Pullup ticket #6122 - requested by kim

textproc/libxml2: security fix

Revisions pulled up:
- textproc/libxml2/Makefile                                     1.155
- textproc/libxml2/distinfo                                     1.132
- textproc/libxml2/patches/patch-parser.c                       1.7
- textproc/libxml2/patches/patch-xmlschemas.c                   1.1

---
   Module Name:    pkgsrc
   Committed By:   kim
   Date:           Fri Jan 24 10:40:36 UTC 2020

   Modified Files:
           pkgsrc/textproc/libxml2: Makefile distinfo
   Added Files:
           pkgsrc/textproc/libxml2/patches: patch-parser.c patch-xmlschemas.c

   Log Message:
   Apply upstream patch for CVE-2020-7595.
   Apply upstream pull request for CVE-2019-20388.

4 files changed, 82 insertions, 2 deletions

diff --git a/textproc/libxml2/Makefile b/textproc/libxml2/Makefile
index 6718ade25ef..e7230ff400f 100644
--- a/textproc/libxml2/Makefile
+++ b/textproc/libxml2/Makefile
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.154 2019/11/04 21:43:38 rillig Exp $
+# $NetBSD: Makefile,v 1.154.4.1 2020/01/27 10:13:42 bsiegert Exp $
 
 .include "../../textproc/libxml2/Makefile.common"
+PKGREVISION=	1
 
 COMMENT=	XML parser library from the GNOME project
 LICENSE=	modified-bsd
diff --git a/textproc/libxml2/distinfo b/textproc/libxml2/distinfo
index b8abc41a268..7a12cf4abe4 100644
--- a/textproc/libxml2/distinfo
+++ b/textproc/libxml2/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.131 2019/11/06 13:19:43 wiz Exp $
+$NetBSD: distinfo,v 1.131.4.1 2020/01/27 10:13:42 bsiegert Exp $
 
 SHA1 (libxml2-2.9.10.tar.gz) = db6592ec9ca9708c4e71bf6bfd907bbb5cd40644
 RMD160 (libxml2-2.9.10.tar.gz) = 455f81e1f121c63dac96802de7f83ce4483f1afe
@@ -9,8 +9,10 @@ SHA1 (patch-catalog.c) = 34afe787f6012b460a85be993048e133907a1621
 SHA1 (patch-configure) = f6e9f08377a537657df08deee17a5cc66c60b808
 SHA1 (patch-doc_examples_Makefile.in) = 4eede9719724f94402e850ee6d6043a74aaf62b2
 SHA1 (patch-encoding.c) = 6cf0a7d421828b9f40a4079ee85adb791c54d096
+SHA1 (patch-parser.c) = 9dcda6b8bc71c1abb095fc2c840ac40c1ae04a33
 SHA1 (patch-python_libxml.c) = cfa07b4f3dfddb501c2ba210bb32b8ee14e3df9d
 SHA1 (patch-python_libxml.py) = 869a72ae5ba2e27e6d46552878890acb22337675
 SHA1 (patch-python_libxml2.py) = 209d105b0f3aedb834091390a7c6819705108e34
 SHA1 (patch-python_setup.py) = 7771fd02ee6779463f1d3321f099d7e6d19cd1b1
 SHA1 (patch-xmlcatalog.c) = d65b7e3be9694147e96ce4bb70a1739e2279ba81
+SHA1 (patch-xmlschemas.c) = edd5be08e7b19ab8e35412b854e95dedbb7befdd
diff --git a/textproc/libxml2/patches/patch-parser.c b/textproc/libxml2/patches/patch-parser.c
new file mode 100644
index 00000000000..70293e00d72
--- /dev/null
+++ b/textproc/libxml2/patches/patch-parser.c
@@ -0,0 +1,38 @@
+$NetBSD: patch-parser.c,v 1.7.2.2 2020/01/27 10:13:42 bsiegert Exp $
+
+Fix CVE-2020-7595
+
+https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076.patch
+
+From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Thu, 12 Dec 2019 17:30:55 +0800
+Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
+
+When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
+return NULL which cause a infinite loop in xmlStringLenDecodeEntities
+
+Found with libFuzzer.
+
+Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
+---
+ parser.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index d1c31963..a34bb6cd 100644
+--- parser.c
++++ parser.c
+@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
+     else
+         c = 0;
+     while ((c != 0) && (c != end) && /* non input consuming loop */
+-	   (c != end2) && (c != end3)) {
++           (c != end2) && (c != end3) &&
++           (ctxt->instate != XML_PARSER_EOF)) {
+ 
+ 	if (c == 0) break;
+         if ((c == '&') && (str[1] == '#')) {
+-- 
+2.24.1
+
diff --git a/textproc/libxml2/patches/patch-xmlschemas.c b/textproc/libxml2/patches/patch-xmlschemas.c
new file mode 100644
index 00000000000..96a58499501
--- /dev/null
+++ b/textproc/libxml2/patches/patch-xmlschemas.c
@@ -0,0 +1,39 @@
+$NetBSD: patch-xmlschemas.c,v 1.1.2.2 2020/01/27 10:13:42 bsiegert Exp $
+
+Fix CVE-2019-20388
+
+https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68.patch
+
+From 6088a74bcf7d0c42e24cff4594d804e1d3c9fbca Mon Sep 17 00:00:00 2001
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Tue, 20 Aug 2019 16:33:06 +0800
+Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream
+
+When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
+alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
+to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
+vctxt->xsiAssemble to 0 again which cause the alloced schema
+can not be freed anymore.
+
+Found with libFuzzer.
+
+Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
+---
+ xmlschemas.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/xmlschemas.c b/xmlschemas.c
+index 301c8449..39d92182 100644
+--- xmlschemas.c
++++ xmlschemas.c
+@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) {
+     vctxt->nberrors = 0;
+     vctxt->depth = -1;
+     vctxt->skipDepth = -1;
+-    vctxt->xsiAssemble = 0;
+     vctxt->hasKeyrefs = 0;
+ #ifdef ENABLE_IDC_NODE_TABLES_TEST
+     vctxt->createIDCNodeTables = 1;
+-- 
+2.24.1
+