1 |
commit: 2ad6bf6d6f3dbe00df33a5399c6762fb0ae1867f |
2 |
Author: Mike Frysinger <vapier <AT> chromium <DOT> org> |
3 |
AuthorDate: Thu Jan 3 11:08:40 2019 +0000 |
4 |
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org> |
5 |
CommitDate: Thu Jan 3 11:21:38 2019 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2ad6bf6d |
7 |
|
8 |
dev-libs/libxml2: fix CVE-2017-8872 #618110 |
9 |
|
10 |
Bug: https://bugs.gentoo.org/618110 |
11 |
Signed-off-by: Mike Frysinger <vapier <AT> gentoo.org> |
12 |
|
13 |
.../files/libxml2-2.9.8-CVE-2017-8872.patch | 65 ++++++ |
14 |
dev-libs/libxml2/libxml2-2.9.8-r1.ebuild | 217 +++++++++++++++++++++ |
15 |
2 files changed, 282 insertions(+) |
16 |
|
17 |
diff --git a/dev-libs/libxml2/files/libxml2-2.9.8-CVE-2017-8872.patch b/dev-libs/libxml2/files/libxml2-2.9.8-CVE-2017-8872.patch |
18 |
new file mode 100644 |
19 |
index 00000000000..6062f63df9e |
20 |
--- /dev/null |
21 |
+++ b/dev-libs/libxml2/files/libxml2-2.9.8-CVE-2017-8872.patch |
22 |
@@ -0,0 +1,65 @@ |
23 |
+https://bugs.gentoo.org/618110 |
24 |
+https://bugzilla.gnome.org/show_bug.cgi?id=775200 |
25 |
+https://gitlab.gnome.org/GNOME/libxml2/issues/26 |
26 |
+ |
27 |
+From 123234f2cfcd9e9b9f83047eee1dc17b4c3f4407 Mon Sep 17 00:00:00 2001 |
28 |
+From: Nick Wellnhofer <wellnhofer@×××××.de> |
29 |
+Date: Tue, 11 Sep 2018 14:52:07 +0200 |
30 |
+Subject: [PATCH] Free input buffer in xmlHaltParser |
31 |
+ |
32 |
+This avoids miscalculation of available bytes. |
33 |
+ |
34 |
+Thanks to Yunho Kim for the report. |
35 |
+ |
36 |
+Closes: #26 |
37 |
+--- |
38 |
+ parser.c | 5 +++++ |
39 |
+ result/errors/759573.xml.err | 17 +++++++---------- |
40 |
+ 2 files changed, 12 insertions(+), 10 deletions(-) |
41 |
+ |
42 |
+diff --git a/parser.c b/parser.c |
43 |
+index ca9fde2c8758..5813a6643e15 100644 |
44 |
+--- a/parser.c |
45 |
++++ b/parser.c |
46 |
+@@ -12462,7 +12462,12 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) { |
47 |
+ ctxt->input->free((xmlChar *) ctxt->input->base); |
48 |
+ ctxt->input->free = NULL; |
49 |
+ } |
50 |
++ if (ctxt->input->buf != NULL) { |
51 |
++ xmlFreeParserInputBuffer(ctxt->input->buf); |
52 |
++ ctxt->input->buf = NULL; |
53 |
++ } |
54 |
+ ctxt->input->cur = BAD_CAST""; |
55 |
++ ctxt->input->length = 0; |
56 |
+ ctxt->input->base = ctxt->input->cur; |
57 |
+ ctxt->input->end = ctxt->input->cur; |
58 |
+ } |
59 |
+diff --git a/result/errors/759573.xml.err b/result/errors/759573.xml.err |
60 |
+index 554039f65b91..38ef5c40b8e3 100644 |
61 |
+--- a/result/errors/759573.xml.err |
62 |
++++ b/result/errors/759573.xml.err |
63 |
+@@ -21,14 +21,11 @@ Entity: line 1: |
64 |
+ ^ |
65 |
+ ./test/errors/759573.xml:1: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration |
66 |
+ |
67 |
+-<?h?><!DOCTYPEt[<!ELEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ00 |
68 |
+- ^ |
69 |
++ |
70 |
++^ |
71 |
+ ./test/errors/759573.xml:1: parser error : DOCTYPE improperly terminated |
72 |
+-<?h?><!DOCTYPEt[<!ELEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ00 |
73 |
+- ^ |
74 |
+-./test/errors/759573.xml:1: parser error : StartTag: invalid element name |
75 |
+-<?h?><!DOCTYPEt[<!ELEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ00 |
76 |
+- ^ |
77 |
+-./test/errors/759573.xml:1: parser error : Extra content at the end of the document |
78 |
+-<?h?><!DOCTYPEt[<!ELEMENT t (A)><!ENTITY % xx '%<![INCLUDE[000%ஸ00 |
79 |
+- ^ |
80 |
++ |
81 |
++^ |
82 |
++./test/errors/759573.xml:1: parser error : Start tag expected, '<' not found |
83 |
++ |
84 |
++^ |
85 |
+-- |
86 |
+2.19.1 |
87 |
+ |
88 |
|
89 |
diff --git a/dev-libs/libxml2/libxml2-2.9.8-r1.ebuild b/dev-libs/libxml2/libxml2-2.9.8-r1.ebuild |
90 |
new file mode 100644 |
91 |
index 00000000000..1a798958bcb |
92 |
--- /dev/null |
93 |
+++ b/dev-libs/libxml2/libxml2-2.9.8-r1.ebuild |
94 |
@@ -0,0 +1,217 @@ |
95 |
+# Copyright 1999-2018 Gentoo Authors |
96 |
+# Distributed under the terms of the GNU General Public License v2 |
97 |
+ |
98 |
+EAPI=6 |
99 |
+PYTHON_COMPAT=( python2_7 python3_{4,5,6,7} ) |
100 |
+PYTHON_REQ_USE="xml" |
101 |
+ |
102 |
+inherit libtool flag-o-matic ltprune python-r1 autotools prefix multilib-minimal |
103 |
+ |
104 |
+DESCRIPTION="XML C parser and toolkit" |
105 |
+HOMEPAGE="http://www.xmlsoft.org/" |
106 |
+ |
107 |
+LICENSE="MIT" |
108 |
+SLOT="2" |
109 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" |
110 |
+IUSE="debug examples icu ipv6 lzma python readline static-libs test" |
111 |
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )" |
112 |
+ |
113 |
+XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite" |
114 |
+XSTS_NAME_1="xmlschema2002-01-16" |
115 |
+XSTS_NAME_2="xmlschema2004-01-14" |
116 |
+XSTS_TARBALL_1="xsts-2002-01-16.tar.gz" |
117 |
+XSTS_TARBALL_2="xsts-2004-01-14.tar.gz" |
118 |
+XMLCONF_TARBALL="xmlts20080827.tar.gz" |
119 |
+ |
120 |
+SRC_URI="ftp://xmlsoft.org/${PN}/${PN}-${PV/_rc/-rc}.tar.gz |
121 |
+ test? ( |
122 |
+ ${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1} |
123 |
+ ${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2} |
124 |
+ http://www.w3.org/XML/Test/${XMLCONF_TARBALL} )" |
125 |
+ |
126 |
+RDEPEND=" |
127 |
+ >=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] |
128 |
+ icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] ) |
129 |
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] ) |
130 |
+ python? ( ${PYTHON_DEPS} ) |
131 |
+ readline? ( sys-libs/readline:= ) |
132 |
+" |
133 |
+DEPEND="${RDEPEND} |
134 |
+ dev-util/gtk-doc-am |
135 |
+ virtual/pkgconfig |
136 |
+ hppa? ( >=sys-devel/binutils-2.15.92.0.2 ) |
137 |
+" |
138 |
+ |
139 |
+S="${WORKDIR}/${PN}-${PV%_rc*}" |
140 |
+ |
141 |
+MULTILIB_CHOST_TOOLS=( |
142 |
+ /usr/bin/xml2-config |
143 |
+) |
144 |
+ |
145 |
+src_unpack() { |
146 |
+ # ${A} isn't used to avoid unpacking of test tarballs into $WORKDIR, |
147 |
+ # as they are needed as tarballs in ${S}/xstc instead and not unpacked |
148 |
+ unpack ${P/_rc/-rc}.tar.gz |
149 |
+ cd "${S}" || die |
150 |
+ |
151 |
+ if use test; then |
152 |
+ cp "${DISTDIR}/${XSTS_TARBALL_1}" \ |
153 |
+ "${DISTDIR}/${XSTS_TARBALL_2}" \ |
154 |
+ "${S}"/xstc/ \ |
155 |
+ || die "Failed to install test tarballs" |
156 |
+ unpack ${XMLCONF_TARBALL} |
157 |
+ fi |
158 |
+} |
159 |
+ |
160 |
+src_prepare() { |
161 |
+ default |
162 |
+ |
163 |
+ DOCS=( AUTHORS ChangeLog NEWS README* TODO* ) |
164 |
+ |
165 |
+ # Patches needed for prefix support |
166 |
+ eapply "${FILESDIR}"/${PN}-2.7.1-catalog_path.patch |
167 |
+ |
168 |
+ eprefixify catalog.c xmlcatalog.c runtest.c xmllint.c |
169 |
+ |
170 |
+ # Fix build for Windows platform |
171 |
+ # https://bugzilla.gnome.org/show_bug.cgi?id=760456 |
172 |
+ # eapply "${FILESDIR}"/${PN}-2.8.0_rc1-winnt.patch |
173 |
+ |
174 |
+ # Fix python detection, bug #567066 |
175 |
+ # https://bugzilla.gnome.org/show_bug.cgi?id=760458 |
176 |
+ eapply "${FILESDIR}"/${PN}-2.9.2-python-ABIFLAG.patch |
177 |
+ |
178 |
+ # Fix python tests when building out of tree #565576 |
179 |
+ eapply "${FILESDIR}"/${PN}-2.9.8-out-of-tree-test.patch |
180 |
+ |
181 |
+ # CVE-2017-8872 #618110 |
182 |
+ # https://bugzilla.gnome.org/show_bug.cgi?id=775200 |
183 |
+ eapply "${FILESDIR}"/${PN}-2.9.8-CVE-2017-8872.patch |
184 |
+ |
185 |
+ if [[ ${CHOST} == *-darwin* ]] ; then |
186 |
+ # Avoid final linking arguments for python modules |
187 |
+ sed -i -e '/PYTHON_LIBS/s/ldflags/libs/' configure.ac || die |
188 |
+ # gcc-apple doesn't grok -Wno-array-bounds |
189 |
+ sed -i -e 's/-Wno-array-bounds//' configure.ac || die |
190 |
+ fi |
191 |
+ |
192 |
+ # Please do not remove, as else we get references to PORTAGE_TMPDIR |
193 |
+ # in /usr/lib/python?.?/site-packages/libxml2mod.la among things. |
194 |
+ # We now need to run eautoreconf at the end to prevent maintainer mode. |
195 |
+# elibtoolize |
196 |
+# epunt_cxx # if we don't eautoreconf |
197 |
+ |
198 |
+ eautoreconf |
199 |
+} |
200 |
+ |
201 |
+multilib_src_configure() { |
202 |
+ # filter seemingly problematic CFLAGS (#26320) |
203 |
+ filter-flags -fprefetch-loop-arrays -funroll-loops |
204 |
+ |
205 |
+ # USE zlib support breaks gnome2 |
206 |
+ # (libgnomeprint for instance fails to compile with |
207 |
+ # fresh install, and existing) - <azarah@g.o> (22 Dec 2002). |
208 |
+ |
209 |
+ # The meaning of the 'debug' USE flag does not apply to the --with-debug |
210 |
+ # switch (enabling the libxml2 debug module). See bug #100898. |
211 |
+ |
212 |
+ # --with-mem-debug causes unusual segmentation faults (bug #105120). |
213 |
+ |
214 |
+ libxml2_configure() { |
215 |
+ ECONF_SOURCE="${S}" econf \ |
216 |
+ --with-html-subdir=${PF}/html \ |
217 |
+ $(use_with debug run-debug) \ |
218 |
+ $(use_with icu) \ |
219 |
+ $(use_with lzma) \ |
220 |
+ $(use_enable ipv6) \ |
221 |
+ $(use_enable static-libs static) \ |
222 |
+ $(multilib_native_use_with readline) \ |
223 |
+ $(multilib_native_use_with readline history) \ |
224 |
+ "$@" |
225 |
+ } |
226 |
+ |
227 |
+ libxml2_py_configure() { |
228 |
+ mkdir -p "${BUILD_DIR}" || die # ensure python build dirs exist |
229 |
+ run_in_build_dir libxml2_configure "--with-python=${ROOT%/}${PYTHON}" # odd build system, also see bug #582130 |
230 |
+ } |
231 |
+ |
232 |
+ libxml2_configure --without-python # build python bindings separately |
233 |
+ |
234 |
+ if multilib_is_native_abi && use python; then |
235 |
+ python_foreach_impl libxml2_py_configure |
236 |
+ fi |
237 |
+} |
238 |
+ |
239 |
+multilib_src_compile() { |
240 |
+ default |
241 |
+ if multilib_is_native_abi && use python; then |
242 |
+ local native_builddir=${BUILD_DIR} |
243 |
+ python_foreach_impl libxml2_py_emake top_builddir="${native_builddir}" all |
244 |
+ fi |
245 |
+} |
246 |
+ |
247 |
+multilib_src_test() { |
248 |
+ emake check |
249 |
+ multilib_is_native_abi && use python && python_foreach_impl libxml2_py_emake test |
250 |
+} |
251 |
+ |
252 |
+multilib_src_install() { |
253 |
+ emake DESTDIR="${D}" \ |
254 |
+ EXAMPLES_DIR="${EPREFIX}"/usr/share/doc/${PF}/examples install |
255 |
+ |
256 |
+ if multilib_is_native_abi && use python; then |
257 |
+ python_foreach_impl libxml2_py_emake \ |
258 |
+ DESTDIR="${D}" \ |
259 |
+ docsdir="${EPREFIX}"/usr/share/doc/${PF}/python \ |
260 |
+ exampledir="${EPREFIX}"/usr/share/doc/${PF}/python/examples \ |
261 |
+ install |
262 |
+ python_foreach_impl python_optimize |
263 |
+ fi |
264 |
+} |
265 |
+ |
266 |
+multilib_src_install_all() { |
267 |
+ # on windows, xmllint is installed by interix libxml2 in parent prefix. |
268 |
+ # this is the version to use. the native winnt version does not support |
269 |
+ # symlinks, which makes repoman fail if the portage tree is linked in |
270 |
+ # from another location (which is my default). -- mduft |
271 |
+ if [[ ${CHOST} == *-winnt* ]]; then |
272 |
+ rm -rf "${ED}"/usr/bin/xmllint |
273 |
+ rm -rf "${ED}"/usr/bin/xmlcatalog |
274 |
+ fi |
275 |
+ |
276 |
+ rm -rf "${ED}"/usr/share/doc/${P} |
277 |
+ einstalldocs |
278 |
+ |
279 |
+ if ! use examples; then |
280 |
+ rm -rf "${ED}"/usr/share/doc/${PF}/examples |
281 |
+ rm -rf "${ED}"/usr/share/doc/${PF}/python/examples |
282 |
+ fi |
283 |
+ |
284 |
+ prune_libtool_files --modules |
285 |
+} |
286 |
+ |
287 |
+pkg_postinst() { |
288 |
+ # We don't want to do the xmlcatalog during stage1, as xmlcatalog will not |
289 |
+ # be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887. |
290 |
+ if [[ "${ROOT}" != "/" ]]; then |
291 |
+ elog "Skipping XML catalog creation for stage building (bug #208887)." |
292 |
+ else |
293 |
+ # need an XML catalog, so no-one writes to a non-existent one |
294 |
+ CATALOG="${EROOT}etc/xml/catalog" |
295 |
+ |
296 |
+ # we dont want to clobber an existing catalog though, |
297 |
+ # only ensure that one is there |
298 |
+ # <obz@g.o> |
299 |
+ if [[ ! -e ${CATALOG} ]]; then |
300 |
+ [[ -d "${EROOT}etc/xml" ]] || mkdir -p "${EROOT}etc/xml" |
301 |
+ "${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}" |
302 |
+ einfo "Created XML catalog in ${CATALOG}" |
303 |
+ fi |
304 |
+ fi |
305 |
+} |
306 |
+ |
307 |
+libxml2_py_emake() { |
308 |
+ pushd "${BUILD_DIR}/python" > /dev/null || die |
309 |
+ emake "$@" |
310 |
+ popd > /dev/null |
311 |
+} |