mirror of
https://git.yoctoproject.org/poky
synced 2026-03-28 10:02:21 +01:00
cb3bc91a03
Fixes use-after-free in xmlEncodeEntitiesInternal() in entities.c
CVE: CVE-2021-3516
Upstream-Status: Backport [1358d157d0]
(From OE-Core rev: 490cddd7baf1aacb814128b611aabf82fda3e77b)
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
37 lines
1.2 KiB
Diff
37 lines
1.2 KiB
Diff
From b76718876953e11bbd73dc6c9457323fd5aeda2e Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Wed, 21 Apr 2021 13:23:27 +0200
|
|
Subject: [PATCH 2/3] Fix use-after-free with `xmllint --html --push`
|
|
|
|
Call htmlCtxtUseOptions to make sure that names aren't stored in
|
|
dictionaries.
|
|
|
|
Note that this issue only affects xmllint using the HTML push parser.
|
|
|
|
Fixes #230.
|
|
|
|
CVE: CVE-2021-3516
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539]
|
|
|
|
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
|
|
---
|
|
xmllint.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/xmllint.c b/xmllint.c
|
|
index c0712674..ba66676b 100644
|
|
--- a/xmllint.c
|
|
+++ b/xmllint.c
|
|
@@ -2204,7 +2204,7 @@ static void parseAndPrintFile(char *filename, xmlParserCtxtPtr rectxt) {
|
|
if (res > 0) {
|
|
ctxt = htmlCreatePushParserCtxt(NULL, NULL,
|
|
chars, res, filename, XML_CHAR_ENCODING_NONE);
|
|
- xmlCtxtUseOptions(ctxt, options);
|
|
+ htmlCtxtUseOptions(ctxt, options);
|
|
while ((res = fread(chars, 1, pushsize, f)) > 0) {
|
|
htmlParseChunk(ctxt, chars, res, 0);
|
|
}
|
|
--
|
|
2.25.1
|
|
|