aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTony Tascioglu <tony.tascioglu@windriver.com>2021-05-14 09:14:49 -0400
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-05-22 10:01:16 +0100
commit490cddd7baf1aacb814128b611aabf82fda3e77b (patch)
tree52fc1f7bc09905da45deaffec0bc744b57b332f7
parent16ad173ba0e8f88b23c62aa8357b8afca36c2161 (diff)
downloadopenembedded-core-490cddd7baf1aacb814128b611aabf82fda3e77b.tar.gz
openembedded-core-490cddd7baf1aacb814128b611aabf82fda3e77b.tar.bz2
openembedded-core-490cddd7baf1aacb814128b611aabf82fda3e77b.zip
libxml2: fix CVE-2021-3516
Fixes use-after-free in xmlEncodeEntitiesInternal() in entities.c CVE: CVE-2021-3516 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539] Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch36
-rw-r--r--meta/recipes-core/libxml/libxml2_2.9.10.bb1
2 files changed, 37 insertions, 0 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch b/meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch
new file mode 100644
index 0000000000..287a171924
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2021-3516.patch
@@ -0,0 +1,36 @@
+From b76718876953e11bbd73dc6c9457323fd5aeda2e Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Wed, 21 Apr 2021 13:23:27 +0200
+Subject: [PATCH 2/3] Fix use-after-free with `xmllint --html --push`
+
+Call htmlCtxtUseOptions to make sure that names aren't stored in
+dictionaries.
+
+Note that this issue only affects xmllint using the HTML push parser.
+
+Fixes #230.
+
+CVE: CVE-2021-3516
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539]
+
+Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
+---
+ xmllint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xmllint.c b/xmllint.c
+index c0712674..ba66676b 100644
+--- a/xmllint.c
++++ b/xmllint.c
+@@ -2204,7 +2204,7 @@ static void parseAndPrintFile(char *filename, xmlParserCtxtPtr rectxt) {
+ if (res > 0) {
+ ctxt = htmlCreatePushParserCtxt(NULL, NULL,
+ chars, res, filename, XML_CHAR_ENCODING_NONE);
+- xmlCtxtUseOptions(ctxt, options);
++ htmlCtxtUseOptions(ctxt, options);
+ while ((res = fread(chars, 1, pushsize, f)) > 0) {
+ htmlParseChunk(ctxt, chars, res, 0);
+ }
+--
+2.25.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb
index ad612379b3..6f1229c2d0 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb
@@ -25,6 +25,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
file://CVE-2020-24977.patch \
file://fix-python39.patch \
file://CVE-2021-3517.patch \
+ file://CVE-2021-3516.patch \
"
SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5"