<br><br>On Tuesday, September 17, 2013, Burton, Ross wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 17 September 2013 03:36, Hongxu Jia <<a href="javascript:;" onclick="_e(event, 'cvml', 'hongxu.jia@windriver.com')">hongxu.jia@windriver.com</a>> wrote:<br>
> The upstream of libxml2 has not fixed this issue:<br>
> git clone git://<a href="http://git.gnome.org/libxml2" target="_blank">git.gnome.org/libxml2</a><br>
><br>
> And I have filed a bug to them<br>
> <a href="https://bugzilla.gnome.org/show_bug.cgi?id=708205" target="_blank">https://bugzilla.gnome.org/show_bug.cgi?id=708205</a><br>
><br>
> After this is fixed and released, also need to report another<br>
> bug to LSB to update their libxml2 source code.<br>
><br>
> The time cycle is long, should we mark this bug as "Waiting For Upstream"<br>
> or accept this patch to workaround for LSB test.<br>
<br>
Using my amazing ability of talking to the upstream maintainer (DV in<br>
#xml on <a href="http://irc.gnome.org" target="_blank">irc.gnome.org</a>) I've sorted this out.<br>
<br>
The CVE is for *Chromium's fork of libxml*. Not upstream libxml2.<br>
The patch changes a public structure by adding fields *in the middle*,<br>
so that broke the ABI. That's two good reasons to revert the patch.<br>
As Daniel has said in the bug, this patch was the quick fix that<br>
Chromium did as they statically link to libxml2 so the API breakage<br>
isn't an issue, the proper fix is already in libxslt. As long as we<br>
have libxml 2.9.0 and libxslt 1.1.27 onwards (which we do), the issue<br>
is correctly fixed.</blockquote><div><br></div><div>Thanks for sorting this out in real good way </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
So, NAK to this patch, and a revert incoming.<br>
<br>
Ross<br>
</blockquote>