<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Arial","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Hi Ross,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">I think, there was a web-page delay. Patch 3/3 is already there:
<a href="http://lists.openembedded.org/pipermail/openembedded-core/2016-December/130046.html">
http://lists.openembedded.org/pipermail/openembedded-core/2016-December/130046.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D">Andrej<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Burton, Ross [mailto:ross.burton@intel.com]
<br>
<b>Sent:</b> 12. decembra 2016 14:44<br>
<b>To:</b> Valek, Andrej (CT DD DS EU SK BT)<br>
<b>Cc:</b> OE-core<br>
<b>Subject:</b> Re: [OE-core] [PATCH 1/3] libxml2: Necessary changes before fixing CVE-2016-5131 Fix comaparation with root node in xmlXPathCmpNodes and NULL pointer deref in XPointer<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I see part 1 and 2 but no part 3.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Also, have you asked upstream if they'll be making a point release with these in?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ross<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 12 December 2016 at 13:20, Andrej Valek <<a href="mailto:andrej.valek@siemens.com" target="_blank">andrej.valek@siemens.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">xpath:<br>
- Check for errors after evaluating first operand.<br>
- Add sanity check for empty stack.<br>
- Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes<br>
<br>
Signed-off-by: Andrej Valek <<a href="mailto:andrej.valek@siemens.com">andrej.valek@siemens.com</a>><br>
Signed-off-by: Pascal Bach <<a href="mailto:pascal.bach@siemens.com">pascal.bach@siemens.com</a>><br>
---<br>
.../libxml2/libxml2-fix_node_comparison.patch | 67 ++++++++++++++++++++++<br>
meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" target="_blank">libxml2_2.9.4.bb</a> | 1 +<br>
2 files changed, 68 insertions(+)<br>
create mode 100644 meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch<br>
<br>
diff --git a/meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch b/meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch<br>
new file mode 100644<br>
index 0000000..11718bb<br>
--- /dev/null<br>
+++ b/meta/recipes-core/libxml/libxml2/libxml2-fix_node_comparison.patch<br>
@@ -0,0 +1,67 @@<br>
+libxml2-2.9.4: Fix comparison with root node in xmlXPathCmpNodes and NULL pointer deref in XPointer<br>
+<br>
+xpath:<br>
+ - Check for errors after evaluating first operand.<br>
+ - Add sanity check for empty stack.<br>
+ - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes<br>
+<br>
+Upstream-Status: Backported<br>
+ - [<a href="https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b" target="_blank">https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b</a>]<br>
+ - [<a href="https://git.gnome.org/browse/libxml2/commit/?id=a005199330b86dada19d162cae15ef9bdcb6baa8" target="_blank">https://git.gnome.org/browse/libxml2/commit/?id=a005199330b86dada19d162cae15ef9bdcb6baa8</a>]<br>
+CVE: necessary changes for fixing CVE-2016-5131<br>
+Signed-off-by: Andrej Valek <<a href="mailto:andrej.valek@siemens.com">andrej.valek@siemens.com</a>><br>
+Signed-off-by: Pascal Bach <<a href="mailto:pascal.bach@siemens.com">pascal.bach@siemens.com</a>><br>
+<br>
+diff --git a/result/XPath/xptr/viderror b/result/XPath/xptr/viderror<br>
+new file mode 100644<br>
+index 0000000..d589882<br>
+--- /dev/null<br>
++++ b/result/XPath/xptr/viderror<br>
+@@ -0,0 +1,4 @@<br>
++<br>
++========================<br>
++Expression: xpointer(non-existing-fn()/range-to(id('chapter2')))<br>
++Object is empty (NULL)<br>
+diff --git a/test/XPath/xptr/viderror b/test/XPath/xptr/viderror<br>
+new file mode 100644<br>
+index 0000000..da8c53b<br>
+--- /dev/null<br>
++++ b/test/XPath/xptr/viderror<br>
+@@ -0,0 +1 @@<br>
++xpointer(non-existing-fn()/range-to(id('chapter2')))<br>
+diff --git a/xpath.c b/xpath.c<br>
+index 113bce6..d992841 100644<br>
+--- a/xpath.c<br>
++++ b/xpath.c<br>
+@@ -3342,13 +3342,13 @@ xmlXPathCmpNodes(xmlNodePtr node1, xmlNodePtr node2) {<br>
+ * compute depth to root<br>
+ */<br>
+ for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {<br>
+- if (cur == node1)<br>
++ if (cur->parent == node1)<br>
+ return(1);<br>
+ depth2++;<br>
+ }<br>
+ root = cur;<br>
+ for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {<br>
+- if (cur == node2)<br>
++ if (cur->parent == node2)<br>
+ return(-1);<br>
+ depth1++;<br>
+ }<br>
+@@ -14005,9 +14005,14 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)<br>
+ xmlNodeSetPtr oldset;<br>
+ int i, j;<br>
+<br>
+- if (op->ch1 != -1)<br>
++ if (op->ch1 != -1) {<br>
+ total +=<br>
+ xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);<br>
++ CHECK_ERROR0;<br>
++ }<br>
++ if (ctxt->value == NULL) {<br>
++ XP_ERROR0(XPATH_INVALID_OPERAND);<br>
++ }<br>
+ if (op->ch2 == -1)<br>
+ return (total);<br>
+<br>
diff --git a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" target="_blank">libxml2_2.9.4.bb</a> b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" target="_blank">libxml2_2.9.4.bb</a><br>
index 1fed90b..66a8940 100644<br>
--- a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" target="_blank">libxml2_2.9.4.bb</a><br>
+++ b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" target="_blank">libxml2_2.9.4.bb</a><br>
@@ -19,6 +19,7 @@ SRC_URI = "<a href="ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar" target="_blank">ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar</a> \<br>
file://run-ptest \<br>
file://python-sitepackages-dir.patch \<br>
file://libxml-m4-use-pkgconfig.patch \<br>
+ file://libxml2-fix_node_comparison.patch \<br>
file://libxml2-CVE-2016-5131.patch \<br>
"<br>
<span style="color:#888888"><br>
<span class="hoenzb">--</span><br>
<span class="hoenzb">2.1.4</span><br>
<br>
<span class="hoenzb">--</span><br>
<span class="hoenzb">_______________________________________________</span><br>
<span class="hoenzb">Openembedded-core mailing list</span><br>
<span class="hoenzb"><a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.openembedded.org</a></span><br>
<span class="hoenzb"><a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a></span></span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>