diff --git a/fix-CVE-2023-45322.patch b/fix-CVE-2023-45322.patch new file mode 100644 index 0000000000000000000000000000000000000000..9ae86829676f7cc0b063377e5d9be04de94fc327 --- /dev/null +++ b/fix-CVE-2023-45322.patch @@ -0,0 +1,51 @@ +diff -Nurw libxml2-2.11.5/tree.c libxml2-2.11.5_new/tree.c +--- libxml2-2.11.5/tree.c 2023-08-09 20:27:38.000000000 +0800 ++++ libxml2-2.11.5_new/tree.c 2023-11-03 14:39:55.019117784 +0800 +@@ -4473,29 +4473,28 @@ + xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) { + xmlNodePtr ret = NULL; + xmlNodePtr p = NULL,q; ++ xmlDtdPtr newSubset = NULL; + + while (node != NULL) { +-#ifdef LIBXML_TREE_ENABLED + if (node->type == XML_DTD_NODE ) { +- if (doc == NULL) { ++#ifdef LIBXML_TREE_ENABLED ++ if ((doc == NULL) || (doc->intSubset != NULL)) { + node = node->next; + continue; + } +- if (doc->intSubset == NULL) { + q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node ); + if (q == NULL) goto error; + q->doc = doc; + q->parent = parent; +- doc->intSubset = (xmlDtdPtr) q; +- xmlAddChild(parent, q); +- } else { +- q = (xmlNodePtr) doc->intSubset; +- xmlAddChild(parent, q); +- } +- } else ++ newSubset = (xmlDtdPtr) q; ++#else ++ node = node->next; ++ continue; + #endif /* LIBXML_TREE_ENABLED */ ++ } else { + q = xmlStaticCopyNode(node, doc, parent, 1); + if (q == NULL) goto error; ++ } + if (ret == NULL) { + q->prev = NULL; + ret = p = q; +@@ -4507,6 +4506,8 @@ + } + node = node->next; + } ++ if (newSubset != NULL) ++ doc->intSubset = newSubset; + return(ret); + error: + xmlFreeNodeList(ret); diff --git a/libxml2-2.10.4.tar.xz b/libxml2-2.10.4.tar.xz deleted file mode 100644 index 53c7fc384269d28bcea0fd3eef220ee293ffd2b2..0000000000000000000000000000000000000000 Binary files a/libxml2-2.10.4.tar.xz and /dev/null differ diff --git a/libxml2-2.9.8-python3-unicode-errors.patch b/libxml2-2.11.1-python3-unicode-errors.patch similarity index 69% rename from libxml2-2.9.8-python3-unicode-errors.patch rename to libxml2-2.11.1-python3-unicode-errors.patch index e87dcdedf88ced34b3a75323d1b8c9698cc5edce..698fc347f348fcf96eed03b726a1cd5753666018 100644 --- a/libxml2-2.9.8-python3-unicode-errors.patch +++ b/libxml2-2.11.1-python3-unicode-errors.patch @@ -1,8 +1,12 @@ -Index: libxml2-2.9.5/python/libxml.c +--- + python/libxml.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +Index: libxml2-2.11.1/python/libxml.c =================================================================== ---- libxml2-2.9.5.orig/python/libxml.c -+++ libxml2-2.9.5/python/libxml.c -@@ -1620,6 +1620,7 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU +--- libxml2-2.11.1.orig/python/libxml.c ++++ libxml2-2.11.1/python/libxml.c +@@ -1606,6 +1606,7 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU PyObject *message; PyObject *result; char str[1000]; @@ -10,7 +14,7 @@ Index: libxml2-2.9.5/python/libxml.c #ifdef DEBUG_ERROR printf("libxml_xmlErrorFuncHandler(%p, %s, ...) called\n", ctx, msg); -@@ -1636,12 +1637,20 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU +@@ -1622,12 +1623,20 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNU str[999] = 0; va_end(ap); @@ -26,7 +30,7 @@ Index: libxml2-2.9.5/python/libxml.c - message = libxml_charPtrConstWrap(str); + message = libxml_charPtrConstWrap(ptr); PyTuple_SetItem(list, 1, message); - result = PyEval_CallObject(libxml_xmlPythonErrorFuncHandler, list); + result = PyObject_CallObject(libxml_xmlPythonErrorFuncHandler, list); + /* Forget any errors caused in the error handler. */ + PyErr_Clear(); Py_XDECREF(list); diff --git a/libxml2-2.11.5.tar.xz b/libxml2-2.11.5.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..578d7a09247404650198dd977d6fda2bf82a0722 Binary files /dev/null and b/libxml2-2.11.5.tar.xz differ diff --git a/libxml2-multilib.patch b/libxml2-multilib.patch new file mode 100644 index 0000000000000000000000000000000000000000..dee13839d58d39390ada7d929ee8880c8553ad08 --- /dev/null +++ b/libxml2-multilib.patch @@ -0,0 +1,24 @@ +*** XML/xml2-config.in.orig 2006-06-06 16:35:56.000000000 +0200 +--- XML/xml2-config.in 2006-06-06 16:36:24.000000000 +0200 +*************** +*** 3,9 **** + prefix=@prefix@ + exec_prefix=@exec_prefix@ + includedir=@includedir@ +! libdir=@libdir@ + cflags= + libs= + +--- 3,14 ---- + prefix=@prefix@ + exec_prefix=@exec_prefix@ + includedir=@includedir@ +! if [ "`ldd /bin/sh | grep lib64`" = "" ] +! then +! libdir=${exec_prefix}/lib +! else +! libdir=${exec_prefix}/lib64 +! fi + cflags= + libs= + diff --git a/libxml2.spec b/libxml2.spec index 2fc9ce9edba65de11bbaaf9fc13f0f1064928583..4b2348a443abf5e165003bf93d57ba9f45dfb341 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -1,23 +1,26 @@ %define anolis_release 1 Name: libxml2 -Version: 2.10.4 +Version: 2.11.5 Release: %{anolis_release}%{?dist} Summary: Library providing XML and HTML support License: MIT URL: http://xmlsoft.org/ -Source0: https://download.gnome.org/sources/%{name}/2.10.3/%{name}-%{version}.tar.xz +Source0: https://download.gnome.org/sources/%{name}/2.11/%{name}-%{version}.tar.xz +Patch0: libxml2-multilib.patch # Patch from openSUSE. # See: https://bugzilla.gnome.org/show_bug.cgi?id=789714 -Patch1: libxml2-2.9.8-python3-unicode-errors.patch +Patch1: libxml2-2.11.1-python3-unicode-errors.patch +Patch2: fix-CVE-2023-45322.patch BuildRequires: cmake-rpm-macros -BuildRequires: make -BuildRequires: pkgconfig(liblzma) -BuildRequires: pkgconfig(zlib) +BuildRequires: gcc +BuildRequires: make +BuildRequires: pkgconfig(zlib) +BuildRequires: pkgconfig(liblzma) %description -iThis library allows to manipulate XML files. It includes support +This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output @@ -27,16 +30,23 @@ to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library. - -%package devel -Summary: Development files for %{name} +%package devel +Summary: Libraries, includes, etc. to develop XML and HTML applications Requires: %{name} = %{version}-%{release} Requires: zlib-devel Requires: xz-devel -%description devel -The %{name}-devel package contains libraries and header files for -developing applications that use %{name}. +%description devel +Libraries, include files, etc you can use to develop XML applications. +This library allows to manipulate XML files. It includes support +to read, modify and write XML and HTML files. There is DTDs support +this includes parsing and validation even with complex DtDs, either +at parse time or later once the document has been modified. The output +can be a simple SAX stream or and in-memory DOM like representations. +In this case one can use the built-in XPath and XPointer implementation +to select sub nodes or ranges. A flexible Input/Output mechanism is +available, with existing HTTP and FTP modules and combined to an +URI library. %package static Summary: Static library for libxml2 @@ -72,6 +82,7 @@ Doc files for libxml2 %prep %autosetup -p1 +find doc -type f -executable -print -exec chmod 0644 {} ';' %build %configure \ @@ -84,9 +95,11 @@ Doc files for libxml2 %install %make_install + touch -m --reference=%{buildroot}%{_includedir}/libxml2/libxml/parser.h %{buildroot}%{_bindir}/xml2-config -rm -vf %{buildroot}%{python3_sitearch}/*.a +find %{buildroot} -type f -name '*.la' -print -delete +rm -vf %{buildroot}{%{python2_sitearch},%{python3_sitearch}}/*.a rm -vrf %{buildroot}%{_datadir}/doc/ (cd doc/examples ; make clean ; rm -rf .deps Makefile) gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz @@ -95,7 +108,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %check # Tests require the XML conformance suite, and fail in doc/examples somwhere. -#%make_build check +#%make_build runtests + +%ldconfig_scriptlets %files %dir %{abidir} @@ -105,8 +120,8 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %{_bindir}/xmllint %{_mandir}/man1/xmllint.1* %{_bindir}/xmlcatalog -%{abidir}/xmlcatalog-option.list %{_mandir}/man1/xmlcatalog.1* +%{abidir}/xmlcatalog-option.list %files devel %doc doc/*.html @@ -129,7 +144,7 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %{_libdir}/libxml2.a %files -n python3-%{name} -%doc python/TODO python/libxml2class.txt +%doc python/libxml2class.txt %doc doc/*.py %{python3_sitearch}/libxml2mod.so %{python3_sitelib}/libxml2.py @@ -139,9 +154,12 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %{abidir}/libxml2mod.dump %files doc -%doc NEWS README.md TODO +%doc NEWS README.md %changelog +* Wed Aug 16 2023 David King - 2.11.5-1 +- Update to 2.11.5 and fix CVE-2023-45322 + * Fri Apr 14 2023 Funda Wang - 2.10.4-1 - New version 2.10.4