diff --git a/Test-for-CVE-2025-6021.patch b/Test-for-CVE-2025-6021.patch new file mode 100644 index 0000000000000000000000000000000000000000..7801b78b27fb6b67f057fb93dd6c99d5e5b2d92b --- /dev/null +++ b/Test-for-CVE-2025-6021.patch @@ -0,0 +1,83 @@ +From a3d1ee597af591bcfb257bba71d089b4ac3665ee Mon Sep 17 00:00:00 2001 +From: panzhe0328 +Date: Mon, 11 Aug 2025 15:17:52 +0800 +Subject: [PATCH] Add test for CVE-2025-6021 + +--- + testapi.c | 42 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +diff --git a/testapi.c b/testapi.c +index 0a0aadf..24fc6bb 100644 +--- a/testapi.c ++++ b/testapi.c +@@ -15,10 +15,12 @@ + #include + #include + #include ++#include + #include + #include + #include + #include ++#include "libxml/xmlmemory.h" + + + static int testlibxml2(void); +@@ -18742,6 +18744,45 @@ test_xmlBuildQName(void) { + return(test_ret); + } + ++static int ++test_xmlBuildQName_overflow(void) { ++ // Test for CVE-2025-6021 ++ int test_ret = 0; ++ ++ printf("Begin to test xmlBuildQName overflow\n"); ++ ++ const xmlChar *prefix = (const xmlChar *)"abc"; ++ size_t ncname_length = (size_t)INT_MAX - 3; ++ xmlChar *ncname = (xmlChar *)xmlMalloc(ncname_length + 1); ++ if (!ncname) { ++ printf("Memory allocation failed for local name\n"); ++ test_ret++; ++ return(test_ret); ++ } ++ memset(ncname, 'a', ncname_length); ++ ncname[ncname_length] = '\0'; ++ xmlChar buf[100]; ++ memset(buf, 'b', sizeof(buf)); ++ ++ xmlChar *result = xmlBuildQName(ncname, prefix, buf, sizeof(buf)); ++ if (result == buf) { ++ test_ret++; ++ printf("Used input buffer directly: potential overflow detected.\n"); ++ } else if (result) { ++ printf("Created new buffer for result: safe allocation path.\n"); ++ xmlFree(result); ++ } else { ++ test_ret++; ++ printf("Operation returned NULL: unexpected error occurred.\n"); ++ } ++ ++ xmlFree(ncname); ++ xmlCleanupParser(); ++ ++ function_tests++; ++ ++ return(test_ret); ++} + + static int + test_xmlChildElementCount(void) { +@@ -23978,6 +24019,7 @@ test_tree(void) { + test_ret += test_xmlValidateNMToken(); + test_ret += test_xmlValidateName(); + test_ret += test_xmlValidateQName(); ++ test_ret += test_xmlBuildQName_overflow(); + + if (test_ret != 0) + printf("Module tree: %d errors\n", test_ret); +-- +2.25.1 + diff --git a/libxml2.spec b/libxml2.spec index 687e5c70c36f83a53fb0d1cb8abb8f57b31729c9..87efd384478354dc66b531a589f3f06547d9b071 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -1,7 +1,7 @@ Summary: Library providing XML and HTML support Name: libxml2 Version: 2.12.10 -Release: 6 +Release: 7 License: MIT Group: Development/Libraries Source: https://download.gnome.org/sources/%{name}/2.12/%{name}-%{version}.tar.xz @@ -14,6 +14,7 @@ Patch6004: CVE-2025-49795.patch Patch6005: CVE-2025-49794,CVE-2025-49796.patch Patch6006: backport-CVE-2025-6170.patch Patch6007: backport-Fix-relaxng-is-parsed-to-an-infinite-attrs-next-loop.patch +Patch6008: Test-for-CVE-2025-6021.patch BuildRequires: pkgconfig(liblzma) BuildRequires: pkgconfig(python3) @@ -133,6 +134,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %changelog +* Thu Aug 14 2025 panzhe - 2.12.10-7 +- Add test for CVE-2025-6021 + * Tue Aug 12 2025 andy - 2.12.10-6 - Type:bugfix - ID:NA