mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-03-02 05:19:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

libxml2: patch CVE-2026-0990

Browse Source 
Pick patch which closed [1].

[1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018

(From OE-Core rev: f1bb433bbdb0fa19d7d8cbe15d4180c9d18cca5a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Peter Marko
2026-01-25 19:35:05 +01:00
committed by Richard Purdie
parent 35fca9ec35
commit 57126cdaa7
2 changed files with 77 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch Normal file
View File

@@ -0,0 +1,76 @@
From 1961208e958ca22f80a0b4e4c9d71cfa050aa982 Mon Sep 17 00:00:00 2001
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
Date: Wed, 17 Dec 2025 15:24:08 +0100
Subject: [PATCH] catalog: prevent inf recursion in xmlCatalogXMLResolveURI
Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
CVE: CVE-2026-0989
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
catalog.c | 31 +++++++++++++++++++++++--------
1 file changed, 23 insertions(+), 8 deletions(-)
diff --git a/catalog.c b/catalog.c
index 76c063a8..46b877e6 100644
--- a/catalog.c
+++ b/catalog.c
@@ -2086,12 +2086,21 @@ static xmlChar *
xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
xmlChar *ret = NULL;
xmlChar *urnID = NULL;
+ xmlCatalogEntryPtr cur = NULL;
if (catal == NULL)
return(NULL);
if (URI == NULL)
return(NULL);
+ if (catal->depth > MAX_CATAL_DEPTH) {
+ xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION,
+ "Detected recursion in catalog %s\n",
+ catal->name, NULL, NULL);
+ return(NULL);
+ }
+ catal->depth++;
+
if (!xmlStrncmp(URI, BAD_CAST XML_URN_PUBID, sizeof(XML_URN_PUBID) - 1)) {
urnID = xmlCatalogUnWrapURN(URI);
if (xmlDebugCatalogs) {
@@ -2105,21 +2114,27 @@ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
ret = xmlCatalogListXMLResolve(catal, urnID, NULL);
if (urnID != NULL)
xmlFree(urnID);
+ catal->depth--;
return(ret);
}
- while (catal != NULL) {
- if (catal->type == XML_CATA_CATALOG) {
- if (catal->children == NULL) {
- xmlFetchXMLCatalogFile(catal);
+ cur = catal;
+ while (cur != NULL) {
+ if (cur->type == XML_CATA_CATALOG) {
+ if (cur->children == NULL) {
+ xmlFetchXMLCatalogFile(cur);
}
- if (catal->children != NULL) {
- ret = xmlCatalogXMLResolveURI(catal->children, URI);
- if (ret != NULL)
+ if (cur->children != NULL) {
+ ret = xmlCatalogXMLResolveURI(cur->children, URI);
+ if (ret != NULL) {
+ catal->depth--;
return(ret);
+ }
}
}
- catal = catal->next;
+ cur = cur->next;
}
+
+ catal->depth--;
return(ret);
}

1
meta/recipes-core/libxml/libxml2_2.12.10.bb
View File

@@ -26,6 +26,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2025-6170.patch \
file://CVE-2025-7425.patch \
file://CVE-2026-0989.patch \
file://CVE-2026-0990.patch \
"
SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"