[OE-core] [PATCH][V2][Jethro, fido 01/10] libxml2: security fix CVE-2015-7941

[akuster808]

On 01/11/2016 07:38 PM, Robert Yang wrote:
> 
> Hi Armin,
> 
> 
> I got strange errors when apply the patches:
> 
> $ git am /tmp/jethro/*libxml2*
> [snip]
> Applying: libxml2: security fix CVE-2015-7500
> /buildarea/lyang1/poky/.git/rebase-apply/patch:80: trailing whitespace.
> 
> /buildarea/lyang1/poky/.git/rebase-apply/patch:82: space before tab in
> indent.
>            ((RAW != '/') || (NXT(1) != '>')) &&
> /buildarea/lyang1/poky/.git/rebase-apply/patch:84: trailing whitespace.
> 
> /buildarea/lyang1/poky/.git/rebase-apply/patch:85: space before tab in
> indent.
>         attname = xmlParseAttribute2(ctxt, prefix, localname,
> /buildarea/lyang1/poky/.git/rebase-apply/patch:86: space before tab in
> indent.
>                                      &aprefix, &attvalue, &len, &alloc);
> fatal: corrupt patch at line 300
> Patch failed at 0008 libxml2: security fix CVE-2015-7500
> 
> Would you please put the patches to a repo ? so that I can fetch them ?

sure thing.

armin
> 
> // Robert
> 
> On 01/08/2016 08:48 AM, Armin Kuster wrote:
>> From: Armin Kuster <akuster at mvista.com>
>>
>> includes:
>> CVE-2015-7941-1
>> CVE-2015-7941-2
>>
>> Signed-off-by: Armin Kuster <akuster at mvista.com>
>> ---
>>   meta/recipes-core/libxml/libxml2.inc               |  2 +
>>   ...top-parsing-on-entities-boundaries-errors.patch | 39 +++++++++++++++
>>   ...leanup-conditional-section-error-handling.patch | 56
>> ++++++++++++++++++++++
>>   3 files changed, 97 insertions(+)
>>   create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
>>
>>   create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
>>
>>
>> diff --git a/meta/recipes-core/libxml/libxml2.inc
>> b/meta/recipes-core/libxml/libxml2.inc
>> index 1c3c37d..24b98a6 100644
>> --- a/meta/recipes-core/libxml/libxml2.inc
>> +++ b/meta/recipes-core/libxml/libxml2.inc
>> @@ -21,6 +21,8 @@ SRC_URI =
>> "ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar \
>>              file://libxml-m4-use-pkgconfig.patch \
>>              file://configure.ac-fix-cross-compiling-warning.patch \
>>             
>> file://0001-CVE-2015-1819-Enforce-the-reader-to-run-in-constant-.patch \
>> +          
>> file://CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch \
>> +          
>> file://CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch \
>>             "
>>
>>   BINCONFIG = "${bindir}/xml2-config"
>> diff --git
>> a/meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
>> b/meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
>>
>> new file mode 100644
>> index 0000000..11da9f9
>> --- /dev/null
>> +++
>> b/meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
>>
>> @@ -0,0 +1,39 @@
>> +From a7dfab7411cbf545f359dd3157e5df1eb0e7ce31 Mon Sep 17 00:00:00 2001
>> +From: Daniel Veillard <veillard at redhat.com>
>> +Date: Mon, 23 Feb 2015 11:17:35 +0800
>> +Subject: [PATCH] Stop parsing on entities boundaries errors
>> +
>> +For https://bugzilla.gnome.org/show_bug.cgi?id=744980
>> +
>> +There are times, like on unterminated entities that it's preferable to
>> +stop parsing, even if that means less error reporting. Entities are
>> +feeding the parser on further processing, and if they are ill defined
>> +then it's possible to get the parser to bug. Also do the same on
>> +Conditional Sections if the input is broken, as the structure of
>> +the document can't be guessed.
>> +
>> +Upstream-Status: Backport
>> +
>> +CVE-2015-7941-1
>> +
>> +Signed-off-by: Armin Kuster <akuster at mvista.com>
>> +
>> +---
>> + parser.c | 1 +
>> + 1 file changed, 1 insertion(+)
>> +
>> +diff --git a/parser.c b/parser.c
>> +index a8d1b67..bbe97eb 100644
>> +--- a/parser.c
>> ++++ b/parser.c
>> +@@ -5658,6 +5658,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
>> +     if (RAW != '>') {
>> +         xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
>> +                 "xmlParseEntityDecl: entity %s not terminated\n",
>> name);
>> ++        xmlStopParser(ctxt);
>> +     } else {
>> +         if (input != ctxt->input) {
>> +         xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
>> +--
>> +2.3.5
>> +
>> diff --git
>> a/meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
>> b/meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
>>
>> new file mode 100644
>> index 0000000..b7bd960
>> --- /dev/null
>> +++
>> b/meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
>>
>> @@ -0,0 +1,56 @@
>> +From 9b8512337d14c8ddf662fcb98b0135f225a1c489 Mon Sep 17 00:00:00 2001
>> +From: Daniel Veillard <veillard at redhat.com>
>> +Date: Mon, 23 Feb 2015 11:29:20 +0800
>> +Subject: [PATCH] Cleanup conditional section error handling
>> +
>> +For https://bugzilla.gnome.org/show_bug.cgi?id=744980
>> +
>> +The error handling of Conditional Section also need to be
>> +straightened as the structure of the document can't be
>> +guessed on a failure there and it's better to stop parsing
>> +as further errors are likely to be irrelevant.
>> +
>> +Upstream-Status: Backport
>> +
>> +CVE-2015-7941-2
>> +
>> +Signed-off-by: Armin Kuster <akuster at mvista.com>
>> +
>> +---
>> + parser.c | 6 ++++++
>> + 1 file changed, 6 insertions(+)
>> +
>> +diff --git a/parser.c b/parser.c
>> +index bbe97eb..fe603ac 100644
>> +--- a/parser.c
>> ++++ b/parser.c
>> +@@ -6770,6 +6770,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr
>> ctxt) {
>> +     SKIP_BLANKS;
>> +     if (RAW != '[') {
>> +         xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
>> ++        xmlStopParser(ctxt);
>> ++        return;
>> +     } else {
>> +         if (ctxt->input->id != id) {
>> +         xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
>> +@@ -6830,6 +6832,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr
>> ctxt) {
>> +     SKIP_BLANKS;
>> +     if (RAW != '[') {
>> +         xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
>> ++        xmlStopParser(ctxt);
>> ++        return;
>> +     } else {
>> +         if (ctxt->input->id != id) {
>> +         xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
>> +@@ -6885,6 +6889,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr
>> ctxt) {
>> +
>> +     } else {
>> +     xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
>> ++    xmlStopParser(ctxt);
>> ++    return;
>> +     }
>> +
>> +     if (RAW == 0)
>> +--
>> +2.3.5
>> +
>>