已合并
libxml2修复CVE-2026-0992 #144
limin创建于 2月10日
libxml2修复CVE-2026-0992 #144
已合并
共 3 个文件变更+50-1
| @@ -76,6 +76,7 @@ action("libxml2_install_action") { | |||
| 76 | "Fix-CVE-2025-49795-null-pointer-dereference-leading-to-DoS.patch", | 76 | "Fix-CVE-2025-49795-null-pointer-dereference-leading-to-DoS.patch", |
| 77 | "Fix-CVE-2025-8732-Prevent-infinite-recursion-in-xmlCatalogList.patch", | 77 | "Fix-CVE-2025-8732-Prevent-infinite-recursion-in-xmlCatalogList.patch", |
| 78 | "Fix-CVE-2026-0990-catalog-prevent-inf-recursion-in-xmlCatalogXMLResolveURI.patch", | 78 | "Fix-CVE-2026-0990-catalog-prevent-inf-recursion-in-xmlCatalogXMLResolveURI.patch", |
| 79 | + "Fix-CVE-2026-0992-catalog-Ignore-repeated-nextCatalog-entries.patch", | ||
| 79 | ] | 80 | ] |
| 80 | 81 | ||
| 81 | args = [ | 82 | args = [ |
| @@ -0,0 +1,47 @@ | |||
| 1 | +From 997657d2950f6b1530949c3d3187490922e9713d Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Daniel Garcia Moreno <daniel.garcia@suse.com> | ||
| 3 | +Date: Fri, 19 Dec 2025 11:02:18 +0100 | ||
| 4 | +Subject: [PATCH] catalog: Ignore repeated nextCatalog entries | ||
| 5 | + | ||
| 6 | +This patch makes the catalog parsing to ignore repeated entries of | ||
| 7 | +nextCatalog with the same value. | ||
| 8 | + | ||
| 9 | +Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019 | ||
| 10 | +--- | ||
| 11 | + catalog.c | 17 +++++++++++++++++ | ||
| 12 | + 1 file changed, 17 insertions(+) | ||
| 13 | + | ||
| 14 | +diff --git a/catalog.c b/catalog.c | ||
| 15 | +index f43443b27..e6f38fa32 100644 | ||
| 16 | +--- a/catalog.c | ||
| 17 | ++++ b/catalog.c | ||
| 18 | + xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer, | ||
| 19 | + BAD_CAST "delegateURI", BAD_CAST "uriStartString", | ||
| 20 | + BAD_CAST "catalog", prefer, cgroup); | ||
| 21 | + } else if (xmlStrEqual(cur->name, BAD_CAST "nextCatalog")) { | ||
| 22 | ++ xmlCatalogEntryPtr prev = parent->children; | ||
| 23 | ++ | ||
| 24 | + entry = xmlParseXMLCatalogOneNode(cur, XML_CATA_NEXT_CATALOG, | ||
| 25 | + BAD_CAST "nextCatalog", NULL, | ||
| 26 | + BAD_CAST "catalog", prefer, cgroup); | ||
| 27 | ++ /* Avoid duplication of nextCatalog */ | ||
| 28 | ++ while (prev != NULL) { | ||
| 29 | ++ if ((prev->type == XML_CATA_NEXT_CATALOG) && | ||
| 30 | ++ (xmlStrEqual (prev->URL, entry->URL)) && | ||
| 31 | ++ (prev->prefer == entry->prefer) && | ||
| 32 | ++ (prev->group == entry->group)) { | ||
| 33 | ++ if (xmlDebugCatalogs) | ||
| 34 | ++ xmlCatalogPrintDebug( | ||
| 35 | ++ "Ignoring repeated nextCatalog %s\n", entry->URL); | ||
| 36 | ++ xmlFreeCatalogEntry(entry, NULL); | ||
| 37 | ++ entry = NULL; | ||
| 38 | ++ break; | ||
| 39 | ++ } | ||
| 40 | ++ prev = prev->next; | ||
| 41 | ++ } | ||
| 42 | + } | ||
| 43 | + if (entry != NULL) { | ||
| 44 | + if (parent != NULL) { | ||
| 45 | +-- | ||
| 46 | +2.34.1 | ||
| 47 | + | ||
| @@ -57,7 +57,8 @@ def do_patch(args, target_dir): | |||
| 57 | "Fix-CVE-2025-49794-CVE-2025-49796-memory-safety-issues-in-xmlSchematronReportOutput.patch", | 57 | "Fix-CVE-2025-49794-CVE-2025-49796-memory-safety-issues-in-xmlSchematronReportOutput.patch", |
| 58 | "Fix-CVE-2025-49795-null-pointer-dereference-leading-to-DoS.patch", | 58 | "Fix-CVE-2025-49795-null-pointer-dereference-leading-to-DoS.patch", |
| 59 | "Fix-CVE-2025-8732-Prevent-infinite-recursion-in-xmlCatalogList.patch", | 59 | "Fix-CVE-2025-8732-Prevent-infinite-recursion-in-xmlCatalogList.patch", |
| 60 | - "Fix-CVE-2026-0990-catalog-prevent-inf-recursion-in-xmlCatalogXMLResolveURI.patch" | 60 | + "Fix-CVE-2026-0990-catalog-prevent-inf-recursion-in-xmlCatalogXMLResolveURI.patch", |
| 61 | + "Fix-CVE-2026-0992-catalog-Ignore-repeated-nextCatalog-entries.patch" | ||
| 61 | ] | 62 | ] |
| 62 | 63 | ||
| 63 | for patch in patch_file: | 64 | for patch in patch_file: |