https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288306
--- Comment #11 from bagas <bagas1...@mail.ru> --- taken from here. https://forums.freebsd.org/threads/libxslt.98744/#post-715796 debian fix http://deb.debian.org/debian/pool/main/libx/libxslt/libxslt_1.1.43-0.2.debian.tar.xz CVE-2025-7424 [22:08:45] [linsux!root]/usr/ports/textproc/libxslt#cat files/patch-gnome-libxslt-bug-139-apple-fix.diff >From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001 From: David Kilzer <ddkil...@apple.com> Date: Sat, 24 May 2025 15:06:42 -0700 Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet and source nodes * libxslt/functions.c: (xsltDocumentFunctionLoadDocument): - Implement fix suggested by Ivan Fratric. This copies the xmlDoc, calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the xmlDoc to tctxt->docList. - Add error handling for functions that may return NULL. * libxslt/transform.c: - Remove static keyword so this can be called from xsltDocumentFunctionLoadDocument(). * libxslt/transformInternals.h: Add. (xsltCleanupSourceDoc): Add declaration. Fixes #139. --- libxslt/functions.c | 16 +++++++++++++++- libxslt/transform.c | 3 ++- libxslt/transformInternals.h | 9 +++++++++ 3 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 libxslt/transformInternals.h diff --git a/libxslt/functions.c b/libxslt/functions.c index 72a58dc4..11ec039f 100644 --- libxslt/functions.c.orig +++ libxslt/functions.c @@ -34,6 +34,7 @@ #include "numbersInternals.h" #include "keys.h" #include "documents.h" +#include "transformInternals.h" #ifdef WITH_XSLT_DEBUG #define WITH_XSLT_DEBUG_FUNCTION @@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, /* * This selects the stylesheet's doc itself. */ - doc = tctxt->style->doc; + doc = xmlCopyDoc(tctxt->style->doc, 1); + if (doc == NULL) { + xsltTransformError(tctxt, NULL, NULL, + "document() : failed to copy style doc\n"); + goto out_fragment; + } + xsltCleanupSourceDoc(doc); /* Remove psvi fields. */ + idoc = xsltNewDocument(tctxt, doc); + if (idoc == NULL) { + xsltTransformError(tctxt, NULL, NULL, + "document() : failed to create xsltDocument\n"); + xmlFreeDoc(doc); + goto out_fragment; + } } else { goto out_fragment; } diff --git a/libxslt/transform.c b/libxslt/transform.c index 54ef821b..38c2dce6 100644 --- libxslt/transform.c.orig +++ libxslt/transform.c @@ -43,6 +43,7 @@ #include "xsltlocale.h" #include "pattern.h" #include "transform.h" +#include "transformInternals.h" #include "variables.h" #include "numbersInternals.h" #include "namespaces.h" @@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt) * * Resets source node flags and ids stored in 'psvi' member. */ -static void +void xsltCleanupSourceDoc(xmlDocPtr doc) { xmlNodePtr cur = (xmlNodePtr) doc; void **psviPtr; diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h new file mode 100644 index 00000000..d0f42823 --- /dev/null +++ libxslt/transformInternals.h @@ -0,0 +1,9 @@ +/* + * Summary: set of internal interfaces for the XSLT engine transformation part. + * + * Copy: See Copyright for the status of this software. + * + * Author: David Kilzer <ddkil...@apple.com> + */ + +void xsltCleanupSourceDoc(xmlDocPtr doc); -- 2.39.5 (Apple Git-154) -- You are receiving this mail because: You are the assignee for the bug.
