<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 09/17/2013 01:09 AM, Khem Raj wrote:<br>
</div>
<blockquote
cite="mid:C187B0ED-19E6-47C1-AD22-CF80F1EC19B3@gmail.com"
type="cite">
<pre wrap="">
On Sep 16, 2013, at 4:14 AM, Hongxu Jia <a class="moz-txt-link-rfc2396E" href="mailto:hongxu.jia@windriver.com"><hongxu.jia@windriver.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">The commit
<a class="moz-txt-link-freetext" href="http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=8780c5ddf2916bbd42fc67b79c286652aebb1546">http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=8780c5ddf2916bbd42fc67b79c286652aebb1546</a>
add a patch to fix a security issue. It modify include file 'tree.h'
to add 'const char *dummy_children' on 'struct _xmlNs'.
But lsb test suites didn't do this in his own include file, so the LSB
desktop-xml tests failed.
</pre>
</blockquote>
<pre wrap="">
IMO the testcase should be fixed. This is security patch that you are disabling. I don't think LSB compliance
should mean less secure
</pre>
</blockquote>
<br>
The upstream of libxml2 has not fixed this issue:<br>
git clone git://git.gnome.org/libxml2<br>
<br>
And I have filed a bug to them<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a href="https://bugzilla.gnome.org/show_bug.cgi?id=708205">https://bugzilla.gnome.org/show_bug.cgi?id=708205</a><br>
<br>
After this is fixed and released, also need to report another<br>
bug to LSB to update their libxml2 source code.<br>
<br>
The time cycle is long, should we mark this bug as "Waiting For
Upstream"<br>
or accept this patch to workaround for LSB test.<br>
<br>
Thanks,<br>
Hongxu<br>
<br>
<blockquote
cite="mid:C187B0ED-19E6-47C1-AD22-CF80F1EC19B3@gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">
Disable this patch for linuxstdbase could fix this issue.
[YOCTO #5151]
Signed-off-by: Hongxu Jia <a class="moz-txt-link-rfc2396E" href="mailto:hongxu.jia@windriver.com"><hongxu.jia@windriver.com></a>
---
meta/recipes-core/libxml/libxml2_2.9.1.bb | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/libxml/libxml2_2.9.1.bb b/meta/recipes-core/libxml/libxml2_2.9.1.bb
index fa9c657..3b031a1 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.1.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.1.bb
@@ -1,6 +1,9 @@
require libxml2.inc
-SRC_URI += <a class="moz-txt-link-rfc2396E" href="file://libxml2-CVE-2012-2871.patch\+LIBXML2_CVE=">"file://libxml2-CVE-2012-2871.patch \
+LIBXML2_CVE = "</a<a class="moz-txt-link-rfc2396E" href="file://libxml2-CVE-2012-2871.patch">"file://libxml2-CVE-2012-2871.patch"</a>
+LIBXML2_CVE_linuxstdbase = ""
+
+SRC_URI += "${LIBXML2_CVE} \
<a class="moz-txt-link-freetext" href="http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar">http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar</a> \
"
--
1.8.1.2
_______________________________________________
Openembedded-core mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.openembedded.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openembedded.org/mailman/listinfo/openembedded-core">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
</body>
</html>