[OE-core] [PATCH] libxml2: fix CVE-2017-8872

[Burton, Ross]

This isn't a backport, it's just a patch that is in bugzilla so should
be marked as Submitted.

Ross



On 3 July 2018 at 09:10, Hongxu Jia <hongxu.jia at windriver.com> wrote:
> The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4
> allows attackers to cause a denial of service (buffer over-read) or
> information disclosure.
>
> https://bugzilla.gnome.org/show_bug.cgi?id=775200
>
> Signed-off-by: Hongxu Jia <hongxu.jia at windriver.com>
> ---
>  .../libxml/libxml2/fix-CVE-2017-8872.patch         | 38 ++++++++++++++++++++++
>  meta/recipes-core/libxml/libxml2_2.9.8.bb          |  1 +
>  2 files changed, 39 insertions(+)
>  create mode 100644 meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch
>
> diff --git a/meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch b/meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch
> new file mode 100644
> index 0000000..e34a48e
> --- /dev/null
> +++ b/meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch
> @@ -0,0 +1,38 @@
> +From b4bee17b158e289e5c4c9045e64e5374ccafe068 Mon Sep 17 00:00:00 2001
> +From: Salvatore Bonaccorso <carnil at debian.org>
> +Date: Tue, 3 Jul 2018 15:54:03 +0800
> +Subject: [PATCH] Out-of-bounds read in htmlParseTryOrFinish (CVE-2017-8872)
> +
> +https://bugzilla.gnome.org/show_bug.cgi?id=775200
> +Fixes bug 775200.
> +
> +Signed-off-by: Salvatore Bonaccorso <carnil at debian.org>
> +
> +Upstream-Status: Backport
> +https://bug775200.bugzilla-attachments.gnome.org/attachment.cgi?id=366193
> +CVE: CVE-2017-8872
> +Signed-off-by: Hongxu Jia <hongxu.jia at windriver.com>
> +---
> + parser.c | 6 +++++-
> + 1 file changed, 5 insertions(+), 1 deletion(-)
> +
> +diff --git a/parser.c b/parser.c
> +index ca9fde2..fb4c889 100644
> +--- a/parser.c
> ++++ b/parser.c
> +@@ -12464,7 +12464,11 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) {
> +       }
> +       ctxt->input->cur = BAD_CAST"";
> +       ctxt->input->base = ctxt->input->cur;
> +-        ctxt->input->end = ctxt->input->cur;
> ++      ctxt->input->end = ctxt->input->cur;
> ++      if (ctxt->input->buf)
> ++          xmlBufEmpty (ctxt->input->buf->buffer);
> ++      else
> ++          ctxt->input->length = 0;
> +     }
> + }
> +
> +--
> +2.7.4
> +
> diff --git a/meta/recipes-core/libxml/libxml2_2.9.8.bb b/meta/recipes-core/libxml/libxml2_2.9.8.bb
> index d55e650..1f22bb0 100644
> --- a/meta/recipes-core/libxml/libxml2_2.9.8.bb
> +++ b/meta/recipes-core/libxml/libxml2_2.9.8.bb
> @@ -20,6 +20,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
>             file://libxml-m4-use-pkgconfig.patch \
>             file://0001-Make-ptest-run-the-python-tests-if-python-is-enabled.patch \
>             file://fix-execution-of-ptests.patch \
> +           file://fix-CVE-2017-8872.patch \
>             "
>
>  SRC_URI[libtar.md5sum] = "b786e353e2aa1b872d70d5d1ca0c740d"
> --
> 2.7.4
>