From 08704a58f5c388f33e07e0ab8dc8326479de7771 Mon Sep 17 00:00:00 2001
From: sa-buc <zjl02254423@alibaba-inc.com>
Date: Tue, 26 Aug 2025 18:15:57 +0800
Subject: [PATCH] add patch to fix cve

---
 Bugfix-for-CVE-2025-49795.patch | 66 +++++++++++++++++++++++++++++++++
 libxml2.spec                    |  7 +++-
 2 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100644 Bugfix-for-CVE-2025-49795.patch

diff --git a/Bugfix-for-CVE-2025-49795.patch b/Bugfix-for-CVE-2025-49795.patch
new file mode 100644
index 0000000..3ab9d28
--- /dev/null
+++ b/Bugfix-for-CVE-2025-49795.patch
@@ -0,0 +1,66 @@
+From 499bcb78ab389f60c2fd634ce410d4bb85c18765 Mon Sep 17 00:00:00 2001
+From: Michael Mann <mmann78@netscape.net>
+Date: Sat, 21 Jun 2025 12:11:30 -0400
+Subject: [PATCH] Schematron: Fix null pointer dereference leading to DoS
+
+(CVE-2025-49795)
+
+Fixes #932
+---
+ result/schematron/zvon16_0.err | 1 +
+ schematron.c                   | 2 ++
+ test/schematron/zvon16.sct     | 7 +++++++
+ test/schematron/zvon16_0.xml   | 5 +++++
+ 4 files changed, 15 insertions(+)
+ create mode 100644 result/schematron/zvon16_0.err
+ create mode 100644 test/schematron/zvon16.sct
+ create mode 100644 test/schematron/zvon16_0.xml
+
+diff --git a/result/schematron/zvon16_0.err b/result/schematron/zvon16_0.err
+new file mode 100644
+index 000000000..465cf2eb4
+--- /dev/null
++++ b/result/schematron/zvon16_0.err
+@@ -0,0 +1 @@
++xmlSchematronParse: could not load './test/schematron/zvon16.sct'
+\ No newline at end of file
+diff --git a/schematron.c b/schematron.c
+index 5c1a27bf1..d33755e6d 100644
+--- a/schematron.c
++++ b/schematron.c
+@@ -1453,6 +1453,8 @@ xmlSchematronFormatReport(xmlSchematronValidCtxtPtr ctxt,
+             select = xmlGetNoNsProp(child, BAD_CAST "select");
+             comp = xmlXPathCtxtCompile(ctxt->xctxt, select);
+             eval = xmlXPathCompiledEval(comp, ctxt->xctxt);
++            if (eval == NULL)
++                return ret;
+ 
+             switch (eval->type) {
+             case XPATH_NODESET: {
+diff --git a/test/schematron/zvon16.sct b/test/schematron/zvon16.sct
+new file mode 100644
+index 000000000..4d24c0541
+--- /dev/null
++++ b/test/schematron/zvon16.sct
+@@ -0,0 +1,7 @@
++<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron"
++	<sch:pattern id="TestPattern">
++		<sch:rule context="book">
++			<sch:report test="not(@available)">Book <sch:value-of select="falae()"/> test</sch:report>
++		</sch:rule>
++	</sch:pattern>
++</sch:schema>
+diff --git a/test/schematron/zvon16_0.xml b/test/schematron/zvon16_0.xml
+new file mode 100644
+index 000000000..551e2d654
+--- /dev/null
++++ b/test/schematron/zvon16_0.xml
+@@ -0,0 +1,5 @@
++<library>
++	<book title="Test Book" id="bk101">
++		<author>Test Author</author>
++	</book>
++</library>
+-- 
+GitLab
+
diff --git a/libxml2.spec b/libxml2.spec
index 273a610..853bab1 100644
--- a/libxml2.spec
+++ b/libxml2.spec
@@ -1,4 +1,4 @@
-%define anolis_release 14
+%define anolis_release 15
 Name:           libxml2
 Version:        2.11.5
 Release:        %{anolis_release}%{?dist}
@@ -46,6 +46,8 @@ Patch12:       Bugfix-for-CVE-2025-49794.patch
 Patch13:       13-bugfix-for-CVE-2025-7425.patch
 # https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/321/diffs?commit_id=069bcda17d8194e9582c64dd4bc9dac99b015810
 Patch14:       1002-fix-CVE-2025-6170.patch
+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/499bcb78ab389f60c2fd634ce410d4bb85c18765
+Patch15:       Bugfix-for-CVE-2025-49795.patch
 
 BuildRequires:  cmake-rpm-macros
 BuildRequires:  gcc
@@ -191,6 +193,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
 %doc NEWS README.md
 
 %changelog
+* Wed Aug 27 2025 zjl002254423 <zjl02254423@alibaba-inc.com> - 2.11.5-15
+- Add patch to fix CVE-2025-49795
+
 * Mon Aug 04 2025 wenxin <wx02272781@alibaba-inc.com> - 2.11.5-14
 - Add patch to fix CVE-2025-6170
 
-- 
Gitee