From 3d610526ee2e872e72d5f5e7bdd01d52fde2d7f9 Mon Sep 17 00:00:00 2001 From: "@ran-zhao-yu" Date: Tue, 4 Jun 2024 21:26:48 +0800 Subject: [PATCH] =?UTF-8?q?=E5=88=A0=E9=99=A4=E5=A4=9A=E4=BD=99pr?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: @ran-zhao-yu --- backport-CVE-2023-45322.patch | 74 ----------------------------------- 1 file changed, 74 deletions(-) delete mode 100644 backport-CVE-2023-45322.patch diff --git a/backport-CVE-2023-45322.patch b/backport-CVE-2023-45322.patch deleted file mode 100644 index 6b7bc5b..0000000 --- a/backport-CVE-2023-45322.patch +++ /dev/null @@ -1,74 +0,0 @@ -From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Wed, 23 Aug 2023 20:24:24 +0200 -Subject: [PATCH] tree: Fix copying of DTDs - -- Don't create multiple DTD nodes. -- Fix UAF if malloc fails. -- Skip DTD nodes if tree module is disabled. - -Fixes #583. ---- - tree.c | 31 ++++++++++++++++--------------- - 1 file changed, 16 insertions(+), 15 deletions(-) - -diff --git a/tree.c b/tree.c -index 6c8a875b..02c1b579 100644 ---- a/tree.c -+++ b/tree.c -@@ -4386,29 +4386,28 @@ xmlNodePtr - xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { - xmlNodePtr ret = NULL; - xmlNodePtr p = NULL,q; -+ xmlDtdPtr newSubset = NULL; - - while (node != NULL) { --#ifdef LIBXML_TREE_ENABLED - if (node->type == XML_DTD_NODE ) { -- if (doc == NULL) { -+#ifdef LIBXML_TREE_ENABLED -+ if ((doc == NULL) || (doc->intSubset != NULL)) { - node = node->next; - continue; - } -- if (doc->intSubset == NULL) { -- q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); -- if (q == NULL) goto error; -- q->doc = doc; -- q->parent = parent; -- doc->intSubset = (xmlDtdPtr) q; -- xmlAddChild(parent, q); -- } else { -- q = (xmlNodePtr) doc->intSubset; -- xmlAddChild(parent, q); -- } -- } else -+ q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); -+ if (q == NULL) goto error; -+ q->doc = doc; -+ q->parent = parent; -+ newSubset = (xmlDtdPtr) q; -+#else -+ node = node->next; -+ continue; - #endif /* LIBXML_TREE_ENABLED */ -+ } else { - q = xmlStaticCopyNode(node, doc, parent, 1); -- if (q == NULL) goto error; -+ if (q == NULL) goto error; -+ } - if (ret == NULL) { - q->prev = NULL; - ret = p = q; -@@ -4420,6 +4419,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { - } - node = node->next; - } -+ if (newSubset != NULL) -+ doc->intSubset = newSubset; - return(ret); - error: - xmlFreeNodeList(ret); --- -2.27.0 - -- Gitee