aboutsummaryrefslogtreecommitdiffstats
path: root/main/libxml2/CVE-2017-5969.patch
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2017-06-16 14:25:25 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2017-06-16 14:25:25 +0000
commit80f4efd8ae07abf0f36afd88e30f5a1ed1f94628 (patch)
treee5736df8ce9bae4cd7900bef1e9a56363790f79b /main/libxml2/CVE-2017-5969.patch
parent1082ef7a48afce0e1d604a31e1671a042d160ed7 (diff)
downloadaports-80f4efd8ae07abf0f36afd88e30f5a1ed1f94628.tar.bz2
aports-80f4efd8ae07abf0f36afd88e30f5a1ed1f94628.tar.xz
main/libxml2: fix for CVE-2017-5969
ref #6851
Diffstat (limited to 'main/libxml2/CVE-2017-5969.patch')
-rw-r--r--main/libxml2/CVE-2017-5969.patch63
1 files changed, 63 insertions, 0 deletions
diff --git a/main/libxml2/CVE-2017-5969.patch b/main/libxml2/CVE-2017-5969.patch
new file mode 100644
index 0000000000..367ad730d0
--- /dev/null
+++ b/main/libxml2/CVE-2017-5969.patch
@@ -0,0 +1,63 @@
+From 94691dc884d1a8ada39f073408b4bb92fe7fe882 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Wed, 7 Jun 2017 16:47:36 +0200
+Subject: Fix NULL pointer deref in xmlDumpElementContent
+
+Can only be triggered in recovery mode.
+
+Fixes bug 758422 (CVE-2017-5969).
+---
+ valid.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/valid.c b/valid.c
+index 9b2df56..8075d3a 100644
+--- a/valid.c
++++ b/valid.c
+@@ -1172,29 +1172,33 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementContentPtr content, int glob)
+ xmlBufferWriteCHAR(buf, content->name);
+ break;
+ case XML_ELEMENT_CONTENT_SEQ:
+- if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
+- (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
++ if ((content->c1 != NULL) &&
++ ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
++ (content->c1->type == XML_ELEMENT_CONTENT_SEQ)))
+ xmlDumpElementContent(buf, content->c1, 1);
+ else
+ xmlDumpElementContent(buf, content->c1, 0);
+ xmlBufferWriteChar(buf, " , ");
+- if ((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
+- ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&
+- (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
++ if ((content->c2 != NULL) &&
++ ((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
++ ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&
++ (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE))))
+ xmlDumpElementContent(buf, content->c2, 1);
+ else
+ xmlDumpElementContent(buf, content->c2, 0);
+ break;
+ case XML_ELEMENT_CONTENT_OR:
+- if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
+- (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
++ if ((content->c1 != NULL) &&
++ ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
++ (content->c1->type == XML_ELEMENT_CONTENT_SEQ)))
+ xmlDumpElementContent(buf, content->c1, 1);
+ else
+ xmlDumpElementContent(buf, content->c1, 0);
+ xmlBufferWriteChar(buf, " | ");
+- if ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
+- ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&
+- (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
++ if ((content->c2 != NULL) &&
++ ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
++ ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&
++ (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE))))
+ xmlDumpElementContent(buf, content->c2, 1);
+ else
+ xmlDumpElementContent(buf, content->c2, 0);
+--
+cgit v0.12
+