From 0439350149dd2ba8015fcb1ea55687f97117f3da Mon Sep 17 00:00:00 2001 From: panxiaohe Date: Thu, 11 Nov 2021 16:59:42 +0800 Subject: [PATCH] Fix heap-use-after-free in xmlAddNextSibling and xmlAddChild --- ...in-xmlAddNextSibling-and-xmlAddChild.patch | 31 +++++++++++++++++++ libxml2.spec | 9 +++++- 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 Fix-heap-use-after-free-in-xmlAddNextSibling-and-xmlAddChild.patch diff --git a/Fix-heap-use-after-free-in-xmlAddNextSibling-and-xmlAddChild.patch b/Fix-heap-use-after-free-in-xmlAddNextSibling-and-xmlAddChild.patch new file mode 100644 index 0000000..c41cbc8 --- /dev/null +++ b/Fix-heap-use-after-free-in-xmlAddNextSibling-and-xmlAddChild.patch @@ -0,0 +1,31 @@ +From ace5aece17b5ecaafee286fc943616fdee03d885 Mon Sep 17 00:00:00 2001 +From: panxiaohe +Date: Thu, 11 Nov 2021 16:45:04 +0800 +Subject: [PATCH] Fix heap-use-after-free in xmlAddNextSibling and xmlAddChild + +--- + xinclude.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/xinclude.c b/xinclude.c +index b2e6ea1..d39ff7d 100644 +--- a/xinclude.c ++++ b/xinclude.c +@@ -1103,12 +1103,11 @@ xmlXIncludeCopyRange(xmlXIncludeCtxtPtr ctxt, xmlDocPtr target, + } + if (tmp != NULL) { + if (level == lastLevel) +- xmlAddNextSibling(last, tmp); ++ last = xmlAddNextSibling(last, tmp); + else { +- xmlAddChild(last, tmp); ++ last = xmlAddChild(last, tmp); + lastLevel = level; + } +- last = tmp; + } + } + /* +-- +1.8.3.1 + diff --git a/libxml2.spec b/libxml2.spec index 0b3b0aa..10427a2 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -1,7 +1,7 @@ Summary: Library providing XML and HTML support Name: libxml2 Version: 2.9.12 -Release: 1 +Release: 2 License: MIT Group: Development/Libraries Source: ftp://xmlsoft.org/libxml2/libxml2-%{version}.tar.gz @@ -10,6 +10,7 @@ Patch0: libxml2-multilib.patch Patch1: Fix-XPath-recursion-limit.patch Patch2: Fix-Null-deref-in-xmlSchemaGetComponentTargetNs.patch Patch3: Fix-memleaks-in-xmlXIncludeProcessFlags.patch +Patch4: Fix-heap-use-after-free-in-xmlAddNextSibling-and-xmlAddChild.patch BuildRoot: %{_tmppath}/%{name}-%{version}-root BuildRequires: python3-devel @@ -170,6 +171,12 @@ rm -fr %{buildroot} %changelog +* Thu Nov 11 2021 panxiaohe - 2.9.12-2 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:fix heap-use-after-free in xmlAddNextSibling and xmlAddChild + * Wed Nov 10 2021 Zhipeng Xie - 2.9.12-1 - Type:enhancement - ID:NA -- Gitee