From ee6bb0cc763507b165674dbe03c6ae5d26c8da5c Mon Sep 17 00:00:00 2001
From: Mark H Weaver <mhw@netris.org>
Date: Sun, 15 Nov 2015 14:16:57 -0500
Subject: gnu: libxml2: Add fixes for CVE-2015-{1819,7941,7942,8035} and other
 bugs.

* gnu/packages/patches/libxml2-CVE-2015-1819.patch,
  gnu/packages/patches/libxml2-CVE-2015-7941-pt1.patch,
  gnu/packages/patches/libxml2-CVE-2015-7941-pt2.patch,
  gnu/packages/patches/libxml2-CVE-2015-7942-pt1.patch,
  gnu/packages/patches/libxml2-CVE-2015-7942-pt2.patch,
  gnu/packages/patches/libxml2-CVE-2015-8035.patch,
  gnu/packages/patches/libxml2-bug-737840.patch,
  gnu/packages/patches/libxml2-bug-738805.patch,
  gnu/packages/patches/libxml2-bug-746048.patch,
  gnu/packages/patches/libxml2-bug-747437.patch,
  gnu/packages/patches/libxml2-bug-751603.patch,
  gnu/packages/patches/libxml2-bug-751631.patch,
  gnu/packages/patches/libxml2-bug-754946.patch,
  gnu/packages/patches/libxml2-bug-754947.patch,
  gnu/packages/patches/libxml2-bug-755857.patch,
  gnu/packages/patches/libxml2-fix-catalog-corruption.patch,
  gnu/packages/patches/libxml2-id-attrs-in-xmlSetTreeDoc.patch,
  gnu/packages/patches/libxml2-node-sort-order-pt1.patch,
  gnu/packages/patches/libxml2-node-sort-order-pt2.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/xml.scm (libxml2)[source]: Add patches.
---
 .../patches/libxml2-CVE-2015-7942-pt1.patch        | 32 ++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 gnu/packages/patches/libxml2-CVE-2015-7942-pt1.patch

(limited to 'gnu/packages/patches/libxml2-CVE-2015-7942-pt1.patch')

diff --git a/gnu/packages/patches/libxml2-CVE-2015-7942-pt1.patch b/gnu/packages/patches/libxml2-CVE-2015-7942-pt1.patch
new file mode 100644
index 0000000000..bd9077d7c4
--- /dev/null
+++ b/gnu/packages/patches/libxml2-CVE-2015-7942-pt1.patch
@@ -0,0 +1,32 @@
+From bd0526e66a56e75a18da8c15c4750db8f801c52d Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Fri, 23 Oct 2015 19:02:28 +0800
+Subject: [PATCH] Another variation of overflow in Conditional sections
+
+Which happen after the previous fix to
+https://bugzilla.gnome.org/show_bug.cgi?id=756456
+
+But stopping the parser and exiting we didn't pop the intermediary entities
+and doing the SKIP there applies on an input which may be too small
+---
+ parser.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index a65e4cc..b9217ff 100644
+--- a/parser.c
++++ b/parser.c
+@@ -6915,7 +6915,9 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
+ 	"All markup of the conditional section is not in the same entity\n",
+ 				 NULL, NULL);
+ 	}
+-        SKIP(3);
++	if ((ctxt-> instate != XML_PARSER_EOF) &&
++	    ((ctxt->input->cur + 3) < ctxt->input->end))
++	    SKIP(3);
+     }
+ }
+ 
+-- 
+2.6.3
+
-- 
cgit v1.2.3