Blame SOURCES/libxml2-2.9.7-CVE-2021-3518.patch

6ce3da
From 752e5f71d7cea2ca5a7e7c0b8f72ed04ce654be4 Mon Sep 17 00:00:00 2001
6ce3da
From: Nick Wellnhofer <wellnhofer@aevum.de>
6ce3da
Date: Wed, 10 Jun 2020 16:34:52 +0200
6ce3da
Subject: [PATCH 1/2] Don't recurse into xi:include children in
6ce3da
 xmlXIncludeDoProcess
6ce3da
6ce3da
Otherwise, nested xi:include nodes might result in a use-after-free
6ce3da
if XML_PARSE_NOXINCNODE is specified.
6ce3da
6ce3da
Found with libFuzzer and ASan.
6ce3da
---
6ce3da
 result/XInclude/fallback3.xml     |  8 ++++++++
6ce3da
 result/XInclude/fallback3.xml.err |  0
6ce3da
 result/XInclude/fallback3.xml.rdr | 25 +++++++++++++++++++++++++
6ce3da
 result/XInclude/fallback4.xml     | 10 ++++++++++
6ce3da
 result/XInclude/fallback4.xml.err |  0
6ce3da
 result/XInclude/fallback4.xml.rdr | 29 +++++++++++++++++++++++++++++
6ce3da
 test/XInclude/docs/fallback3.xml  |  9 +++++++++
6ce3da
 test/XInclude/docs/fallback4.xml  |  7 +++++++
6ce3da
 xinclude.c                        | 24 ++++++++++--------------
6ce3da
 9 files changed, 98 insertions(+), 14 deletions(-)
6ce3da
 create mode 100644 result/XInclude/fallback3.xml
6ce3da
 create mode 100644 result/XInclude/fallback3.xml.err
6ce3da
 create mode 100644 result/XInclude/fallback3.xml.rdr
6ce3da
 create mode 100644 result/XInclude/fallback4.xml
6ce3da
 create mode 100644 result/XInclude/fallback4.xml.err
6ce3da
 create mode 100644 result/XInclude/fallback4.xml.rdr
6ce3da
 create mode 100644 test/XInclude/docs/fallback3.xml
6ce3da
 create mode 100644 test/XInclude/docs/fallback4.xml
6ce3da
6ce3da
diff --git a/result/XInclude/fallback3.xml b/result/XInclude/fallback3.xml
6ce3da
new file mode 100644
6ce3da
index 00000000..b4235514
6ce3da
--- /dev/null
6ce3da
+++ b/result/XInclude/fallback3.xml
6ce3da
@@ -0,0 +1,8 @@
6ce3da
+
6ce3da
+
6ce3da
+    <doc xml:base="../ents/something.xml">
6ce3da
+

something

6ce3da
+

really

6ce3da
+

simple

6ce3da
+</doc>
6ce3da
+
6ce3da
diff --git a/result/XInclude/fallback3.xml.err b/result/XInclude/fallback3.xml.err
6ce3da
new file mode 100644
6ce3da
index 00000000..e69de29b
6ce3da
diff --git a/result/XInclude/fallback3.xml.rdr b/result/XInclude/fallback3.xml.rdr
6ce3da
new file mode 100644
6ce3da
index 00000000..aa2f1374
6ce3da
--- /dev/null
6ce3da
+++ b/result/XInclude/fallback3.xml.rdr
6ce3da
@@ -0,0 +1,25 @@
6ce3da
+0 1 a 0 0
6ce3da
+1 14 #text 0 1 
6ce3da
+    
6ce3da
+1 1 doc 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+2 1 p 0 0
6ce3da
+3 3 #text 0 1 something
6ce3da
+2 15 p 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+2 1 p 0 0
6ce3da
+3 3 #text 0 1 really
6ce3da
+2 15 p 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+2 1 p 0 0
6ce3da
+3 3 #text 0 1 simple
6ce3da
+2 15 p 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+1 15 doc 0 0
6ce3da
+1 14 #text 0 1 
6ce3da
+
6ce3da
+0 15 a 0 0
6ce3da
diff --git a/result/XInclude/fallback4.xml b/result/XInclude/fallback4.xml
6ce3da
new file mode 100644
6ce3da
index 00000000..9883fd54
6ce3da
--- /dev/null
6ce3da
+++ b/result/XInclude/fallback4.xml
6ce3da
@@ -0,0 +1,10 @@
6ce3da
+
6ce3da
+
6ce3da
+    
6ce3da
+            <doc xml:base="../ents/something.xml">
6ce3da
+

something

6ce3da
+

really

6ce3da
+

simple

6ce3da
+</doc>
6ce3da
+        
6ce3da
+
6ce3da
diff --git a/result/XInclude/fallback4.xml.err b/result/XInclude/fallback4.xml.err
6ce3da
new file mode 100644
6ce3da
index 00000000..e69de29b
6ce3da
diff --git a/result/XInclude/fallback4.xml.rdr b/result/XInclude/fallback4.xml.rdr
6ce3da
new file mode 100644
6ce3da
index 00000000..628b9513
6ce3da
--- /dev/null
6ce3da
+++ b/result/XInclude/fallback4.xml.rdr
6ce3da
@@ -0,0 +1,29 @@
6ce3da
+0 1 a 0 0
6ce3da
+1 14 #text 0 1 
6ce3da
+    
6ce3da
+1 14 #text 0 1 
6ce3da
+            
6ce3da
+1 1 doc 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+2 1 p 0 0
6ce3da
+3 3 #text 0 1 something
6ce3da
+2 15 p 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+2 1 p 0 0
6ce3da
+3 3 #text 0 1 really
6ce3da
+2 15 p 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+2 1 p 0 0
6ce3da
+3 3 #text 0 1 simple
6ce3da
+2 15 p 0 0
6ce3da
+2 14 #text 0 1 
6ce3da
+
6ce3da
+1 15 doc 0 0
6ce3da
+1 14 #text 0 1 
6ce3da
+        
6ce3da
+1 14 #text 0 1 
6ce3da
+
6ce3da
+0 15 a 0 0
6ce3da
diff --git a/test/XInclude/docs/fallback3.xml b/test/XInclude/docs/fallback3.xml
6ce3da
new file mode 100644
6ce3da
index 00000000..0c8b6c9e
6ce3da
--- /dev/null
6ce3da
+++ b/test/XInclude/docs/fallback3.xml
6ce3da
@@ -0,0 +1,9 @@
6ce3da
+
6ce3da
+    <xi:include href="../ents/something.xml" xmlns:xi="http://www.w3.org/2001/XInclude">
6ce3da
+        <xi:fallback>
6ce3da
+            <xi:include href="c.xml">
6ce3da
+                <xi:fallback>There is no c.xml ... </xi:fallback>
6ce3da
+            </xi:include>
6ce3da
+        </xi:fallback>
6ce3da
+    </xi:include>
6ce3da
+
6ce3da
diff --git a/test/XInclude/docs/fallback4.xml b/test/XInclude/docs/fallback4.xml
6ce3da
new file mode 100644
6ce3da
index 00000000..b500a635
6ce3da
--- /dev/null
6ce3da
+++ b/test/XInclude/docs/fallback4.xml
6ce3da
@@ -0,0 +1,7 @@
6ce3da
+
6ce3da
+    <xi:include href="c.xml" xmlns:xi="http://www.w3.org/2001/XInclude">
6ce3da
+        <xi:fallback>
6ce3da
+            <xi:include href="../ents/something.xml"/>
6ce3da
+        </xi:fallback>
6ce3da
+    </xi:include>
6ce3da
+
6ce3da
diff --git a/xinclude.c b/xinclude.c
6ce3da
index ba850fa5..f260c1a7 100644
6ce3da
--- a/xinclude.c
6ce3da
+++ b/xinclude.c
6ce3da
@@ -2392,21 +2392,19 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
6ce3da
      * First phase: lookup the elements in the document
6ce3da
      */
6ce3da
     cur = tree;
6ce3da
-    if (xmlXIncludeTestNode(ctxt, cur) == 1)
6ce3da
-	xmlXIncludePreProcessNode(ctxt, cur);
6ce3da
     while ((cur != NULL) && (cur != tree->parent)) {
6ce3da
 	/* TODO: need to work on entities -> stack */
6ce3da
-	if ((cur->children != NULL) &&
6ce3da
-	    (cur->children->type != XML_ENTITY_DECL) &&
6ce3da
-	    (cur->children->type != XML_XINCLUDE_START) &&
6ce3da
-	    (cur->children->type != XML_XINCLUDE_END)) {
6ce3da
-	    cur = cur->children;
6ce3da
-	    if (xmlXIncludeTestNode(ctxt, cur))
6ce3da
-		xmlXIncludePreProcessNode(ctxt, cur);
6ce3da
-	} else if (cur->next != NULL) {
6ce3da
+        if (xmlXIncludeTestNode(ctxt, cur) == 1) {
6ce3da
+            xmlXIncludePreProcessNode(ctxt, cur);
6ce3da
+        } else if ((cur->children != NULL) &&
6ce3da
+                   (cur->children->type != XML_ENTITY_DECL) &&
6ce3da
+                   (cur->children->type != XML_XINCLUDE_START) &&
6ce3da
+                   (cur->children->type != XML_XINCLUDE_END)) {
6ce3da
+            cur = cur->children;
6ce3da
+            continue;
6ce3da
+        }
6ce3da
+	if (cur->next != NULL) {
6ce3da
 	    cur = cur->next;
6ce3da
-	    if (xmlXIncludeTestNode(ctxt, cur))
6ce3da
-		xmlXIncludePreProcessNode(ctxt, cur);
6ce3da
 	} else {
6ce3da
 	    if (cur == tree)
6ce3da
 	        break;
6ce3da
@@ -2416,8 +2414,6 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
6ce3da
 		    break; /* do */
6ce3da
 		if (cur->next != NULL) {
6ce3da
 		    cur = cur->next;
6ce3da
-		    if (xmlXIncludeTestNode(ctxt, cur))
6ce3da
-			xmlXIncludePreProcessNode(ctxt, cur);
6ce3da
 		    break; /* do */
6ce3da
 		}
6ce3da
 	    } while (cur != NULL);
6ce3da
-- 
6ce3da
2.31.1
6ce3da
6ce3da
6ce3da
From 49cc4182543dba73216add4021994a81678763bd Mon Sep 17 00:00:00 2001
6ce3da
From: Nick Wellnhofer <wellnhofer@aevum.de>
6ce3da
Date: Thu, 22 Apr 2021 19:26:28 +0200
6ce3da
Subject: [PATCH 2/2] Fix user-after-free with `xmllint --xinclude --dropdtd`
6ce3da
6ce3da
The --dropdtd option can leave dangling pointers in entity reference
6ce3da
nodes. Make sure to skip these nodes when processing XIncludes.
6ce3da
6ce3da
This also avoids scanning entity declarations and even modifying
6ce3da
them inadvertently during XInclude processing.
6ce3da
6ce3da
Move from a block list to an allow list approach to avoid descending
6ce3da
into other node types that can't contain elements.
6ce3da
6ce3da
Fixes #237.
6ce3da
---
6ce3da
 xinclude.c | 5 ++---
6ce3da
 1 file changed, 2 insertions(+), 3 deletions(-)
6ce3da
6ce3da
diff --git a/xinclude.c b/xinclude.c
6ce3da
index f260c1a7..d7648529 100644
6ce3da
--- a/xinclude.c
6ce3da
+++ b/xinclude.c
6ce3da
@@ -2397,9 +2397,8 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
6ce3da
         if (xmlXIncludeTestNode(ctxt, cur) == 1) {
6ce3da
             xmlXIncludePreProcessNode(ctxt, cur);
6ce3da
         } else if ((cur->children != NULL) &&
6ce3da
-                   (cur->children->type != XML_ENTITY_DECL) &&
6ce3da
-                   (cur->children->type != XML_XINCLUDE_START) &&
6ce3da
-                   (cur->children->type != XML_XINCLUDE_END)) {
6ce3da
+                   ((cur->type == XML_DOCUMENT_NODE) ||
6ce3da
+                    (cur->type == XML_ELEMENT_NODE))) {
6ce3da
             cur = cur->children;
6ce3da
             continue;
6ce3da
         }
6ce3da
-- 
6ce3da
2.31.1
6ce3da