From dcded58998d560676de564b53b97173ae91cc4f4 Mon Sep 17 00:00:00 2001 From: yangjinlin01 Date: Wed, 18 Jun 2025 14:26:53 +0800 Subject: [PATCH] [CVE] FIX CVE-2025-24928 to #19328 Commit add patch to fix cve-2025-24928 Project: TC2024080204 Signed-off-by: yangjinlin01 --- Bugfix-for-CVE-2025-24928.patch | 58 +++++++++++++++++++++++++++++++++ libxml2.spec | 7 +++- 2 files changed, 64 insertions(+), 1 deletion(-) create mode 100644 Bugfix-for-CVE-2025-24928.patch diff --git a/Bugfix-for-CVE-2025-24928.patch b/Bugfix-for-CVE-2025-24928.patch new file mode 100644 index 0000000..5799edc --- /dev/null +++ b/Bugfix-for-CVE-2025-24928.patch @@ -0,0 +1,58 @@ +From 858ca26c0689161a6b903a6682cc8a1cc10a0ea8 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Tue, 11 Feb 2025 17:30:40 +0100 +Subject: [PATCH] [CVE-2025-24928] Fix stack-buffer-overflow in + xmlSnprintfElements + +Fixes #847. +--- + valid.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/valid.c b/valid.c +index 76d657d62..abefdc50a 100644 +--- a/valid.c ++++ b/valid.c +@@ -5057,25 +5057,26 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + return; + } + switch (cur->type) { +- case XML_ELEMENT_NODE: ++ case XML_ELEMENT_NODE: { ++ int qnameLen = xmlStrlen(cur->name); ++ ++ if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) ++ qnameLen += xmlStrlen(cur->ns->prefix) + 1; ++ if (size - len < qnameLen + 10) { ++ if ((size - len > 4) && (buf[len - 1] != '.')) ++ strcat(buf, " ..."); ++ return; ++ } + if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) { +- if (size - len < xmlStrlen(cur->ns->prefix) + 10) { +- if ((size - len > 4) && (buf[len - 1] != '.')) +- strcat(buf, " ..."); +- return; +- } + strcat(buf, (char *) cur->ns->prefix); + strcat(buf, ":"); + } +- if (size - len < xmlStrlen(cur->name) + 10) { +- if ((size - len > 4) && (buf[len - 1] != '.')) +- strcat(buf, " ..."); +- return; +- } +- strcat(buf, (char *) cur->name); ++ if (cur->name != NULL) ++ strcat(buf, (char *) cur->name); + if (cur->next != NULL) + strcat(buf, " "); + break; ++ } + case XML_TEXT_NODE: + if (xmlIsBlankNode(cur)) + break; +-- +GitLab + + diff --git a/libxml2.spec b/libxml2.spec index 7056406..59b9566 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -1,4 +1,4 @@ -%define anolis_release 10 +%define anolis_release 11 Name: libxml2 Version: 2.11.5 Release: %{anolis_release}%{?dist} @@ -39,6 +39,8 @@ Patch8: Bugfix-for-CVE-2024-56171.patch Patch9: Bugfix-for-CVE-2025-27113.patch #Upstream fix: https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0 Patch10: Bugfix-for-CVE-2025-6021.patch +#Upstream fix: https://gitlab.gnome.org/GNOME/libxml2/-/commit/858ca26c0689161a6b903a6682cc8a1cc10a0ea8 +Patch11: Bugfix-for-CVE-2025-24928.patch BuildRequires: cmake-rpm-macros BuildRequires: gcc @@ -184,6 +186,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %doc NEWS README.md %changelog +* Wed Jun 18 2025 yangjinlin01 - 2.11.5-11 +- Fix CVE-2025-24928 + * Tue Jun 17 2025 yangjinlin01 - 2.11.5-10 - Fix CVE-2025-6021 -- Gitee