summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArmin Kuster <akuster@mvista.com>2016-07-09 15:06:40 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2016-07-27 08:29:41 +0100
commitceabe39237a035efda6a74c746848a9fbab30a08 (patch)
treed5ff843a71622d37ae034fa3d2eaec6a8d71ccf5
parent990b5427fd3bf5c00ac7c5820d5f455378776b62 (diff)
downloadopenembedded-core-contrib-ceabe39237a035efda6a74c746848a9fbab30a08.tar.gz
openembedded-core-contrib-ceabe39237a035efda6a74c746848a9fbab30a08.tar.bz2
openembedded-core-contrib-ceabe39237a035efda6a74c746848a9fbab30a08.zip
libxml2: Security fix for CVE-2016-3627
Affects libxml2 < 2.9.4 Signed-off-by: Armin Kuster <akuster@mvista.com>
-rw-r--r--meta/recipes-core/libxml/libxml2/CVE-2016-3627.patch64
-rw-r--r--meta/recipes-core/libxml/libxml2_2.9.2.bb1
2 files changed, 65 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-3627.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-3627.patch
new file mode 100644
index 0000000000..2de9c5ecb9
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2016-3627.patch
@@ -0,0 +1,64 @@
+From bdd66182ef53fe1f7209ab6535fda56366bd7ac9 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Mon, 23 May 2016 12:27:58 +0800
+Subject: [PATCH] Avoid building recursive entities
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=762100
+
+When we detect a recusive entity we should really not
+build the associated data, moreover if someone bypass
+libxml2 fatal errors and still tries to serialize a broken
+entity make sure we don't risk to get ito a recursion
+
+* parser.c: xmlParserEntityCheck() don't build if entity loop
+ were found and remove the associated text content
+* tree.c: xmlStringGetNodeList() avoid a potential recursion
+
+Upstream-Status: Backport
+CVE: CVE-2016-3627
+Signed-off-by: Armin Kuster <akuster@mvsita.com
+
+---
+ parser.c | 6 +++++-
+ tree.c | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index ea0e89e..53a6b7f 100644
+--- a/parser.c
++++ b/parser.c
+@@ -138,7 +138,8 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+ * entities problems
+ */
+ if ((ent != NULL) && (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
+- (ent->content != NULL) && (ent->checked == 0)) {
++ (ent->content != NULL) && (ent->checked == 0) &&
++ (ctxt->errNo != XML_ERR_ENTITY_LOOP)) {
+ unsigned long oldnbent = ctxt->nbentities;
+ xmlChar *rep;
+
+@@ -148,6 +149,9 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+ rep = xmlStringDecodeEntities(ctxt, ent->content,
+ XML_SUBSTITUTE_REF, 0, 0, 0);
+ --ctxt->depth;
++ if (ctxt->errNo == XML_ERR_ENTITY_LOOP) {
++ ent->content[0] = 0;
++ }
+
+ ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
+ if (rep != NULL) {
+diff --git a/tree.c b/tree.c
+index 7fbca6e..9d330b8 100644
+--- a/tree.c
++++ b/tree.c
+@@ -1593,6 +1593,7 @@ xmlStringGetNodeList(const xmlDoc *doc, const xmlChar *value) {
+ else if ((ent != NULL) && (ent->children == NULL)) {
+ xmlNodePtr temp;
+
++ ent->children = (xmlNodePtr) -1;
+ ent->children = xmlStringGetNodeList(doc,
+ (const xmlChar*)node->content);
+ ent->owner = 1;
+--
+2.3.5
+
diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb
index 76efa9ffca..90f7a7ab79 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.2.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb
@@ -16,6 +16,7 @@ SRC_URI += "file://CVE-2016-1762.patch \
file://CVE-2016-1837.patch \
file://CVE-2016-1835.patch \
file://CVE-2016-1833.patch \
+ file://CVE-2016-3627.patch \
"
SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788"