libxml2: Security fix for CVE-2016-3627

Affects libxml2 < 2.9.4

Signed-off-by: Armin Kuster <akuster@mvista.com>

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-3627.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-3627.patch
new file mode 100644 (file)
index 0000000..2de9c5e
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2016-3627.patch
@@ -0,0 +1,64 @@
+From bdd66182ef53fe1f7209ab6535fda56366bd7ac9 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Mon, 23 May 2016 12:27:58 +0800
+Subject: [PATCH] Avoid building recursive entities
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=762100
+
+When we detect a recusive entity we should really not
+build the associated data, moreover if someone bypass
+libxml2 fatal errors and still tries to serialize a broken
+entity make sure we don't risk to get ito a recursion
+
+* parser.c: xmlParserEntityCheck() don't build if entity loop
+  were found and remove the associated text content
+* tree.c: xmlStringGetNodeList() avoid a potential recursion
+
+Upstream-Status: Backport
+CVE: CVE-2016-3627
+Signed-off-by: Armin Kuster <akuster@mvsita.com
+
+---
+ parser.c | 6 +++++-
+ tree.c   | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index ea0e89e..53a6b7f 100644
+--- a/parser.c
++++ b/parser.c
+@@ -138,7 +138,8 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+      * entities problems
+      */
+     if ((ent != NULL) && (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
+-      (ent->content != NULL) && (ent->checked == 0)) {
++      (ent->content != NULL) && (ent->checked == 0) &&
++      (ctxt->errNo != XML_ERR_ENTITY_LOOP)) {
+       unsigned long oldnbent = ctxt->nbentities;
+       xmlChar *rep;
+ 
+@@ -148,6 +149,9 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+       rep = xmlStringDecodeEntities(ctxt, ent->content,
+                                 XML_SUBSTITUTE_REF, 0, 0, 0);
+         --ctxt->depth;
++      if (ctxt->errNo == XML_ERR_ENTITY_LOOP) {
++          ent->content[0] = 0;
++      }
+ 
+       ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
+       if (rep != NULL) {
+diff --git a/tree.c b/tree.c
+index 7fbca6e..9d330b8 100644
+--- a/tree.c
++++ b/tree.c
+@@ -1593,6 +1593,7 @@ xmlStringGetNodeList(const xmlDoc *doc, const xmlChar *value) {
+                       else if ((ent != NULL) && (ent->children == NULL)) {
+                           xmlNodePtr temp;
+ 
++                          ent->children = (xmlNodePtr) -1;
+                           ent->children = xmlStringGetNodeList(doc,
+                                   (const xmlChar*)node->content);
+                           ent->owner = 1;
+-- 
+2.3.5
+

diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb
index 76efa9ffcae4c83fdda75e7c23c4c7296b07596d..90f7a7ab79452dd5da1561b8e1d17ee4393ae966 100644 (file)
--- a/meta/recipes-core/libxml/libxml2_2.9.2.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb
@@ -16,6 +16,7 @@ SRC_URI += "file://CVE-2016-1762.patch \
             file://CVE-2016-1837.patch \
             file://CVE-2016-1835.patch \
             file://CVE-2016-1833.patch \
+            file://CVE-2016-3627.patch \
     "
 
 SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788"