mirror of
https://git.yoctoproject.org/poky
synced 2026-02-26 11:29:40 +01:00
57126cdaa7
Pick patch which closed [1]. [1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018 (From OE-Core rev: f1bb433bbdb0fa19d7d8cbe15d4180c9d18cca5a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
77 lines
2.2 KiB
Diff
77 lines
2.2 KiB
Diff
From 1961208e958ca22f80a0b4e4c9d71cfa050aa982 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
|
|
Date: Wed, 17 Dec 2025 15:24:08 +0100
|
|
Subject: [PATCH] catalog: prevent inf recursion in xmlCatalogXMLResolveURI
|
|
|
|
Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
|
|
|
|
CVE: CVE-2026-0989
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982]
|
|
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
|
---
|
|
catalog.c | 31 +++++++++++++++++++++++--------
|
|
1 file changed, 23 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/catalog.c b/catalog.c
|
|
index 76c063a8..46b877e6 100644
|
|
--- a/catalog.c
|
|
+++ b/catalog.c
|
|
@@ -2086,12 +2086,21 @@ static xmlChar *
|
|
xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
|
|
xmlChar *ret = NULL;
|
|
xmlChar *urnID = NULL;
|
|
+ xmlCatalogEntryPtr cur = NULL;
|
|
|
|
if (catal == NULL)
|
|
return(NULL);
|
|
if (URI == NULL)
|
|
return(NULL);
|
|
|
|
+ if (catal->depth > MAX_CATAL_DEPTH) {
|
|
+ xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION,
|
|
+ "Detected recursion in catalog %s\n",
|
|
+ catal->name, NULL, NULL);
|
|
+ return(NULL);
|
|
+ }
|
|
+ catal->depth++;
|
|
+
|
|
if (!xmlStrncmp(URI, BAD_CAST XML_URN_PUBID, sizeof(XML_URN_PUBID) - 1)) {
|
|
urnID = xmlCatalogUnWrapURN(URI);
|
|
if (xmlDebugCatalogs) {
|
|
@@ -2105,21 +2114,27 @@ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
|
|
ret = xmlCatalogListXMLResolve(catal, urnID, NULL);
|
|
if (urnID != NULL)
|
|
xmlFree(urnID);
|
|
+ catal->depth--;
|
|
return(ret);
|
|
}
|
|
- while (catal != NULL) {
|
|
- if (catal->type == XML_CATA_CATALOG) {
|
|
- if (catal->children == NULL) {
|
|
- xmlFetchXMLCatalogFile(catal);
|
|
+ cur = catal;
|
|
+ while (cur != NULL) {
|
|
+ if (cur->type == XML_CATA_CATALOG) {
|
|
+ if (cur->children == NULL) {
|
|
+ xmlFetchXMLCatalogFile(cur);
|
|
}
|
|
- if (catal->children != NULL) {
|
|
- ret = xmlCatalogXMLResolveURI(catal->children, URI);
|
|
- if (ret != NULL)
|
|
+ if (cur->children != NULL) {
|
|
+ ret = xmlCatalogXMLResolveURI(cur->children, URI);
|
|
+ if (ret != NULL) {
|
|
+ catal->depth--;
|
|
return(ret);
|
|
+ }
|
|
}
|
|
}
|
|
- catal = catal->next;
|
|
+ cur = cur->next;
|
|
}
|
|
+
|
|
+ catal->depth--;
|
|
return(ret);
|
|
}
|
|
|