${PN}-${PV%_rc*}" |
626 |
+ |
627 |
+MULTILIB_CHOST_TOOLS=( |
628 |
+ /usr/bin/xml2-config |
629 |
+) |
630 |
+ |
631 |
+src_unpack() { |
632 |
+ # ${A} isn't used to avoid unpacking of test tarballs into $WORKDIR, |
633 |
+ # as they are needed as tarballs in ${S}/xstc instead and not unpacked |
634 |
+ unpack ${P/_rc/-rc}.tar.gz |
635 |
+ cd "${S}" |
636 |
+ |
637 |
+ if use test; then |
638 |
+ cp "${DISTDIR}/${XSTS_TARBALL_1}" \ |
639 |
+ "${DISTDIR}/${XSTS_TARBALL_2}" \ |
640 |
+ "${S}"/xstc/ \ |
641 |
+ || die "Failed to install test tarballs" |
642 |
+ unpack ${XMLCONF_TARBALL} |
643 |
+ fi |
644 |
+} |
645 |
+ |
646 |
+src_prepare() { |
647 |
+ default |
648 |
+ |
649 |
+ DOCS=( AUTHORS ChangeLog NEWS README* TODO* ) |
650 |
+ |
651 |
+ # Patches needed for prefix support |
652 |
+ eapply "${FILESDIR}"/${PN}-2.7.1-catalog_path.patch |
653 |
+ |
654 |
+ eprefixify catalog.c xmlcatalog.c runtest.c xmllint.c |
655 |
+ |
656 |
+ # Fix build for Windows platform |
657 |
+ # https://bugzilla.gnome.org/show_bug.cgi?id=760456 |
658 |
+ eapply "${FILESDIR}"/${PN}-2.8.0_rc1-winnt.patch |
659 |
+ |
660 |
+ # Disable programs that we don't actually install. |
661 |
+ # https://bugzilla.gnome.org/show_bug.cgi?id=760457 |
662 |
+ eapply "${FILESDIR}"/${PN}-2.9.2-disable-tests.patch |
663 |
+ |
664 |
+ # Fix python detection, bug #567066 |
665 |
+ # https://bugzilla.gnome.org/show_bug.cgi?id=760458 |
666 |
+ eapply "${FILESDIR}"/${PN}-2.9.2-python-ABIFLAG.patch |
667 |
+ |
668 |
+ # Apply latest round of security patches wrt bugs |
669 |
+ # 589816, 597112, 597114, 597116. This will be included |
670 |
+ # in the next upstream release |
671 |
+ eapply "${FILESDIR}"/${PN}-2.9.4-CVE-2016-4658.patch |
672 |
+ eapply "${FILESDIR}"/${PN}-2.9.4-CVE-2016-5131.patch |
673 |
+ eapply "${FILESDIR}"/${PN}-2.9.4-nullptrderef.patch |
674 |
+ eapply "${FILESDIR}"/${PN}-2.9.4-nullptrderef2.patch |
675 |
+ |
676 |
+ # Avoid final linking arguments for python modules |
677 |
+ if [[ ${CHOST} == *-darwin* ]] ; then |
678 |
+ sed -i -e '/PYTHON_LIBS/s/ldflags/libs/' configure.ac || die |
679 |
+ fi |
680 |
+ |
681 |
+ # Please do not remove, as else we get references to PORTAGE_TMPDIR |
682 |
+ # in /usr/lib/python?.?/site-packages/libxml2mod.la among things. |
683 |
+ # We now need to run eautoreconf at the end to prevent maintainer mode. |
684 |
+# elibtoolize |
685 |
+# epunt_cxx # if we don't eautoreconf |
686 |
+ |
687 |
+ eautoreconf |
688 |
+} |
689 |
+ |
690 |
+multilib_src_configure() { |
691 |
+ # filter seemingly problematic CFLAGS (#26320) |
692 |
+ filter-flags -fprefetch-loop-arrays -funroll-loops |
693 |
+ |
694 |
+ # USE zlib support breaks gnome2 |
695 |
+ # (libgnomeprint for instance fails to compile with |
696 |
+ # fresh install, and existing) - <azarah@g.o> (22 Dec 2002). |
697 |
+ |
698 |
+ # The meaning of the 'debug' USE flag does not apply to the --with-debug |
699 |
+ # switch (enabling the libxml2 debug module). See bug #100898. |
700 |
+ |
701 |
+ # --with-mem-debug causes unusual segmentation faults (bug #105120). |
702 |
+ |
703 |
+ libxml2_configure() { |
704 |
+ ECONF_SOURCE="${S}" econf \ |
705 |
+ --with-html-subdir=${PF}/html \ |
706 |
+ $(use_with debug run-debug) \ |
707 |
+ $(use_with icu) \ |
708 |
+ $(use_with lzma) \ |
709 |
+ $(use_enable ipv6) \ |
710 |
+ $(use_enable static-libs static) \ |
711 |
+ $(multilib_native_use_with readline) \ |
712 |
+ $(multilib_native_use_with readline history) \ |
713 |
+ "$@" |
714 |
+ } |
715 |
+ |
716 |
+ libxml2_py_configure() { |
717 |
+ mkdir -p "${BUILD_DIR}" || die # ensure python build dirs exist |
718 |
+ run_in_build_dir libxml2_configure "--with-python=${ROOT%/}${PYTHON}" # odd build system, also see bug #582130 |
719 |
+ } |
720 |
+ |
721 |
+ libxml2_configure --without-python # build python bindings separately |
722 |
+ |
723 |
+ if multilib_is_native_abi && use python; then |
724 |
+ python_foreach_impl libxml2_py_configure |
725 |
+ fi |
726 |
+} |
727 |
+ |
728 |
+multilib_src_compile() { |
729 |
+ default |
730 |
+ if multilib_is_native_abi && use python; then |
731 |
+ local native_builddir=${BUILD_DIR} |
732 |
+ python_foreach_impl libxml2_py_emake top_builddir="${native_builddir}" all |
733 |
+ fi |
734 |
+} |
735 |
+ |
736 |
+multilib_src_test() { |
737 |
+ default |
738 |
+ multilib_is_native_abi && use python && python_foreach_impl libxml2_py_emake test |
739 |
+} |
740 |
+ |
741 |
+multilib_src_install() { |
742 |
+ emake DESTDIR="${D}" \ |
743 |
+ EXAMPLES_DIR="${EPREFIX}"/usr/share/doc/${PF}/examples install |
744 |
+ |
745 |
+ if multilib_is_native_abi && use python; then |
746 |
+ python_foreach_impl libxml2_py_emake \ |
747 |
+ DESTDIR="${D}" \ |
748 |
+ docsdir="${EPREFIX}"/usr/share/doc/${PF}/python \ |
749 |
+ exampledir="${EPREFIX}"/usr/share/doc/${PF}/python/examples \ |
750 |
+ install |
751 |
+ python_foreach_impl python_optimize |
752 |
+ fi |
753 |
+} |
754 |
+ |
755 |
+multilib_src_install_all() { |
756 |
+ # on windows, xmllint is installed by interix libxml2 in parent prefix. |
757 |
+ # this is the version to use. the native winnt version does not support |
758 |
+ # symlinks, which makes repoman fail if the portage tree is linked in |
759 |
+ # from another location (which is my default). -- mduft |
760 |
+ if [[ ${CHOST} == *-winnt* ]]; then |
761 |
+ rm -rf "${ED}"/usr/bin/xmllint |
762 |
+ rm -rf "${ED}"/usr/bin/xmlcatalog |
763 |
+ fi |
764 |
+ |
765 |
+ rm -rf "${ED}"/usr/share/doc/${P} |
766 |
+ einstalldocs |
767 |
+ |
768 |
+ if ! use examples; then |
769 |
+ rm -rf "${ED}"/usr/share/doc/${PF}/examples |
770 |
+ rm -rf "${ED}"/usr/share/doc/${PF}/python/examples |
771 |
+ fi |
772 |
+ |
773 |
+ prune_libtool_files --modules |
774 |
+} |
775 |
+ |
776 |
+pkg_postinst() { |
777 |
+ # We don't want to do the xmlcatalog during stage1, as xmlcatalog will not |
778 |
+ # be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887. |
779 |
+ if [[ "${ROOT}" != "/" ]]; then |
780 |
+ elog "Skipping XML catalog creation for stage building (bug #208887)." |
781 |
+ else |
782 |
+ # need an XML catalog, so no-one writes to a non-existent one |
783 |
+ CATALOG="${EROOT}etc/xml/catalog" |
784 |
+ |
785 |
+ # we dont want to clobber an existing catalog though, |
786 |
+ # only ensure that one is there |
787 |
+ # <obz@g.o> |
788 |
+ if [[ ! -e ${CATALOG} ]]; then |
789 |
+ [[ -d "${EROOT}etc/xml" ]] || mkdir -p "${EROOT}etc/xml" |
790 |
+ "${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}" |
791 |
+ einfo "Created XML catalog in ${CATALOG}" |
792 |
+ fi |
793 |
+ fi |
794 |
+} |
795 |
+ |
796 |
+libxml2_py_emake() { |
797 |
+ pushd "${BUILD_DIR}/python" > /dev/null || die |
798 |
+ emake "$@" |
799 |
+ popd > /dev/null |
800 |
+} |