diff options
| author |   Tony Tascioglu <tony.tascioglu@windriver.com> | 2021-05-20 17:13:04 -0400 |
|---|---|---|
| committer |   Tim Orling <timothy.t.orling@intel.com> | 2021-07-18 16:59:31 -0700 |
| commit | c68ee1d5c1c5e3bac27ee0aa33ed78f900824419 (patch) | |
| tree | 6ada85b3496e86f8c98bd049bb271a4a1671332b /meta/recipes-core/libxml/libxml2/CVE-2019-20388.patch | |
| parent | cfd74f2bae51413d9c327e0f08ecf751325c2d74 (diff) | |
| download | openembedded-core-contrib-timo/dunfell/libxml2-2.9.12.tar.gz | |
libxml2: Update to 2.9.12timo/dunfell/libxml2-2.9.12
Drop CVE patches which are fixed by the new upstream version.
Modify conflicting patches to apply to the new versions:
libxml2/libxml-m4-use-pkgconfig.patch
libxml2/0001-Make-ptest-run-the-python-tests-if-python-is-enabled.patch
Drop fix-python39, which is merged upstream.
Removed hunk for tstLastError.py from
libxml2/0001-Make-ptest-run-the-python-tests-if-python-is-enabled.patch
since it has been fixed upstream by:
8c3e52e: Updated python/tests/tstLastError.py
libxml2.registerErrorHandler(None,None):
None is not acceptable as first argument
failUnlessEqual replaced by assertEqual
The checksums for the licence file changed because a typo was fixed
across the files. The licence remains the same.
The obsolete MD5 checksums for the tar files have been dropped in
favor of SHA256.
The new release also adds fuzz tests, which are removed from the
makefile to allow the ptests to run. Fuzz testing is done upstream
and there is no need to run them as part of ptests which are
intended for functionality testing.
(From OE-Core rev: c7c429d05ca51b0404f09981f6c9bcad7dc33222)
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport to dunfell
Fixes CVE-2021-3541
References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3541
https://bugzilla.redhat.com/show_bug.cgi?id=1950515
Signed-off-by: Tim Orling <timothy.t.orling@intel.com>
Diffstat (limited to 'meta/recipes-core/libxml/libxml2/CVE-2019-20388.patch')
| -rw-r--r-- | meta/recipes-core/libxml/libxml2/CVE-2019-20388.patch | 37 |
1 files changed, 0 insertions, 37 deletions
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2019-20388.patch b/meta/recipes-core/libxml/libxml2/CVE-2019-20388.patch deleted file mode 100644 index 88eb65a6a5..0000000000 --- a/meta/recipes-core/libxml/libxml2/CVE-2019-20388.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 7ffcd44d7e6c46704f8af0321d9314cd26e0e18a Mon Sep 17 00:00:00 2001 -From: Zhipeng Xie <xiezhipeng1@huawei.com> -Date: Tue, 20 Aug 2019 16:33:06 +0800 -Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream - -When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun -alloc a new schema for ctxt->schema and set vctxt->xsiAssemble -to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize -vctxt->xsiAssemble to 0 again which cause the alloced schema -can not be freed anymore. - -Found with libFuzzer. - -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a] -CVE: CVE-2019-20388 - -Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com> -Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> ---- - xmlschemas.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/xmlschemas.c b/xmlschemas.c -index 301c8449..39d92182 100644 ---- a/xmlschemas.c -+++ b/xmlschemas.c -@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) { - vctxt->nberrors = 0; - vctxt->depth = -1; - vctxt->skipDepth = -1; -- vctxt->xsiAssemble = 0; - vctxt->hasKeyrefs = 0; - #ifdef ENABLE_IDC_NODE_TABLES_TEST - vctxt->createIDCNodeTables = 1; --- -2.24.1 - |