summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2016-07-09 14:59:57 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-07-27 08:29:37 +0100
commit6f6132dc3aeb0d660c9730f6f33e9194a6098226 (patch)
tree9f0ca4758d7d7d702fbf4fbb1a93a0229e33fbb6
parent9229873f278f7c24fb01673ec3d9fd404762bc25 (diff)
downloadopenembedded-core-contrib-6f6132dc3aeb0d660c9730f6f33e9194a6098226.tar.gz
openembedded-core-contrib-6f6132dc3aeb0d660c9730f6f33e9194a6098226.tar.bz2
openembedded-core-contrib-6f6132dc3aeb0d660c9730f6f33e9194a6098226.zip
libxml2: Security fix for CVE-2016-4449
Affects limbxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
-rw-r--r--meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch47
-rw-r--r--meta/recipes-core/libxml/libxml2_2.9.2.bb1
2 files changed, 48 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch
new file mode 100644
index 0000000000..f76bb10e9f
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch
@@ -0,0 +1,47 @@
+From b1d34de46a11323fccffa9fadeb33be670d602f5 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Mon, 14 Mar 2016 17:19:44 +0800
+Subject: [PATCH] Fix inappropriate fetch of entities content
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=761430
+
+libfuzzer regression testing exposed another case where the parser would
+fetch content of an external entity while not in validating mode.
+Plug that hole
+
+Upstream-status: Backport
+CVE: CVE-2016-4449
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ parser.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+Index: libxml2-2.9.2/parser.c
+===================================================================
+--- libxml2-2.9.2.orig/parser.c
++++ libxml2-2.9.2/parser.c
+@@ -2873,7 +2873,21 @@ xmlStringLenDecodeEntities(xmlParserCtxt
+ ctxt->nbentities += ent->checked / 2;
+ if (ent != NULL) {
+ if (ent->content == NULL) {
+- xmlLoadEntityContent(ctxt, ent);
++ /*
++ * Note: external parsed entities will not be loaded,
++ * it is not required for a non-validating parser to
++ * complete external PEreferences coming from the
++ * internal subset
++ */
++ if (((ctxt->options & XML_PARSE_NOENT) != 0) ||
++ ((ctxt->options & XML_PARSE_DTDVALID) != 0) ||
++ (ctxt->validate != 0)) {
++ xmlLoadEntityContent(ctxt, ent);
++ } else {
++ xmlWarningMsg(ctxt, XML_ERR_ENTITY_PROCESSING,
++ "not validating will not read content for PE entity %s\n",
++ ent->name, NULL);
++ }
+ }
+ ctxt->depth++;
+ rep = xmlStringDecodeEntities(ctxt, ent->content, what,
diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb
index 798337cb8b..10e4b563f3 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.2.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb
@@ -12,6 +12,7 @@ SRC_URI += "file://CVE-2016-1762.patch \
file://CVE-2016-1838.patch \
file://CVE-2016-1839.patch \
file://CVE-2016-1836.patch \
+ file://CVE-2016-4449.patch \
"
SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788"