<div dir="ltr">I see part 1 and 2 but no part 3.<div><br></div><div>Also, have you asked upstream if they'll be making a point release with these in?</div><div><br></div><div>Ross</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 12 December 2016 at 13:20, Andrej Valek <span dir="ltr"><<a href="mailto:andrej.valek@siemens.com" target="_blank">andrej.valek@siemens.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">xpath:<br>
- Check for errors after evaluating first operand.<br>
- Add sanity check for empty stack.<br>
- Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes<br>
<br>
Signed-off-by: Andrej Valek <<a href="mailto:andrej.valek@siemens.com">andrej.valek@siemens.com</a>><br>
Signed-off-by: Pascal Bach <<a href="mailto:pascal.bach@siemens.com">pascal.bach@siemens.com</a>><br>
---<br>
.../libxml2/libxml2-fix_node_<wbr>comparison.patch | 67 ++++++++++++++++++++++<br>
meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">libxm<wbr>l2_2.9.4.bb</a> | 1 +<br>
2 files changed, 68 insertions(+)<br>
create mode 100644 meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_node_<wbr>comparison.patch<br>
<br>
diff --git a/meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_node_<wbr>comparison.patch b/meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_node_<wbr>comparison.patch<br>
new file mode 100644<br>
index 0000000..11718bb<br>
--- /dev/null<br>
+++ b/meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_node_<wbr>comparison.patch<br>
@@ -0,0 +1,67 @@<br>
+libxml2-2.9.4: Fix comparison with root node in xmlXPathCmpNodes and NULL pointer deref in XPointer<br>
+<br>
+xpath:<br>
+ - Check for errors after evaluating first operand.<br>
+ - Add sanity check for empty stack.<br>
+ - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes<br>
+<br>
+Upstream-Status: Backported<br>
+ - [<a href="https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b" rel="noreferrer" target="_blank">https://git.gnome.org/browse/<wbr>libxml2/commit/?id=<wbr>c1d1f7121194036608bf555f08d306<wbr>2a36fd344b</a>]<br>
+ - [<a href="https://git.gnome.org/browse/libxml2/commit/?id=a005199330b86dada19d162cae15ef9bdcb6baa8" rel="noreferrer" target="_blank">https://git.gnome.org/browse/<wbr>libxml2/commit/?id=<wbr>a005199330b86dada19d162cae15ef<wbr>9bdcb6baa8</a>]<br>
+CVE: necessary changes for fixing CVE-2016-5131<br>
+Signed-off-by: Andrej Valek <<a href="mailto:andrej.valek@siemens.com">andrej.valek@siemens.com</a>><br>
+Signed-off-by: Pascal Bach <<a href="mailto:pascal.bach@siemens.com">pascal.bach@siemens.com</a>><br>
+<br>
+diff --git a/result/XPath/xptr/viderror b/result/XPath/xptr/viderror<br>
+new file mode 100644<br>
+index 0000000..d589882<br>
+--- /dev/null<br>
++++ b/result/XPath/xptr/viderror<br>
+@@ -0,0 +1,4 @@<br>
++<br>
++========================<br>
++Expression: xpointer(non-existing-fn()/<wbr>range-to(id('chapter2')))<br>
++Object is empty (NULL)<br>
+diff --git a/test/XPath/xptr/viderror b/test/XPath/xptr/viderror<br>
+new file mode 100644<br>
+index 0000000..da8c53b<br>
+--- /dev/null<br>
++++ b/test/XPath/xptr/viderror<br>
+@@ -0,0 +1 @@<br>
++xpointer(non-existing-fn()/<wbr>range-to(id('chapter2')))<br>
+diff --git a/xpath.c b/xpath.c<br>
+index 113bce6..d992841 100644<br>
+--- a/xpath.c<br>
++++ b/xpath.c<br>
+@@ -3342,13 +3342,13 @@ xmlXPathCmpNodes(xmlNodePtr node1, xmlNodePtr node2) {<br>
+ * compute depth to root<br>
+ */<br>
+ for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {<br>
+- if (cur == node1)<br>
++ if (cur->parent == node1)<br>
+ return(1);<br>
+ depth2++;<br>
+ }<br>
+ root = cur;<br>
+ for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {<br>
+- if (cur == node2)<br>
++ if (cur->parent == node2)<br>
+ return(-1);<br>
+ depth1++;<br>
+ }<br>
+@@ -14005,9 +14005,14 @@ xmlXPathCompOpEval(<wbr>xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)<br>
+ xmlNodeSetPtr oldset;<br>
+ int i, j;<br>
+<br>
+- if (op->ch1 != -1)<br>
++ if (op->ch1 != -1) {<br>
+ total +=<br>
+ xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);<br>
++ CHECK_ERROR0;<br>
++ }<br>
++ if (ctxt->value == NULL) {<br>
++ XP_ERROR0(XPATH_INVALID_<wbr>OPERAND);<br>
++ }<br>
+ if (op->ch2 == -1)<br>
+ return (total);<br>
+<br>
diff --git a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a> b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a><br>
index 1fed90b..66a8940 100644<br>
--- a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a><br>
+++ b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a><br>
@@ -19,6 +19,7 @@ SRC_URI = "<a href="ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar" rel="noreferrer" target="_blank">ftp://xmlsoft.org/libxml2/<wbr>libxml2-${PV}.tar.gz;name=<wbr>libtar</a> \<br>
file://run-ptest \<br>
file://python-sitepackages-<wbr>dir.patch \<br>
file://libxml-m4-use-<wbr>pkgconfig.patch \<br>
+ file://libxml2-fix_node_<wbr>comparison.patch \<br>
file://libxml2-CVE-2016-5131.<wbr>patch \<br>
"<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
2.1.4<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote></div><br></div>