Hello community,

here is the log from the commit of package libxml2 for openSUSE:11.4
checked in at Thu Dec 1 12:12:08 CET 2011.



--------
--- old-versions/11.4/UPDATES/all/libxml2/libxml2.changes       2011-06-29 
14:11:08.000000000 +0200
+++ 11.4/libxml2/libxml2.changes        2011-11-28 16:40:25.000000000 +0100
@@ -1,0 +2,5 @@
+Mon Nov 28 15:31:52 UTC 2011 - vci...@suse.com
+
+- add libxml2-CVE-2011-2821.patch (bnc#732787)
+
+-------------------------------------------------------------------

calling whatdependson for 11.4-i586


New:
----
  libxml2-CVE-2011-2821.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ libxml2.spec ++++++
--- /var/tmp/diff_new_pack.Ws4PjO/_old  2011-12-01 12:11:54.000000000 +0100
+++ /var/tmp/diff_new_pack.Ws4PjO/_new  2011-12-01 12:11:54.000000000 +0100
@@ -19,7 +19,7 @@
 
 Name:           libxml2
 Version:        2.7.8
-Release:        16.<RELEASE17>
+Release:        16.<RELEASE19>
 License:        MIT License (or similar)
 Summary:        A Library to Manipulate XML Files
 Url:            http://xmlsoft.org
@@ -29,6 +29,7 @@
 Patch1:         noxref.patch
 Patch2:         libxml2-CVE-2010-4494.patch
 Patch3:         libxml2-CVE-2011-1944.patch
+Patch4:         libxml2-CVE-2011-2821.patch
 BuildRequires:  pkg-config
 BuildRequires:  readline-devel
 BuildRequires:  zlib-devel
@@ -101,6 +102,7 @@
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
 
 %build
 %configure --disable-static \

++++++ libxml2-CVE-2011-2821.patch ++++++
>From f5048b3e71fc30ad096970b8df6e7af073bae4cb Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veill...@redhat.com>
Date: Thu, 18 Aug 2011 09:10:13 +0000
Subject: Hardening of XPath evaluation

Add a mechanism of frame for XPath evaluation when entering a function
or a scoped evaluation, also fix a potential problem in predicate
evaluation.
---
Index: libxml2-2.7.8/include/libxml/xpath.h
===================================================================
--- libxml2-2.7.8.orig/include/libxml/xpath.h   2010-10-12 08:25:32.000000000 
+0200
+++ libxml2-2.7.8/include/libxml/xpath.h        2011-11-28 16:34:41.290246643 
+0100
@@ -68,7 +68,8 @@
     XPATH_UNDEF_PREFIX_ERROR,
     XPATH_ENCODING_ERROR,
     XPATH_INVALID_CHAR_ERROR,
-    XPATH_INVALID_CTXT
+    XPATH_INVALID_CTXT,
+    XPATH_STACK_ERROR
 } xmlXPathError;
 
 /*
@@ -380,6 +381,8 @@
     xmlXPathCompExprPtr comp;          /* the precompiled expression */
     int xptr;                          /* it this an XPointer expression */
     xmlNodePtr         ancestor;       /* used for walking preceding axis */
+
+    int              valueFrame;        /* used to limit Pop on the stack */
 };
 
 /************************************************************************
Index: libxml2-2.7.8/xpath.c
===================================================================
--- libxml2-2.7.8.orig/xpath.c  2011-11-28 16:34:31.000000000 +0100
+++ libxml2-2.7.8/xpath.c       2011-11-28 16:37:19.692872328 +0100
@@ -252,6 +252,7 @@
     "Encoding error\n",
     "Char out of XML range\n",
     "Invalid or incomplete context\n",
+    "Stack usage errror\n",
     "?? Unknown error ??\n"    /* Must be last in the list! */
 };
 #define MAXERRNO ((int)(sizeof(xmlXPathErrorMessages) /        \
@@ -2398,6 +2399,42 @@
  ************************************************************************/
 
 /**
+ * xmlXPathSetFrame:
+ * @ctxt: an XPath parser context
+ *
+ * Set the callee evaluation frame
+ *
+ * Returns the previous frame value to be restored once done
+ */
+static int
+xmlXPathSetFrame(xmlXPathParserContextPtr ctxt) {
+    int ret;
+
+    if (ctxt == NULL)
+        return(0);
+    ret = ctxt->valueFrame;
+    ctxt->valueFrame = ctxt->valueNr;
+    return(ret);
+}
+
+/**
+ * xmlXPathPopFrame:
+ * @ctxt: an XPath parser context
+ * @frame: the previous frame value
+ *
+ * Remove the callee evaluation frame
+ */
+static void
+xmlXPathPopFrame(xmlXPathParserContextPtr ctxt, int frame) {
+    if (ctxt == NULL)
+        return;
+    if (ctxt->valueNr < ctxt->valueFrame) {
+        xmlXPatherror(ctxt, __FILE__, __LINE__, XPATH_STACK_ERROR);
+    }
+    ctxt->valueFrame = frame;
+}
+
+/**
  * valuePop:
  * @ctxt: an XPath evaluation context
  *
@@ -2412,6 +2449,12 @@
 
     if ((ctxt == NULL) || (ctxt->valueNr <= 0))
         return (NULL);
+
+    if (ctxt->valueNr <= ctxt->valueFrame) {
+        xmlXPatherror(ctxt, __FILE__, __LINE__, XPATH_STACK_ERROR);
+        return (NULL);
+    }
+
     ctxt->valueNr--;
     if (ctxt->valueNr > 0)
         ctxt->value = ctxt->valueTab[ctxt->valueNr - 1];
@@ -6154,6 +6197,7 @@
     ret->valueNr = 0;
     ret->valueMax = 10;
     ret->value = NULL;
+    ret->valueFrame = 0;
 
     ret->context = ctxt;
     ret->comp = comp;
@@ -11712,6 +11756,7 @@
        xmlXPathObjectPtr contextObj = NULL, exprRes = NULL;
        xmlNodePtr oldContextNode, contextNode = NULL;
        xmlXPathContextPtr xpctxt = ctxt->context;
+        int frame;
 
 #ifdef LIBXML_XPTR_ENABLED
            /*
@@ -11731,6 +11776,8 @@
        */
        exprOp = &ctxt->comp->steps[op->ch2];
        for (i = 0; i < set->nodeNr; i++) {
+            xmlXPathObjectPtr tmp;
+
            if (set->nodeTab[i] == NULL)
                continue;
 
@@ -11758,23 +11805,25 @@
                xmlXPathNodeSetAddUnique(contextObj->nodesetval,
                    contextNode);
 
+            frame = xmlXPathSetFrame(ctxt);
            valuePush(ctxt, contextObj);
            res = xmlXPathCompOpEvalToBoolean(ctxt, exprOp, 1);
+            tmp = valuePop(ctxt);
+            xmlXPathPopFrame(ctxt, frame);
 
            if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
-               xmlXPathObjectPtr tmp;
-               /* pop the result if any */
-               tmp = valuePop(ctxt);
-                if (tmp != contextObj) {
+                while (tmp != contextObj) {
                     /*
                      * Free up the result
                      * then pop off contextObj, which will be freed later
                      */
                xmlXPathReleaseObject(xpctxt, tmp);
-               valuePop(ctxt);
+                    tmp = valuePop(ctxt);
                 }
                goto evaluation_error;
            }
+            /* push the result back onto the stack */
+            valuePush(ctxt, tmp);
 
            if (res)
                pos++;
@@ -13378,7 +13427,9 @@
                 xmlXPathFunction func;
                 const xmlChar *oldFunc, *oldFuncURI;
                int i;
+                int frame;
 
+                frame = xmlXPathSetFrame(ctxt);
                 if (op->ch1 != -1)
                     total +=
                         xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);
@@ -13386,15 +13437,18 @@
                    xmlGenericError(xmlGenericErrorContext,
                            "xmlXPathCompOpEval: parameter error\n");
                    ctxt->error = XPATH_INVALID_OPERAND;
+                    xmlXPathPopFrame(ctxt, frame);
                    return (total);
                }
-               for (i = 0; i < op->value; i++)
+               for (i = 0; i < op->value; i++) {
                    if (ctxt->valueTab[(ctxt->valueNr - 1) - i] == NULL) {
                        xmlGenericError(xmlGenericErrorContext,
                                "xmlXPathCompOpEval: parameter error\n");
                        ctxt->error = XPATH_INVALID_OPERAND;
+                        xmlXPathPopFrame(ctxt, frame);
                        return (total);
                    }
+                }
                 if (op->cache != NULL)
                     XML_CAST_FPTR(func) = op->cache;
                 else {
@@ -13410,6 +13464,7 @@
                             xmlGenericError(xmlGenericErrorContext,
             "xmlXPathCompOpEval: function %s bound to undefined prefix %s\n",
                                     (char *)op->value4, (char *)op->value5);
+                            xmlXPathPopFrame(ctxt, frame);
                             return (total);
                         }
                         func = xmlXPathFunctionLookupNS(ctxt->context,
@@ -13431,6 +13486,7 @@
                 func(ctxt, op->value);
                 ctxt->context->function = oldFunc;
                 ctxt->context->functionURI = oldFuncURI;
+                xmlXPathPopFrame(ctxt, frame);
                 return (total);
             }
         case XPATH_OP_ARG:
@@ -14334,6 +14390,7 @@
        ctxt->valueNr = 0;
        ctxt->valueMax = 10;
        ctxt->value = NULL;
+        ctxt->valueFrame = 0;
     }
 #ifdef XPATH_STREAMING
     if (ctxt->comp->stream) {
Index: libxml2-2.7.8/xpointer.c
===================================================================
--- libxml2-2.7.8.orig/xpointer.c       2010-10-12 08:25:33.000000000 +0200
+++ libxml2-2.7.8/xpointer.c    2011-11-28 16:34:41.296246819 +0100
@@ -1269,6 +1269,7 @@
        ctxt->valueNr = 0;
        ctxt->valueMax = 10;
        ctxt->value = NULL;
+       ctxt->valueFrame = 0;
     }
     SKIP_BLANKS;
     if (CUR == '/') {
continue with "q"...



Remember to have fun...

-- 
To unsubscribe, e-mail: opensuse-commit+unsubscr...@opensuse.org
For additional commands, e-mail: opensuse-commit+h...@opensuse.org

Reply via email to