From 7027ed1fc73998de9fcac7bfe6a4f72331597d05 Mon Sep 17 00:00:00 2001 From: Funda Wang Date: Wed, 14 May 2025 17:14:11 +0800 Subject: [PATCH] fix CVE-2025-32414 --- backport-CVE-2025-32414.patch | 66 +++++++++++++++++++++++++++++++++++ libxml2.spec | 9 ++++- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-32414.patch diff --git a/backport-CVE-2025-32414.patch b/backport-CVE-2025-32414.patch new file mode 100644 index 0000000..bd49a31 --- /dev/null +++ b/backport-CVE-2025-32414.patch @@ -0,0 +1,66 @@ +From: Maks Verver +Date: Tue, 8 Apr 2025 13:13:55 +0200 +Subject: [PATCH 2/2] [CVE-2025-32414] python: Read at most len/4 characters. + +Fixes #889 by reserving space in the buffer for UTF-8 encoding of text. + +Index: libxml2-2.9.10+dfsg/python/libxml.c +=================================================================== +--- libxml2-2.9.10+dfsg.orig/python/libxml.c 2025-04-28 12:34:16.797639445 +0200 ++++ libxml2-2.9.10+dfsg/python/libxml.c 2025-04-28 12:34:16.793639446 +0200 +@@ -286,7 +286,9 @@ + #endif + file = (PyObject *) context; + if (file == NULL) return(-1); +- ret = PyEval_CallMethod(file, (char *) "read", (char *) "(i)", len); ++ /* When read() returns a string, the length is in characters not bytes, so ++ request at most len / 4 characters to leave space for UTF-8 encoding. */ ++ ret = PyEval_CallMethod(file, (char *) "read", (char *) "(i)", len / 4); + if (ret == NULL) { + printf("xmlPythonFileReadRaw: result is NULL\n"); + return(-1); +@@ -321,10 +323,12 @@ + Py_DECREF(ret); + return(-1); + } +- if (lenread > len) +- memcpy(buffer, data, len); +- else +- memcpy(buffer, data, lenread); ++ if (lenread < 0 || lenread > len) { ++ printf("xmlPythonFileReadRaw: invalid lenread\n"); ++ Py_DECREF(ret); ++ return(-1); ++ } ++ memcpy(buffer, data, lenread); + Py_DECREF(ret); + return(lenread); + } +@@ -351,7 +355,9 @@ + #endif + file = (PyObject *) context; + if (file == NULL) return(-1); +- ret = PyEval_CallMethod(file, (char *) "io_read", (char *) "(i)", len); ++ /* When read() returns a string, the length is in characters not bytes, so ++ request at most len / 4 characters to leave space for UTF-8 encoding. */ ++ ret = PyEval_CallMethod(file, (char *) "io_read", (char *) "(i)", len / 4); + if (ret == NULL) { + printf("xmlPythonFileRead: result is NULL\n"); + return(-1); +@@ -386,10 +392,12 @@ + Py_DECREF(ret); + return(-1); + } +- if (lenread > len) +- memcpy(buffer, data, len); +- else +- memcpy(buffer, data, lenread); ++ if (lenread < 0 || lenread > len) { ++ printf("xmlPythonFileRead: invalid lenread\n"); ++ Py_DECREF(ret); ++ return(-1); ++ } ++ memcpy(buffer, data, lenread); + Py_DECREF(ret); + return(lenread); + } diff --git a/libxml2.spec b/libxml2.spec index 76e1b2b..77e38d7 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -1,7 +1,7 @@ Summary: Library providing XML and HTML support Name: libxml2 Version: 2.9.10 -Release: 44 +Release: 45 License: MIT Group: Development/Libraries Source: ftp://xmlsoft.org/libxml2/libxml2-%{version}.tar.gz @@ -142,6 +142,7 @@ Patch129:backport-CVE-2024-56171.patch Patch130:backport-CVE-2025-24928.patch Patch131:backport-CVE-2025-27113.patch Patch132:backport-CVE-2025-32415.patch +Patch133:backport-CVE-2025-32414.patch BuildRoot: %{_tmppath}/%{name}-%{version}-root BuildRequires: python2-devel @@ -333,6 +334,12 @@ rm -fr %{buildroot} %changelog +* Wed May 14 2025 Funda Wang - 2.9.10-45 +- Type:CVE +- CVE:CVE-2025-32414 +- SUG:NA +- DESC: fix CVE-2025-32414 + * Fri Apr 18 2025 Funda Wang - 2.9.10-44 - Type:CVE - CVE:CVE-2025-32415 -- Gitee