diff options
| -rw-r--r-- | textproc/libxml2/Makefile | 5 | ||||
| -rw-r--r-- | textproc/libxml2/distinfo | 17 | ||||
| -rw-r--r-- | textproc/libxml2/patches/patch-HTMLparser.c | 90 | ||||
| -rw-r--r-- | textproc/libxml2/patches/patch-aj | 18 | ||||
| -rw-r--r-- | textproc/libxml2/patches/patch-ba | 27 | ||||
| -rw-r--r-- | textproc/libxml2/patches/patch-buf.c | 94 | ||||
| -rw-r--r-- | textproc/libxml2/patches/patch-include_libxml_tree.h | 18 | ||||
| -rw-r--r-- | textproc/libxml2/patches/patch-threads.c | 38 | ||||
| -rw-r--r-- | textproc/libxml2/patches/patch-xmlreader.c | 59 |
9 files changed, 7 insertions, 359 deletions
diff --git a/textproc/libxml2/Makefile b/textproc/libxml2/Makefile index 608e261538f..b41088162fa 100644 --- a/textproc/libxml2/Makefile +++ b/textproc/libxml2/Makefile @@ -1,7 +1,6 @@ -# $NetBSD: Makefile,v 1.138 2015/07/03 18:55:46 he Exp $ +# $NetBSD: Makefile,v 1.139 2015/11/22 23:49:03 wiz Exp $ -DISTNAME= libxml2-2.9.2 -PKGREVISION= 3 +DISTNAME= libxml2-2.9.3 CATEGORIES= textproc MASTER_SITES= ftp://xmlsoft.org/libxml2/ \ http://xmlsoft.org/sources/ diff --git a/textproc/libxml2/distinfo b/textproc/libxml2/distinfo index a84304bccfd..c89fcec8598 100644 --- a/textproc/libxml2/distinfo +++ b/textproc/libxml2/distinfo @@ -1,19 +1,12 @@ -$NetBSD: distinfo,v 1.108 2015/11/04 01:59:39 agc Exp $ +$NetBSD: distinfo,v 1.109 2015/11/22 23:49:03 wiz Exp $ -SHA1 (libxml2-2.9.2.tar.gz) = f46a37ea6d869f702e03f393c376760f3cbee673 -RMD160 (libxml2-2.9.2.tar.gz) = 969b4ed8782f455fd4a6ca1c1b4ffa7651090070 -SHA512 (libxml2-2.9.2.tar.gz) = a4e3b20e2efceed39c20379b32b746d4a1cf65c0cf7719d26c9bf7483c1f04a4e5a442ae2f36dc4ae8a4d011b67cfb58d9f6d0be034fa3e897a49059c9289565 -Size (libxml2-2.9.2.tar.gz) = 5444991 bytes -SHA1 (patch-HTMLparser.c) = 46e062001d8c7688f9c938741dbd53e917169d1f +SHA1 (libxml2-2.9.3.tar.gz) = 0301ce933637e0ceda049047dbefd18714f59b6e +RMD160 (libxml2-2.9.3.tar.gz) = 8ffed136daaf3595c306b76c5600ce67b5984e61 +SHA512 (libxml2-2.9.3.tar.gz) = 078afa65229de4f23e6538767253fb4f9f61d96cb72e445179c71d536b224d54922f22972a2b71434796f83f8c99f6a46c3b8813cb4582ad9fca696d141e0abb +Size (libxml2-2.9.3.tar.gz) = 5477112 bytes SHA1 (patch-aa) = 7d1213079cc78c9a28476c49f1283ab1c6af3b34 SHA1 (patch-ab) = bf8983fcde35edf0e450209bf07f0fa628f7bd9e SHA1 (patch-ac) = 015a5903a86793bd770f16f251b94e5b2562b3f7 SHA1 (patch-ad) = fe255e93f9aefd5403d646cd45d9fbdcbd100bd6 SHA1 (patch-ae) = d479d5a0c8b906de3cbe1c30b100c6f8b1bb9c43 SHA1 (patch-ag) = f037f13ccc4047d4bf824a2091e60ac89b172558 -SHA1 (patch-aj) = aab00bf2ba0168fa8f6070db985531c676b5c34d -SHA1 (patch-ba) = 78097bb871cc614c8d95a53d825542d23e113192 -SHA1 (patch-buf.c) = 087a768a39441189b226cda500475014462ff8fd -SHA1 (patch-include_libxml_tree.h) = 9978e6a3ea2408a9aaf68fe1663df5f7dce12eee -SHA1 (patch-threads.c) = 425796881df8520356abbfff001f0e6191d9f186 -SHA1 (patch-xmlreader.c) = cb8710e4c0261a98a68e3e69388d3a4341629f22 diff --git a/textproc/libxml2/patches/patch-HTMLparser.c b/textproc/libxml2/patches/patch-HTMLparser.c deleted file mode 100644 index 7ca54520837..00000000000 --- a/textproc/libxml2/patches/patch-HTMLparser.c +++ /dev/null @@ -1,90 +0,0 @@ -$NetBSD: patch-HTMLparser.c,v 1.1 2015/07/03 18:55:46 he Exp $ - -Suggested patch for arbitrary-memory-access vulnerability, from -https://bugzilla.gnome.org/show_bug.cgi?id=746048 - ---- HTMLparser.c.orig 2014-10-06 10:48:11.000000000 +0000 -+++ HTMLparser.c -@@ -3245,13 +3245,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) - ctxt->instate = state; - return; - } -+ if ((ctxt->input->end - ctxt->input->cur) < 3) { -+ ctxt->instate = XML_PARSER_EOF; -+ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, -+ "Comment not terminated\n", NULL, NULL); -+ xmlFree(buf); -+ return; -+ } - q = CUR_CHAR(ql); - NEXTL(ql); - r = CUR_CHAR(rl); - NEXTL(rl); - cur = CUR_CHAR(l); - len = 0; -- while (IS_CHAR(cur) && -+ while (((ctxt->input->end - ctxt->input->cur) > 0) && IS_CHAR(cur) && - ((cur != '>') || - (r != '-') || (q != '-'))) { - if (len + 5 >= size) { -@@ -3281,7 +3288,7 @@ htmlParseComment(htmlParserCtxtPtr ctxt) - } - } - buf[len] = 0; -- if (!IS_CHAR(cur)) { -+ if (!(ctxt->input->end - ctxt->input->cur) || !IS_CHAR(cur)) { - htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, - "Comment not terminated \n<!--%.50s\n", buf, NULL); - xmlFree(buf); -@@ -4465,6 +4472,7 @@ htmlParseContentInternal(htmlParserCtxtP - depth = ctxt->nameNr; - while (1) { - long cons = ctxt->nbChars; -+ long rem = ctxt->input->end - ctxt->input->cur; - - GROW; - -@@ -4540,7 +4548,7 @@ htmlParseContentInternal(htmlParserCtxtP - /* - * Sometimes DOCTYPE arrives in the middle of the document - */ -- if ((CUR == '<') && (NXT(1) == '!') && -+ if ((rem >= 9) && (CUR == '<') && (NXT(1) == '!') && - (UPP(2) == 'D') && (UPP(3) == 'O') && - (UPP(4) == 'C') && (UPP(5) == 'T') && - (UPP(6) == 'Y') && (UPP(7) == 'P') && -@@ -4554,7 +4562,7 @@ htmlParseContentInternal(htmlParserCtxtP - /* - * First case : a comment - */ -- if ((CUR == '<') && (NXT(1) == '!') && -+ if ((rem >= 4) && (CUR == '<') && (NXT(1) == '!') && - (NXT(2) == '-') && (NXT(3) == '-')) { - htmlParseComment(ctxt); - } -@@ -4562,14 +4570,14 @@ htmlParseContentInternal(htmlParserCtxtP - /* - * Second case : a Processing Instruction. - */ -- else if ((CUR == '<') && (NXT(1) == '?')) { -+ else if ((rem >= 2) && (CUR == '<') && (NXT(1) == '?')) { - htmlParsePI(ctxt); - } - - /* - * Third case : a sub-element. - */ -- else if (CUR == '<') { -+ else if ((rem >= 1) && (CUR == '<')) { - htmlParseElementInternal(ctxt); - if (currentNode != NULL) xmlFree(currentNode); - -@@ -4581,7 +4589,7 @@ htmlParseContentInternal(htmlParserCtxtP - * Fourth case : a reference. If if has not been resolved, - * parsing returns it's Name, create the node - */ -- else if (CUR == '&') { -+ else if ((rem >= 1) && (CUR == '&')) { - htmlParseReference(ctxt); - } - diff --git a/textproc/libxml2/patches/patch-aj b/textproc/libxml2/patches/patch-aj deleted file mode 100644 index d3bac6f99ad..00000000000 --- a/textproc/libxml2/patches/patch-aj +++ /dev/null @@ -1,18 +0,0 @@ -$NetBSD: patch-aj,v 1.4 2015/04/24 11:32:29 spz Exp $ - -Inlucde resolv.h conditionally: - https://bugzilla.gnome.org/show_bug.cgi?id=617053 - ---- nanohttp.c.orig 2014-10-03 11:28:05.000000000 +0000 -+++ nanohttp.c -@@ -43,8 +43,10 @@ - #ifdef HAVE_ARPA_NAMESER_H - #include <arpa/nameser.h> - #endif -+#ifdef HAVE_RESOLV_H - #include <resolv.h> - #endif -+#endif - #ifdef HAVE_FCNTL_H - #include <fcntl.h> - #endif diff --git a/textproc/libxml2/patches/patch-ba b/textproc/libxml2/patches/patch-ba deleted file mode 100644 index fb01607cd0a..00000000000 --- a/textproc/libxml2/patches/patch-ba +++ /dev/null @@ -1,27 +0,0 @@ -$NetBSD: patch-ba,v 1.3 2014/10/28 18:55:56 drochner Exp $ - -https://git.gnome.org/browse/libxml2/commit/?id=f65128f38289d77ff322d63aef2858cc0a819c34 -https://git.gnome.org/browse/libxml2/commit/?id=72a46a519ce7326d9a00f0b6a7f2a8e958cd1675 - ---- parser.c.orig 2014-10-16 05:57:40.000000000 +0000 -+++ parser.c -@@ -7235,7 +7235,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt) - * far more secure as the parser will only process data coming from - * the document entity by default. - */ -- if ((ent->checked == 0) && -+ if (((ent->checked == 0) || -+ ((ent->children == NULL) && (ctxt->options & XML_PARSE_NOENT))) && - ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) || - (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) { - unsigned long oldnbent = ctxt->nbentities; -@@ -14830,9 +14831,6 @@ xmlInitParser(void) { - #ifdef LIBXML_XPATH_ENABLED - xmlXPathInit(); - #endif --#ifdef LIBXML_CATALOG_ENABLED -- xmlInitializeCatalog(); --#endif - xmlParserInitialized = 1; - #ifdef LIBXML_THREAD_ENABLED - } diff --git a/textproc/libxml2/patches/patch-buf.c b/textproc/libxml2/patches/patch-buf.c deleted file mode 100644 index 3f7cf8fb2bd..00000000000 --- a/textproc/libxml2/patches/patch-buf.c +++ /dev/null @@ -1,94 +0,0 @@ -$NetBSD: patch-buf.c,v 1.1 2015/04/24 11:32:29 spz Exp $ - -patch for CVE-2015-1819 Enforce the reader to run in constant memory -from https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9 -part 1 - ---- buf.c.orig 2014-10-13 08:01:31.000000000 +0000 -+++ buf.c -@@ -27,6 +27,7 @@ - #include <libxml/tree.h> - #include <libxml/globals.h> - #include <libxml/tree.h> -+#include <libxml/parserInternals.h> /* for XML_MAX_TEXT_LENGTH */ - #include "buf.h" - - #define WITH_BUFFER_COMPAT -@@ -299,7 +300,8 @@ xmlBufSetAllocationScheme(xmlBufPtr buf, - if ((scheme == XML_BUFFER_ALLOC_DOUBLEIT) || - (scheme == XML_BUFFER_ALLOC_EXACT) || - (scheme == XML_BUFFER_ALLOC_HYBRID) || -- (scheme == XML_BUFFER_ALLOC_IMMUTABLE)) { -+ (scheme == XML_BUFFER_ALLOC_IMMUTABLE) || -+ (scheme == XML_BUFFER_ALLOC_BOUNDED)) { - buf->alloc = scheme; - if (buf->buffer) - buf->buffer->alloc = scheme; -@@ -458,6 +460,18 @@ xmlBufGrowInternal(xmlBufPtr buf, size_t - size = buf->use + len + 100; - #endif - -+ if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) { -+ /* -+ * Used to provide parsing limits -+ */ -+ if ((buf->use + len >= XML_MAX_TEXT_LENGTH) || -+ (buf->size >= XML_MAX_TEXT_LENGTH)) { -+ xmlBufMemoryError(buf, "buffer error: text too long\n"); -+ return(0); -+ } -+ if (size >= XML_MAX_TEXT_LENGTH) -+ size = XML_MAX_TEXT_LENGTH; -+ } - if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) { - size_t start_buf = buf->content - buf->contentIO; - -@@ -738,7 +752,15 @@ xmlBufResize(xmlBufPtr buf, size_t size) - return(0); - CHECK_COMPAT(buf) - -- if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0); -+ if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) { -+ /* -+ * Used to provide parsing limits -+ */ -+ if (size >= XML_MAX_TEXT_LENGTH) { -+ xmlBufMemoryError(buf, "buffer error: text too long\n"); -+ return(0); -+ } -+ } - - /* Don't resize if we don't have to */ - if (size < buf->size) -@@ -867,6 +889,15 @@ xmlBufAdd(xmlBufPtr buf, const xmlChar * - - needSize = buf->use + len + 2; - if (needSize > buf->size){ -+ if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) { -+ /* -+ * Used to provide parsing limits -+ */ -+ if (needSize >= XML_MAX_TEXT_LENGTH) { -+ xmlBufMemoryError(buf, "buffer error: text too long\n"); -+ return(-1); -+ } -+ } - if (!xmlBufResize(buf, needSize)){ - xmlBufMemoryError(buf, "growing buffer"); - return XML_ERR_NO_MEMORY; -@@ -938,6 +969,15 @@ xmlBufAddHead(xmlBufPtr buf, const xmlCh - } - needSize = buf->use + len + 2; - if (needSize > buf->size){ -+ if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) { -+ /* -+ * Used to provide parsing limits -+ */ -+ if (needSize >= XML_MAX_TEXT_LENGTH) { -+ xmlBufMemoryError(buf, "buffer error: text too long\n"); -+ return(-1); -+ } -+ } - if (!xmlBufResize(buf, needSize)){ - xmlBufMemoryError(buf, "growing buffer"); - return XML_ERR_NO_MEMORY; diff --git a/textproc/libxml2/patches/patch-include_libxml_tree.h b/textproc/libxml2/patches/patch-include_libxml_tree.h deleted file mode 100644 index 4ca5b0261ca..00000000000 --- a/textproc/libxml2/patches/patch-include_libxml_tree.h +++ /dev/null @@ -1,18 +0,0 @@ -$NetBSD: patch-include_libxml_tree.h,v 1.1 2015/04/24 11:32:29 spz Exp $ - -patch for CVE-2015-1819 Enforce the reader to run in constant memory -from https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9 -part 2 - ---- include/libxml/tree.h.orig 2014-10-13 08:20:09.000000000 +0000 -+++ include/libxml/tree.h -@@ -76,7 +76,8 @@ typedef enum { - XML_BUFFER_ALLOC_EXACT, /* grow only to the minimal size */ - XML_BUFFER_ALLOC_IMMUTABLE, /* immutable buffer */ - XML_BUFFER_ALLOC_IO, /* special allocation scheme used for I/O */ -- XML_BUFFER_ALLOC_HYBRID /* exact up to a threshold, and doubleit thereafter */ -+ XML_BUFFER_ALLOC_HYBRID, /* exact up to a threshold, and doubleit thereafter */ -+ XML_BUFFER_ALLOC_BOUNDED /* limit the upper size of the buffer */ - } xmlBufferAllocationScheme; - - /** diff --git a/textproc/libxml2/patches/patch-threads.c b/textproc/libxml2/patches/patch-threads.c deleted file mode 100644 index 6a19f102fd2..00000000000 --- a/textproc/libxml2/patches/patch-threads.c +++ /dev/null @@ -1,38 +0,0 @@ -$NetBSD: patch-threads.c,v 1.5 2015/04/24 11:32:29 spz Exp $ - -* Treat OpenBSD and MirBSD same as Linux to avoid linking with libpthread -* NetBSD<4.99.36 and FreeBSD<7.0 lack pthread_equal() stub function in libc -* pthread_once_t cast needed to avoid compilation error - ---- threads.c.orig 2014-10-13 07:02:28.000000000 +0000 -+++ threads.c -@@ -42,13 +42,17 @@ - #include <note.h> - #endif - -+#if defined(__NetBSD__) -+#include <sys/param.h> -+#endif -+ - /* #define DEBUG_THREADS */ - - #ifdef HAVE_PTHREAD_H - - static int libxml_is_threaded = -1; - #ifdef __GNUC__ --#ifdef linux -+#if defined(linux) || defined(__OpenBSD__) || defined(__MirBSD__) - #if (__GNUC__ == 3 && __GNUC_MINOR__ >= 3) || (__GNUC__ > 3) - extern int pthread_once (pthread_once_t *__once_control, - void (*__init_routine) (void)) -@@ -90,6 +94,10 @@ extern int pthread_cond_signal () - #endif - #endif /* linux */ - #endif /* __GNUC__ */ -+#if (defined(__NetBSD__) && __NetBSD_Version__ < 499003600) || (defined(__FreeBSD__) && __FreeBSD_version < 700000) -+extern int pthread_equal () -+ __attribute((weak)); -+#endif /* NetBSD-4, FreeBSD-6 */ - #endif /* HAVE_PTHREAD_H */ - - /* diff --git a/textproc/libxml2/patches/patch-xmlreader.c b/textproc/libxml2/patches/patch-xmlreader.c deleted file mode 100644 index 6ff602006aa..00000000000 --- a/textproc/libxml2/patches/patch-xmlreader.c +++ /dev/null @@ -1,59 +0,0 @@ -$NetBSD: patch-xmlreader.c,v 1.1 2015/04/24 11:32:29 spz Exp $ - -patch for CVE-2015-1819 Enforce the reader to run in constant memory -from https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9 -part 3 - ---- xmlreader.c.orig 2014-10-06 12:05:09.000000000 +0000 -+++ xmlreader.c -@@ -2091,6 +2091,9 @@ xmlNewTextReader(xmlParserInputBufferPtr - "xmlNewTextReader : malloc failed\n"); - return(NULL); - } -+ /* no operation on a reader should require a huge buffer */ -+ xmlBufSetAllocationScheme(ret->buffer, -+ XML_BUFFER_ALLOC_BOUNDED); - ret->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler)); - if (ret->sax == NULL) { - xmlBufFree(ret->buffer); -@@ -3616,6 +3619,7 @@ xmlTextReaderConstValue(xmlTextReaderPtr - return(((xmlNsPtr) node)->href); - case XML_ATTRIBUTE_NODE:{ - xmlAttrPtr attr = (xmlAttrPtr) node; -+ const xmlChar *ret; - - if ((attr->children != NULL) && - (attr->children->type == XML_TEXT_NODE) && -@@ -3629,10 +3633,21 @@ xmlTextReaderConstValue(xmlTextReaderPtr - "xmlTextReaderSetup : malloc failed\n"); - return (NULL); - } -+ xmlBufSetAllocationScheme(reader->buffer, -+ XML_BUFFER_ALLOC_BOUNDED); - } else - xmlBufEmpty(reader->buffer); - xmlBufGetNodeContent(reader->buffer, node); -- return(xmlBufContent(reader->buffer)); -+ ret = xmlBufContent(reader->buffer); -+ if (ret == NULL) { -+ /* error on the buffer best to reallocate */ -+ xmlBufFree(reader->buffer); -+ reader->buffer = xmlBufCreateSize(100); -+ xmlBufSetAllocationScheme(reader->buffer, -+ XML_BUFFER_ALLOC_BOUNDED); -+ ret = BAD_CAST ""; -+ } -+ return(ret); - } - break; - } -@@ -5131,6 +5146,9 @@ xmlTextReaderSetup(xmlTextReaderPtr read - "xmlTextReaderSetup : malloc failed\n"); - return (-1); - } -+ /* no operation on a reader should require a huge buffer */ -+ xmlBufSetAllocationScheme(reader->buffer, -+ XML_BUFFER_ALLOC_BOUNDED); - if (reader->sax == NULL) - reader->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler)); - if (reader->sax == NULL) { |