libxslt: backport patch for CVE-2019-11068

Refreshed existing patches.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

diff --git a/libs/libxslt/Makefile b/libs/libxslt/Makefile
index 2d867c182d07820979b514109a295761fcea204a..c2480bf0bb98663f7478297a9abfbca278e35205 100644 (file)
--- a/libs/libxslt/Makefile
+++ b/libs/libxslt/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libxslt
 PKG_VERSION:=1.1.28
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:= \

diff --git a/libs/libxslt/patches/0009-Fix-for-type-confusion-in-preprocessing-attributes.patch b/libs/libxslt/patches/0009-Fix-for-type-confusion-in-preprocessing-attributes.patch
index 9f2d7ac3f132a729700bae26f1d85a842ab48e9e..c6457821fcf7c13cbd39287f3c167cc3a6ee03b0 100644 (file)
--- a/libs/libxslt/patches/0009-Fix-for-type-confusion-in-preprocessing-attributes.patch
+++ b/libs/libxslt/patches/0009-Fix-for-type-confusion-in-preprocessing-attributes.patch
@@ -10,11 +10,9 @@ its namespace
  libxslt/preproc.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)
 
-diff --git a/libxslt/preproc.c b/libxslt/preproc.c
-index 0eb80a0..7f69325 100644
 --- a/libxslt/preproc.c
 +++ b/libxslt/preproc.c
-@@ -2249,7 +2249,8 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr inst) {
+@@ -2245,7 +2245,8 @@ xsltStylePreCompute(xsltStylesheetPtr st
        } else if (IS_XSLT_NAME(inst, "attribute")) {
            xmlNodePtr parent = inst->parent;
  
@@ -24,6 +22,3 @@ index 0eb80a0..7f69325 100644
                ((parent->ns != inst->ns) &&
                 (!xmlStrEqual(parent->ns->href, inst->ns->href))) ||
                (!xmlStrEqual(parent->name, BAD_CAST "attribute-set"))) {
--- 
-2.8.1
-

diff --git a/libs/libxslt/patches/0012-Fix-xsltNumberFormatGetMultipleLevel.patch b/libs/libxslt/patches/0012-Fix-xsltNumberFormatGetMultipleLevel.patch
index 871fcfbc3df89ffeed0013807bad931d8a8704ba..46dd0534d4654cc5fdcff17c9110bc8427ae6e19 100644 (file)
--- a/libs/libxslt/patches/0012-Fix-xsltNumberFormatGetMultipleLevel.patch
+++ b/libs/libxslt/patches/0012-Fix-xsltNumberFormatGetMultipleLevel.patch
@@ -21,11 +21,9 @@ insignificant bug.
  create mode 100644 tests/general/bug-186.out
  create mode 100644 tests/general/bug-186.xsl
 
-diff --git a/libxslt/numbers.c b/libxslt/numbers.c
-index e3209e0..184ee6f 100644
 --- a/libxslt/numbers.c
 +++ b/libxslt/numbers.c
-@@ -532,6 +532,43 @@ xsltNumberFormatInsertNumbers(xsltNumberDataPtr data,
+@@ -532,6 +532,43 @@ xsltNumberFormatInsertNumbers(xsltNumber
  }
  
  static int
@@ -69,7 +67,7 @@ index e3209e0..184ee6f 100644
  xsltNumberFormatGetAnyLevel(xsltTransformContextPtr context,
                            xmlNodePtr node,
                            xsltCompMatchPtr countPat,
-@@ -562,21 +599,8 @@ xsltNumberFormatGetAnyLevel(xsltTransformContextPtr context,
+@@ -564,21 +601,8 @@ xsltNumberFormatGetAnyLevel(xsltTransfor
  
      while (cur != NULL) {
        /* process current node */
@@ -93,7 +91,7 @@ index e3209e0..184ee6f 100644
        if ((fromPat != NULL) &&
            xsltTestCompMatchList(context, cur, fromPat)) {
            break; /* while */
-@@ -633,30 +657,18 @@ xsltNumberFormatGetMultipleLevel(xsltTransformContextPtr context,
+@@ -637,30 +661,18 @@ xsltNumberFormatGetMultipleLevel(xsltTra
                xsltTestCompMatchList(context, ancestor, fromPat))
                break; /* for */
  
@@ -132,9 +130,6 @@ index e3209e0..184ee6f 100644
                }
                array[amount++] = (double)cnt;
                if (amount >= max)
-diff --git a/tests/docs/bug-186.xml b/tests/docs/bug-186.xml
-new file mode 100644
-index 0000000..424db6b
 --- /dev/null
 +++ b/tests/docs/bug-186.xml
 @@ -0,0 +1,4 @@
@@ -142,9 +137,6 @@ index 0000000..424db6b
 +<foo/>
 +<bar/>
 +</top>
-diff --git a/tests/general/bug-186.out b/tests/general/bug-186.out
-new file mode 100644
-index 0000000..01a59f8
 --- /dev/null
 +++ b/tests/general/bug-186.out
 @@ -0,0 +1,5 @@
@@ -153,9 +145,6 @@ index 0000000..01a59f8
 +1111
 +1111
 +
-diff --git a/tests/general/bug-186.xsl b/tests/general/bug-186.xsl
-new file mode 100644
-index 0000000..9c491dd
 --- /dev/null
 +++ b/tests/general/bug-186.xsl
 @@ -0,0 +1,7 @@
@@ -166,6 +155,3 @@ index 0000000..9c491dd
 +  </xsl:for-each>
 + </xsl:template>
 +</xsl:stylesheet>
--- 
-2.8.1
-

diff --git a/libs/libxslt/patches/0017-Fix-double-free-in-libexslt-hash-functions.patch b/libs/libxslt/patches/0017-Fix-double-free-in-libexslt-hash-functions.patch
index eafdee1695b1006e12a6a17ff6b53c3f85e8de7f..1bd653d8e6350ea359544001217d19725ad3defb 100644 (file)
--- a/libs/libxslt/patches/0017-Fix-double-free-in-libexslt-hash-functions.patch
+++ b/libs/libxslt/patches/0017-Fix-double-free-in-libexslt-hash-functions.patch
@@ -14,11 +14,9 @@ https://bugzilla.gnome.org/show_bug.cgi?id=765271
  tests/exslt/crypto/hash.1.xml |  5 +++++
  3 files changed, 10 insertions(+), 12 deletions(-)
 
-diff --git a/libexslt/crypto.c b/libexslt/crypto.c
-index 6aa9dd2..e13db8b 100644
 --- a/libexslt/crypto.c
 +++ b/libexslt/crypto.c
-@@ -499,11 +499,8 @@ exsltCryptoMd4Function (xmlXPathParserContextPtr ctxt, int nargs) {
+@@ -498,11 +498,8 @@ exsltCryptoMd4Function (xmlXPathParserCo
      unsigned char hex[MD5_DIGEST_LENGTH * 2 + 1];
  
      str_len = exsltCryptoPopString (ctxt, nargs, &str);
@@ -31,7 +29,7 @@ index 6aa9dd2..e13db8b 100644
  
      PLATFORM_HASH (ctxt, PLATFORM_MD4, (const char *) str, str_len,
                   (char *) hash);
-@@ -532,11 +529,8 @@ exsltCryptoMd5Function (xmlXPathParserContextPtr ctxt, int nargs) {
+@@ -531,11 +528,8 @@ exsltCryptoMd5Function (xmlXPathParserCo
      unsigned char hex[MD5_DIGEST_LENGTH * 2 + 1];
  
      str_len = exsltCryptoPopString (ctxt, nargs, &str);
@@ -44,7 +42,7 @@ index 6aa9dd2..e13db8b 100644
  
      PLATFORM_HASH (ctxt, PLATFORM_MD5, (const char *) str, str_len,
                   (char *) hash);
-@@ -565,11 +559,8 @@ exsltCryptoSha1Function (xmlXPathParserContextPtr ctxt, int nargs) {
+@@ -564,11 +558,8 @@ exsltCryptoSha1Function (xmlXPathParserC
      unsigned char hex[SHA1_DIGEST_LENGTH * 2 + 1];
  
      str_len = exsltCryptoPopString (ctxt, nargs, &str);
@@ -57,6 +55,3 @@ index 6aa9dd2..e13db8b 100644
  
      PLATFORM_HASH (ctxt, PLATFORM_SHA1, (const char *) str, str_len,
                   (char *) hash);
--- 
-2.8.1
-

diff --git a/libs/libxslt/patches/0020-Fix-heap-overread-in-xsltFormatNumberConversion.patch b/libs/libxslt/patches/0020-Fix-heap-overread-in-xsltFormatNumberConversion.patch
index 60ead15226e0b9d8f0d2d7fd08e1851bca7fc763..6188db013be2008462c5bdd4d777ced37f6bea0a 100644 (file)
--- a/libs/libxslt/patches/0020-Fix-heap-overread-in-xsltFormatNumberConversion.patch
+++ b/libs/libxslt/patches/0020-Fix-heap-overread-in-xsltFormatNumberConversion.patch
@@ -12,11 +12,9 @@ Found with afl-fuzz and ASan.
  libxslt/numbers.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)
 
-diff --git a/libxslt/numbers.c b/libxslt/numbers.c
-index d1549b4..e78c46b 100644
 --- a/libxslt/numbers.c
 +++ b/libxslt/numbers.c
-@@ -1090,7 +1090,8 @@ xsltFormatNumberConversion(xsltDecimalFormatPtr self,
+@@ -1109,7 +1109,8 @@ xsltFormatNumberConversion(xsltDecimalFo
      }
  
      /* We have finished the integer part, now work on fraction */
@@ -26,6 +24,3 @@ index d1549b4..e78c46b 100644
          format_info.add_decimal = TRUE;
        the_format += xsltUTF8Size(the_format); /* Skip over the decimal */
      }
--- 
-2.10.2
-

diff --git a/libs/libxslt/patches/0021-Check-for-integer-overflow-in-xsltAddTextString.patch b/libs/libxslt/patches/0021-Check-for-integer-overflow-in-xsltAddTextString.patch
index ea941db4cee67554e665374fae1ee34ae8b7f2b9..bd87336716703582256bbc5b39289d187024b3a1 100644 (file)
--- a/libs/libxslt/patches/0021-Check-for-integer-overflow-in-xsltAddTextString.patch
+++ b/libs/libxslt/patches/0021-Check-for-integer-overflow-in-xsltAddTextString.patch
@@ -14,11 +14,9 @@ https://crbug.com/676623
  libxslt/xsltInternals.h |  4 ++--
  2 files changed, 24 insertions(+), 5 deletions(-)
 
-diff --git a/libxslt/transform.c b/libxslt/transform.c
-index 519133fc..02bff34a 100644
 --- a/libxslt/transform.c
 +++ b/libxslt/transform.c
-@@ -813,13 +813,32 @@ xsltAddTextString(xsltTransformContextPtr ctxt, xmlNodePtr target,
+@@ -718,13 +718,32 @@ xsltAddTextString(xsltTransformContextPt
          return(target);
  
      if (ctxt->lasttext == target->content) {
@@ -54,11 +52,9 @@ index 519133fc..02bff34a 100644
            newbuf = (xmlChar *) xmlRealloc(target->content,size);
            if (newbuf == NULL) {
                xsltTransformError(ctxt, NULL, target,
-diff --git a/libxslt/xsltInternals.h b/libxslt/xsltInternals.h
-index 060b1783..5ad17719 100644
 --- a/libxslt/xsltInternals.h
 +++ b/libxslt/xsltInternals.h
-@@ -1754,8 +1754,8 @@ struct _xsltTransformContext {
+@@ -1752,8 +1752,8 @@ struct _xsltTransformContext {
       * Speed optimization when coalescing text nodes
       */
      const xmlChar  *lasttext;         /* last text node content */
@@ -69,6 +65,3 @@ index 060b1783..5ad17719 100644
      /*
       * Per Context Debugging
       */
--- 
-2.11.0
-

diff --git a/libs/libxslt/patches/0022-fix-cve-2019-11068.patch b/libs/libxslt/patches/0022-fix-cve-2019-11068.patch
new file mode 100644 (file)
index 0000000..4ccdb98
--- /dev/null
+++ b/libs/libxslt/patches/0022-fix-cve-2019-11068.patch
@@ -0,0 +1,109 @@
+From e03553605b45c88f0b4b2980adfbbb8f6fca2fd6 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sun, 24 Mar 2019 09:51:39 +0100
+Subject: [PATCH] Fix security framework bypass
+
+xsltCheckRead and xsltCheckWrite return -1 in case of error but callers
+don't check for this condition and allow access. With a specially
+crafted URL, xsltCheckRead could be tricked into returning an error
+because of a supposedly invalid URL that would still be loaded
+succesfully later on.
+
+Fixes #12.
+
+Thanks to Felix Wilhelm for the report.
+---
+ libxslt/documents.c | 18 ++++++++++--------
+ libxslt/imports.c   |  9 +++++----
+ libxslt/transform.c |  9 +++++----
+ libxslt/xslt.c      |  9 +++++----
+ 4 files changed, 25 insertions(+), 20 deletions(-)
+
+--- a/libxslt/documents.c
++++ b/libxslt/documents.c
+@@ -296,10 +296,11 @@ xsltLoadDocument(xsltTransformContextPtr
+       int res;
+ 
+       res = xsltCheckRead(ctxt->sec, ctxt, URI);
+-      if (res == 0) {
+-          xsltTransformError(ctxt, NULL, NULL,
+-               "xsltLoadDocument: read rights for %s denied\n",
+-                           URI);
++      if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(ctxt, NULL, NULL,
++                     "xsltLoadDocument: read rights for %s denied\n",
++                                 URI);
+           return(NULL);
+       }
+     }
+@@ -372,10 +373,11 @@ xsltLoadStyleDocument(xsltStylesheetPtr
+       int res;
+ 
+       res = xsltCheckRead(sec, NULL, URI);
+-      if (res == 0) {
+-          xsltTransformError(NULL, NULL, NULL,
+-               "xsltLoadStyleDocument: read rights for %s denied\n",
+-                           URI);
++      if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsltLoadStyleDocument: read rights for %s denied\n",
++                                 URI);
+           return(NULL);
+       }
+     }
+--- a/libxslt/imports.c
++++ b/libxslt/imports.c
+@@ -131,10 +131,11 @@ xsltParseStylesheetImport(xsltStylesheet
+       int secres;
+ 
+       secres = xsltCheckRead(sec, NULL, URI);
+-      if (secres == 0) {
+-          xsltTransformError(NULL, NULL, NULL,
+-               "xsl:import: read rights for %s denied\n",
+-                           URI);
++      if (secres <= 0) {
++            if (secres == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsl:import: read rights for %s denied\n",
++                                 URI);
+           goto error;
+       }
+     }
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -3416,10 +3416,11 @@ xsltDocumentElem(xsltTransformContextPtr
+      */
+     if (ctxt->sec != NULL) {
+       ret = xsltCheckWrite(ctxt->sec, ctxt, filename);
+-      if (ret == 0) {
+-          xsltTransformError(ctxt, NULL, inst,
+-               "xsltDocumentElem: write rights for %s denied\n",
+-                           filename);
++      if (ret <= 0) {
++            if (ret == 0)
++                xsltTransformError(ctxt, NULL, inst,
++                     "xsltDocumentElem: write rights for %s denied\n",
++                                 filename);
+           xmlFree(URL);
+           xmlFree(filename);
+           return;
+--- a/libxslt/xslt.c
++++ b/libxslt/xslt.c
+@@ -6729,10 +6729,11 @@ xsltParseStylesheetFile(const xmlChar* f
+       int res;
+ 
+       res = xsltCheckRead(sec, NULL, filename);
+-      if (res == 0) {
+-          xsltTransformError(NULL, NULL, NULL,
+-               "xsltParseStylesheetFile: read rights for %s denied\n",
+-                           filename);
++      if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsltParseStylesheetFile: read rights for %s denied\n",
++                                 filename);
+           return(NULL);
+       }
+     }