aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/libxml/libxml2_2.9.4.bb
AgeCommit message (Collapse)Author
2017-11-05libxml2: 2.9.4 -> 2.9.5Andrej Valek
Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-10-16libxml2: use HTTP instead of FTP in SRC_URIRoss Burton
HTTP is more reliable in general so use it instead of FTP. Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-10-06libxml2-ptest: support for encoding ISO-8859-5Juro Bystricky
This fixes the error: ./test/errors/759398.xml:1: parser error : Unsupported encoding ISO-8859-5 <?xml version='1.0' encoding='ISO-8859-5' standalone='no'?> ^ ./test/errors/759398.xml : failed to parse FAIL: Error cases stream regression tests Signed-off-by: Juro Bystricky <juro.bystricky@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-10-06libxml2-ptest: improve reproducibilityJuro Bystricky
Remove various build host references from libxml-ptest package. [YOCTO #11997] Signed-off-by: Juro Bystricky <juro.bystricky@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-08-27libxml2: Fix CVE-2017-8872Hongxu Jia
fix global-buffer-overflow in htmlParseTryOrFinish (HTMLparser.c:5403) https://bugzilla.gnome.org/show_bug.cgi?id=775200 Here is the reproduce steps on ubuntu 16.04, use clang with "-fsanitize=address" ... export CC="clang" export CFLAGS="-fsanitize=address" ./configure --disable-shared make clean all -j wget https://bugzilla.gnome.org/attachment.cgi?id=340871 -O poc ./xmllint --html --push poc ==2785==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000a0de21 at pc 0x0000006a7f6e bp 0x7ffdfe940c10 sp 0x7ffdfe940c08 READ of size 1 at 0x000000a0de21 thread T0 #0 0x6a7f6d (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x6a7f6d) #1 0x6a7356 (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x6a7356) #2 0x4f4504 (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x4f4504) #3 0x4f045e (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x4f045e) #4 0x7f81977d682f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #5 0x419ad8 (/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x419ad8) ... Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-06-23libxml2: Revert "Add an XML_PARSE_NOXXE flag to block all entities loading ↵Andrej Valek
even local" The new flag doesn't work and the change even broke the XML_PARSE_NONET option. Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
2017-06-23libxml2: Fix CVE-2017-0663Andrej Valek
Fix type confusion in xmlValidateOneNamespace Comment out code that casts xmlNsPtr to xmlAttrPtr. ID types on namespace declarations make no practical sense anyway. Fixes bug 780228 CVE: CVE-2017-0663 Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
2017-06-23libxml2: Fix CVE-2017-5969Andrej Valek
Fix NULL pointer deref in xmlDumpElementContent Can only be triggered in recovery mode. Fixes bug 758422 CVE: CVE-2017-5969 Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
2017-06-23libxml2: Fix CVE-2017-9049 and CVE-2017-9050Andrej Valek
Fix handling of parameter-entity references There were two bugs where parameter-entity references could lead to an unexpected change of the input buffer in xmlParseNameComplex and xmlDictLookup being called with an invalid pointer. Fixes bug 781205 and bug 781361 CVE: CVE-2017-9049 CVE-2017-9050 Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
2017-06-23libxml2: Fix CVE-2017-9047 and CVE-2017-9048Andrej Valek
xmlSnprintfElementContent failed to correctly check the available buffer space in two locations. Fixes bug 781333 and bug 781701 CVE: CVE-2017-9047 CVE-2017-9048 Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
2017-06-23libxml2: Avoid reparsing and simplify control flow in xmlParseStartTag2Andrej Valek
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
2017-06-12libxml2: Make ptest run the Python tests if Python support is enabledPeter Kjellerstedt
Since we go through the trouble of copying the Python tests, we may as well actually run them... This also avoids the following QA issue: ERROR: libxml2-2.9.4-r0 do_package_qa: QA Issue: /usr/lib/libxml2/ptest/python/tests/push.py contained in package libxml2-ptest requires /usr/bin/python, but no providers found in RDEPENDS_libxml2-ptest? [file-rdeps] Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-05-10libxml2: move python module to Python 3Alexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-04-28libxml2: CVE-2016-9318Catalin Enache
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318 Upstream patch: https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0 Signed-off-by: Catalin Enache <catalin.enache@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-04-05libxml2: make dependencies on python conditionalDmitry Rozhkov
The library libxml2 can provide its own bindings for python2 in addition to the third party python-lxml and python3-lxml packages if this functionality is enabled in PACKAGECONFIG. But in case the functionality is disabled there's no need to depend on python2. Make the dependency on python2 enabled only if the python feature is added to PACKAGECONFIG. Also add missing run-time dependency on make to libxml2-ptest. Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01recipes: Make use of the new bb.utils.filter() functionPeter Kjellerstedt
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-28libxml2: Drop docs in native caseRichard Purdie
With rss, moving these around was having an increasing overhead and we don't need them in the native case so remove them. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-12-16meta: remove True option to getVar callsJoshua Lock
getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Search made with the following regex: getVar ?\(( ?[^,()]*), True\) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16libxml2: Fix more NULL pointer derefsAndrej Valek
The NULL pointer dereferencing could produced some security problems. This is a preventive security fix. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16libxml2: fix CVE-2016-4658 Disallow namespace nodes in XPointer points and ↵Andrej Valek
ranges Namespace nodes must be copied to avoid use-after-free errors. But they don't necessarily have a physical representation in a document, so simply disallow them in XPointer ranges. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-16libxml2: Necessary changes before fixing CVE-2016-5131Andrej Valek
xpath: - Check for errors after evaluating first operand. - Add sanity check for empty stack. - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-11-30libxml2: Security fix CVE-2016-5131Yi Zhao
CVE-2016-5131 libxml2: Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5131 Patch from: https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-10-15libxml2: Make tests non-executableJussi Kukkonen
The XML W3C conformance test suite contains thousands of xml files all marked executable. We dutifully try to strip all these files of debug info in do_package. "chmod -x" improves build time by ~40 seconds. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-09-03libxml2: control ipv6 support based on DISTRO_FEATURESJackie Huang
Add PACKAGECONFIG for ipv6 and control it based on DISTRO_FEATURES. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-01pythonnative.bbclass, python3native.bbclass: export STAGING_INCDIR, ↵Alexander Kanavin
STAGING_LIBDIR, PYTHON variables We patch Python's distutils modules to access STAGING_INCDIR/LIBDIR, so when they are not set, scripts that utilize distutils (e.g. python-config) fail. Several recipes need to export those manually to prevent such failures, so let's do that in the class instead. PYTHON variable is exported because otherwise autotools' python.m4 macro will pick up its own internal default, which may not be the version that we want. glib recipe in particular was previously using Python 2.x during build due to python.m4 defaulting to it - now it's using Python 3.x, and so needs a small fix in deletion of *.pyc files. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-14libxml2: upgrade to 2.9.4Hongxu Jia
- Drop configure.ac-fix-cross-compiling-warning.patch, libxml2 2.9.4 has fixed it Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-19 02:20:10 +0000