<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On 28 October 2015 at 07:22, <span dir="ltr"><<a href="mailto:kai.kang@windriver.com" target="_blank">kai.kang@windriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">From: Kai Kang <<a href="mailto:kai.kang@windriver.com">kai.kang@windriver.com</a>><br>
<br>
Backport patch from:<br>
<br>
<a href="https://bugzilla.gnome.org/show_bug.cgi?id=746048" rel="noreferrer" target="_blank">https://bugzilla.gnome.org/show_bug.cgi?id=746048</a><br>
<br>
to fix valgrind errors and unsafe memory access.<br>
<br>
Fix the indentation by the way.<br>
<br>
Signed-off-by: Kai Kang <<a href="mailto:kai.kang@windriver.com">kai.kang@windriver.com</a>><br>
---<br>
.../libxml2/libxml2-fix-unsafe-memory-access.patch | 97 ++++++++++++++++++++++<br>
meta/recipes-core/libxml/<a href="http://libxml2_2.9.2.bb" rel="noreferrer" target="_blank">libxml2_2.9.2.bb</a> | 3 +-<br>
2 files changed, 99 insertions(+), 1 deletion(-)<br>
create mode 100644 meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch<br>
<br>
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch b/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch<br>
new file mode 100644<br>
index 0000000..b583032<br>
--- /dev/null<br>
+++ b/meta/recipes-core/libxml/libxml2/libxml2-fix-unsafe-memory-access.patch<br>
@@ -0,0 +1,97 @@<br>
+Upstream-Status: Backport<br>
</blockquote><div><br></div><div>This may be a nitpick but I don't think DV has taken this patch in the six months it's been available so it's not a backport.</div><div><br></div><div> - Jussi </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">+<br>
+Backport from<br>
+<br>
+<a href="https://bugzilla.gnome.org/show_bug.cgi?id=746048" rel="noreferrer" target="_blank">https://bugzilla.gnome.org/show_bug.cgi?id=746048</a><br>
+<br>
+to fix unsafe memory access.<br>
+<br>
+Signed-off-by: Kai Kang <<a href="mailto:kai.kang@windriver.com">kai.kang@windriver.com</a>><br>
+---<br>
+diff --git a/HTMLparser.c b/HTMLparser.c<br>
+index d329d3b..6f81424 100644<br>
+--- a/HTMLparser.c<br>
++++ b/HTMLparser.c<br>
+@@ -3245,13 +3245,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {<br>
+ ctxt->instate = state;<br>
+ return;<br>
+ }<br>
++ if ((ctxt->input->end - ctxt->input->cur) < 3) {<br>
++ ctxt->instate = XML_PARSER_EOF;<br>
++ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,<br>
++ "Comment not terminated\n", NULL, NULL);<br>
++ xmlFree(buf);<br>
++ return;<br>
++ }<br>
+ q = CUR_CHAR(ql);<br>
+ NEXTL(ql);<br>
+ r = CUR_CHAR(rl);<br>
+ NEXTL(rl);<br>
+ cur = CUR_CHAR(l);<br>
+ len = 0;<br>
+- while (IS_CHAR(cur) &&<br>
++ while (((ctxt->input->end - ctxt->input->cur) > 0) && IS_CHAR(cur) &&<br>
+ ((cur != '>') ||<br>
+ (r != '-') || (q != '-'))) {<br>
+ if (len + 5 >= size) {<br>
+@@ -3281,7 +3288,7 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {<br>
+ }<br>
+ }<br>
+ buf[len] = 0;<br>
+- if (!IS_CHAR(cur)) {<br>
++ if (!(ctxt->input->end - ctxt->input->cur) || !IS_CHAR(cur)) {<br>
+ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,<br>
+ "Comment not terminated \n<!--%.50s\n", buf, NULL);<br>
+ xmlFree(buf);<br>
+@@ -4465,6 +4472,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) {<br>
+ depth = ctxt->nameNr;<br>
+ while (1) {<br>
+ long cons = ctxt->nbChars;<br>
++ long rem = ctxt->input->end - ctxt->input->cur;<br>
+<br>
+ GROW;<br>
+<br>
+@@ -4540,7 +4548,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) {<br>
+ /*<br>
+ * Sometimes DOCTYPE arrives in the middle of the document<br>
+ */<br>
+- if ((CUR == '<') && (NXT(1) == '!') &&<br>
++ if ((rem >= 9) && (CUR == '<') && (NXT(1) == '!') &&<br>
+ (UPP(2) == 'D') && (UPP(3) == 'O') &&<br>
+ (UPP(4) == 'C') && (UPP(5) == 'T') &&<br>
+ (UPP(6) == 'Y') && (UPP(7) == 'P') &&<br>
+@@ -4554,7 +4562,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) {<br>
+ /*<br>
+ * First case : a comment<br>
+ */<br>
+- if ((CUR == '<') && (NXT(1) == '!') &&<br>
++ if ((rem >= 4) && (CUR == '<') && (NXT(1) == '!') &&<br>
+ (NXT(2) == '-') && (NXT(3) == '-')) {<br>
+ htmlParseComment(ctxt);<br>
+ }<br>
+@@ -4562,14 +4570,14 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) {<br>
+ /*<br>
+ * Second case : a Processing Instruction.<br>
+ */<br>
+- else if ((CUR == '<') && (NXT(1) == '?')) {<br>
++ else if ((rem >= 2) && (CUR == '<') && (NXT(1) == '?')) {<br>
+ htmlParsePI(ctxt);<br>
+ }<br>
+<br>
+ /*<br>
+ * Third case : a sub-element.<br>
+ */<br>
+- else if (CUR == '<') {<br>
++ else if ((rem >= 1) && (CUR == '<')) {<br>
+ htmlParseElementInternal(ctxt);<br>
+ if (currentNode != NULL) xmlFree(currentNode);<br>
+<br>
+@@ -4581,7 +4589,7 @@ htmlParseContentInternal(htmlParserCtxtPtr ctxt) {<br>
+ * Fourth case : a reference. If if has not been resolved,<br>
+ * parsing returns it's Name, create the node<br>
+ */<br>
+- else if (CUR == '&') {<br>
++ else if ((rem >= 1) && (CUR == '&')) {<br>
+ htmlParseReference(ctxt);<br>
+ }<br>
+<br>
diff --git a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.2.bb" rel="noreferrer" target="_blank">libxml2_2.9.2.bb</a> b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.2.bb" rel="noreferrer" target="_blank">libxml2_2.9.2.bb</a><br>
index 79a395c..4cafc87 100644<br>
--- a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.2.bb" rel="noreferrer" target="_blank">libxml2_2.9.2.bb</a><br>
+++ b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.2.bb" rel="noreferrer" target="_blank">libxml2_2.9.2.bb</a><br>
@@ -2,7 +2,8 @@ require libxml2.inc<br>
<br>
SRC_URI += "<a href="http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar" rel="noreferrer" target="_blank">http://www.w3.org/XML/Test/xmlts20080827.tar.gz;name=testtar</a> \<br>
file://72a46a519ce7326d9a00f0b6a7f2a8e958cd1675.patch \<br>
- file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \<br>
+ file://0001-threads-Define-pthread-definitions-for-glibc-complia.patch \<br>
+ file://libxml2-fix-unsafe-memory-access.patch \<br>
"<br>
<br>
SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788"<br>
<span class="HOEnZb"><font color="#888888">--<br>
2.6.1<br>
<br>
--<br>
_______________________________________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</font></span></blockquote></div><br></div></div>