Star0
3
代码
代码
Issues3
Pull Requests2
项目讨论
Wiki
分析
Star0
3
已开启
update to version 1.64.04 #47
Funda Wang创建于 10月3日
update to version 1.64.04 #47
已开启
Funda Wang创建于 10月3日
从fundawang/xmlrpc-cmaster合入到src-openeuler/xmlrpc-cmaster
共 6 个文件变更+54-321
Mbackport-0001-add-meson-buildsystem-definitions.patch+2-1
@@ -297,7 +297,7 @@ new file mode 100644
297index 00000000..daa91fce297index 00000000..daa91fce
298--- /dev/null298--- /dev/null
299+++ b/lib/abyss/src/meson.build299+++ b/lib/abyss/src/meson.build
300-@@ -0,0 +1,65 @@300+@@ -0,0 +1,66 @@
301+abyss_deps = [socket]301+abyss_deps = [socket]
302+if host_machine.system() == 'windows'302+if host_machine.system() == 'windows'
303+ abyss_socket = 'socket_win.c'303+ abyss_socket = 'socket_win.c'
@@ -330,6 +330,7 @@ index 00000000..daa91fce
330+ 'date.c',330+ 'date.c',
331+ 'file.c',331+ 'file.c',
332+ 'handler.c',332+ 'handler.c',
333++ 'html.c',
333+ 'http.c',334+ 'http.c',
334+ 'init.c',335+ 'init.c',
335+ 'response.c',336+ 'response.c',
Dbackport-CVE-2026-15928.patch+0-274
@@ -1,274 +0,0 @@
1-Conflict:context adapt
2-add build config for meson
3-Reference:https://sourceforge.net/p/xmlrpc-c/code/3342/
4- 
5-diff -Nur xmlrpc-c-code-r3341-trunk/lib/abyss/src/handler.c xmlrpc-c-code-r3342-trunk/lib/abyss/src/handler.c
6---- xmlrpc-c-code-r3341-trunk/lib/abyss/src/handler.c 2025-02-13 12:38:42.000000000 +0800
7-+++ xmlrpc-c-code-r3342-trunk/lib/abyss/src/handler.c 2026-07-27 07:53:17.000000000 +0800
8-@@ -36,6 +36,7 @@
9- #include "file.h"
10- #include "conn.h"
11- #include "http.h"
12-+#include "html.h"
13- #include "date.h"
14- #include "abyss_info.h"
15-
16-@@ -291,11 +292,15 @@
17- "------------------------------------"
18- "--------------------------------------------\r\n");
19- } else {
20-+ const char * const escapedUri = html_escapedForHtml(uri);
21-+
22- sprintf(z, "<HTML><HEAD><TITLE>Index of %s</TITLE></HEAD><BODY>"
23- "<H1>Index of %s</H1><PRE>",
24-- uri, uri);
25-+ escapedUri, escapedUri);
26- strcat(z, "Name Size "
27- "Date-Time Type<HR WIDTH=100%>\r\n");
28-+
29-+ xmlrpc_strfree(escapedUri);
30- }
31-
32- HTTPWriteBodyChunk(sessionP, z, strlen(z));
33-@@ -304,6 +309,37 @@
34-
35-
36- static void
37-+formatHtmlForDirEntry(char * const buffer,
38-+ const char * const name,
39-+ int const attrib,
40-+ const char * const z1,
41-+ const char * const z2,
42-+ const char * const z3,
43-+ const char * const z4,
44-+ const char * const p) {
45-+
46-+ const char * const escapedName = html_escapedForHtml(name);
47-+ const char * const escapedZ1 = html_escapedForHtml(z1);
48-+ const char * const escapedZ2 = html_escapedForHtml(z2);
49-+ const char * const escapedZ3 = html_escapedForHtml(z3);
50-+ const char * const escapedZ4 = html_escapedForHtml(z4);
51-+ const char * const escapedP = html_escapedForHtml(p);
52-+
53-+ sprintf(buffer, "<A HREF=\"%s%s\">%s</A>%s %s %s %s\r\n",
54-+ escapedName, attrib & A_SUBDIR ? "/" : "",
55-+ escapedZ1, escapedP, escapedZ3, escapedZ2, escapedZ4);
56-+
57-+ xmlrpc_strfree(escapedP);
58-+ xmlrpc_strfree(escapedZ1);
59-+ xmlrpc_strfree(escapedZ2);
60-+ xmlrpc_strfree(escapedZ3);
61-+ xmlrpc_strfree(escapedZ4);
62-+ xmlrpc_strfree(escapedName);
63-+}
64-+
65-+
66-+
67-+static void
68- sendDirectoryDocument(TList * const listP,
69- bool const ascending,
70- uint16_t const sort,
71-@@ -405,9 +441,7 @@
72- if (text)
73- sprintf(z, "%s%s %s %s %s\r\n", z1, p, z3, z2, z4);
74- else
75-- sprintf(z, "<A HREF=\"%s%s\">%s</A>%s %s %s %s\r\n",
76-- fi->name, fi->attrib & A_SUBDIR ? "/" : "",
77-- z1, p, z3, z2, z4);
78-+ formatHtmlForDirEntry(z, fi->name, fi->attrib, z1, z2, z3, z4, p);
79-
80- HTTPWriteBodyChunk(sessionP, z, strlen(z));
81- }
82-diff -Nur xmlrpc-c-code-r3341-trunk/lib/abyss/src/html.c xmlrpc-c-code-r3342-trunk/lib/abyss/src/html.c
83---- xmlrpc-c-code-r3341-trunk/lib/abyss/src/html.c 1970-01-01 08:00:00.000000000 +0800
84-+++ xmlrpc-c-code-r3342-trunk/lib/abyss/src/html.c 2026-07-27 07:53:17.000000000 +0800
85-@@ -0,0 +1,89 @@
86-+/*=============================================================================
87-+ html
88-+===============================================================================
89-+ This module contains utilities for processing HTML.
90-+=============================================================================*/
91-+
92-+#include <assert.h>
93-+#include <stdlib.h>
94-+
95-+#include <xmlrpc-c/string_int.h>
96-+
97-+#include "html.h"
98-+
99-+
100-+
101-+static void
102-+insertCharEntity(char * const buffer,
103-+ unsigned int * const cursorP,
104-+ const char * const name) {
105-+
106-+ size_t i;
107-+
108-+ buffer[(*cursorP)++] = '&';
109-+
110-+ for (i = 0; i < strlen(name); ++i)
111-+ buffer[(*cursorP)++] = name[i];
112-+
113-+ buffer[(*cursorP)++] = ';';
114-+}
115-+
116-+
117-+
118-+const char *
119-+html_escapedForHtml(const char * const plainText) {
120-+/*----------------------------------------------------------------------------
121-+ The text 'plainText' with HTML control characters replaced with
122-+ HTML character entities so that the result can be used inside an HTML
123-+ document without any chance of interfering with HTML controls.
124-+
125-+ In particular, we substitute one of the following for each associated
126-+ character:
127-+
128-+ &amp;
129-+ &lt;
130-+ &gt;
131-+ &quot;
132-+ &apos;
133-+
134-+ We return newly malloced storage or a constant if we can't get allocate
135-+ enough, like 'xmlrpc_strdupsol', which must be freed with 'xmlrpc_strfree'.
136-+-----------------------------------------------------------------------------*/
137-+
138-+ size_t const maxPossibleReturnSz = strlen(plainText) * 6 + 1;
139-+
140-+ const char * retval;
141-+ char * buffer; /* malloc'ed */
142-+
143-+ buffer = malloc(maxPossibleReturnSz);
144-+
145-+ if (!buffer)
146-+ retval = xmlrpc_strnomemval();
147-+ else {
148-+ unsigned int inCursor, outCursor;
149-+
150-+ for (inCursor = 0, outCursor = 0;
151-+ inCursor < strlen(plainText);
152-+ ++inCursor) {
153-+
154-+ switch (plainText[inCursor]) {
155-+ case '&': insertCharEntity(buffer, &outCursor, "amp"); break;
156-+ case '<': insertCharEntity(buffer, &outCursor, "lt"); break;
157-+ case '>': insertCharEntity(buffer, &outCursor, "gt"); break;
158-+ case '"': insertCharEntity(buffer, &outCursor, "quot"); break;
159-+ case '\'': insertCharEntity(buffer, &outCursor, "apos"); break;
160-+ default:
161-+ buffer[outCursor++] = plainText[inCursor];
162-+ }
163-+ }
164-+
165-+ buffer[outCursor++] = '\0'; /* string-terminating NUL */
166-+
167-+ assert(outCursor <= maxPossibleReturnSz);
168-+
169-+ retval = buffer;
170-+ }
171-+ return retval;
172-+}
173-+
174-+
175-diff -Nur xmlrpc-c-code-r3341-trunk/lib/abyss/src/html.h xmlrpc-c-code-r3342-trunk/lib/abyss/src/html.h
176---- xmlrpc-c-code-r3341-trunk/lib/abyss/src/html.h 1970-01-01 08:00:00.000000000 +0800
177-+++ xmlrpc-c-code-r3342-trunk/lib/abyss/src/html.h 2026-07-27 07:53:17.000000000 +0800
178-@@ -0,0 +1,7 @@
179-+#ifndef HTML_H_INCLUDED
180-+#define HTML_H_INCLUDED
181-+
182-+const char *
183-+html_escapedForHtml(const char * const plainText);
184-+
185-+#endif
186-diff -Nur xmlrpc-c-code-r3341-trunk/lib/abyss/src/Makefile xmlrpc-c-code-r3342-trunk/lib/abyss/src/Makefile
187---- xmlrpc-c-code-r3341-trunk/lib/abyss/src/Makefile 2025-09-23 02:35:26.000000000 +0800
188-+++ xmlrpc-c-code-r3342-trunk/lib/abyss/src/Makefile 2026-07-27 07:53:17.000000000 +0800
189-@@ -49,6 +49,7 @@
190- date \
191- file \
192- handler \
193-+ html \
194- http \
195- init \
196- response \
197-diff -Nur xmlrpc-c-code-r3341-trunk/lib/abyss/src/meson.build xmlrpc-c-code-r3342-trunk/lib/abyss/src/meson.build
198---- xmlrpc-c-code-r3341-trunk/lib/abyss/src/meson.build 2025-09-23 02:35:26.000000000 +0800
199-+++ xmlrpc-c-code-r3342-trunk/lib/abyss/src/meson.build 2026-07-27 07:53:17.000000000 +0800
200-@@ -30,6 +30,7 @@
201- 'date.c',
202- 'file.c',
203- 'handler.c',
204-+ 'html.c',
205- 'http.c',
206- 'init.c',
207- 'response.c',
208-diff -Nur xmlrpc-c-code-r3341-trunk/lib/abyss/src/response.c xmlrpc-c-code-r3342-trunk/lib/abyss/src/response.c
209---- xmlrpc-c-code-r3341-trunk/lib/abyss/src/response.c 2022-08-11 08:46:02.000000000 +0800
210-+++ xmlrpc-c-code-r3342-trunk/lib/abyss/src/response.c 2026-07-27 07:53:17.000000000 +0800
211-@@ -34,6 +34,7 @@
212- #include "data.h"
213- #include "abyss_info.h"
214- #include "http.h"
215-+#include "html.h"
216-
217-
218-
219-@@ -41,6 +42,8 @@
220- ResponseError2(TSession * const sessionP,
221- const char * const explanation) {
222-
223-+ const char * const escapedExplanation = html_escapedForHtml(explanation);
224-+
225- const char * errorDocument;
226-
227- ResponseAddField(sessionP, "Content-type", "text/html");
228-@@ -54,12 +57,14 @@
229- "<P>%s</P>" SERVER_HTML_INFO
230- "</BODY>"
231- "</HTML>",
232-- sessionP->status, sessionP->status, explanation);
233-+ sessionP->status, sessionP->status, escapedExplanation);
234-
235- ConnWrite(sessionP->connP, errorDocument, strlen(errorDocument),
236- CONN_EXPECT_NOTHING);
237-
238- xmlrpc_strfree(errorDocument);
239-+
240-+ xmlrpc_strfree(escapedExplanation);
241- }
242-
243-
244-diff -Nur xmlrpc-c-code-r3341-trunk/src/abyss_handler.c xmlrpc-c-code-r3342-trunk/src/abyss_handler.c
245---- xmlrpc-c-code-r3341-trunk/src/abyss_handler.c 2025-08-02 01:52:09.000000000 +0800
246-+++ xmlrpc-c-code-r3342-trunk/src/abyss_handler.c 2026-07-27 07:53:17.000000000 +0800
247-@@ -611,7 +611,7 @@
248- abyss_bool
249- xmlrpc_serverAbyssDefaultUriHandler(TSession * const sessionP) {
250- /*----------------------------------------------------------------------------
251-- This is an Abyss default handler. It return a 404 Not Found for all
252-+ This is an Abyss default handler. It returns a 404 Not Found for all
253- requests.
254- -----------------------------------------------------------------------------*/
255- const TRequestInfo * requestInfoP;
256-diff -Nur xmlrpc-c-code-r3341-trunk/src/xmlrpc_serialize.c xmlrpc-c-code-r3342-trunk/src/xmlrpc_serialize.c
257---- xmlrpc-c-code-r3341-trunk/src/xmlrpc_serialize.c 2020-06-08 05:33:24.000000000 +0800
258-+++ xmlrpc-c-code-r3342-trunk/src/xmlrpc_serialize.c 2026-07-27 07:53:17.000000000 +0800
259-@@ -157,11 +157,10 @@
260-
261- &#x0d; is known in XML as a "character reference."
262-
263-- We assume chars[] is is ASCII. That isn't right -- we should
264-- handle all valid UTF-8. Someday, we must do something more complex
265-- and copy over multibyte characters verbatim. (The code here could
266-- erroneously find that e.g. the 2nd byte of a UTF-8 character is a
267-- CR).
268-+ We assume chars[] is ASCII. That isn't right -- we should handle all valid
269-+ UTF-8. Someday, we must do something more complex and copy over multibyte
270-+ characters verbatim. (The code here could erroneously find that e.g. the
271-+ 2nd byte of a UTF-8 character is a CR).
272- -----------------------------------------------------------------------------*/
273- xmlrpc_mem_block * outputP;
274- size_t outputSize;
Mbackport-CVE-2026-72522.patch+33-33
@@ -1,33 +1,33 @@
1-From 3f08142848632e4760bec07534adf5f300ffd95c Mon Sep 17 00:00:00 20011+From 3f08142848632e4760bec07534adf5f300ffd95c Mon Sep 17 00:00:00 2001
2-From: Sebastian Pipping <sebastian@pipping.org>2+From: Sebastian Pipping <sebastian@pipping.org>
3-Date: Tue, 4 Aug 2026 19:17:52 +02003+Date: Tue, 4 Aug 2026 19:17:52 +0200
4-Subject: [PATCH 1/7] Changes: Drop an unintended blank line4+Subject: [PATCH 1/7] Changes: Drop an unintended blank line
5- 5+ 
6-Conflict:context adapt6+Conflict:context adapt
7-remove code not exist from expat/lib/xcsinc.c expat/lib/xmlparse.c 7+remove code not exist from expat/lib/xcsinc.c expat/lib/xmlparse.c
8-remove doc8+remove doc
9-remove change of test9+remove change of test
10-Reference:https://github.com/libexpat/libexpat/commit/27c6536c2bfa857b6678b1038d14f43fd65a4aa6.patch10+Reference:https://github.com/libexpat/libexpat/commit/27c6536c2bfa857b6678b1038d14f43fd65a4aa6.patch
11----11+---
12- lib/expat/xmltok/xmltok.c | 5 +++--12+ lib/expat/xmltok/xmltok.c | 5 +++--
13- 1 file changed, 3 insertions(+), 2 deletions(-)13+ 1 file changed, 3 insertions(+), 2 deletions(-)
14- 14+ 
15-diff --git a/lib/expat/xmltok/xmltok.c b/lib/expat/xmltok/xmltok.c15+diff --git a/lib/expat/xmltok/xmltok.c b/lib/expat/xmltok/xmltok.c
16-index 7b31fbb..4f4d904 10064416+index 7b31fbb..4f4d904 100644
17---- a/lib/expat/xmltok/xmltok.c17+--- a/lib/expat/xmltok/xmltok.c
18-+++ b/lib/expat/xmltok/xmltok.c18++++ b/lib/expat/xmltok/xmltok.c
19-@@ -549,9 +549,10 @@ void E ## toUtf16(const ENCODING *enc ATTR_UNUSED, \19+@@ -549,9 +549,10 @@ void E ## toUtf16(const ENCODING *enc ATTR_UNUSED, \
20- const char **fromP, const char *fromLim, \20+ const char **fromP, const char *fromLim, \
21- unsigned short **toP, const unsigned short *toLim) \21+ unsigned short **toP, const unsigned short *toLim) \
22- { \22+ { \
23-- /* Avoid copying first half only of surrogate */ \23+- /* Avoid copying first half only of surrogate */ \
24-+ /* Avoid copying the first half (2 bytes) of surrogate pairs (4 bytes) */ \24++ /* Avoid copying the first half (2 bytes) of surrogate pairs (4 bytes) */ \
25- if (fromLim - *fromP > ((toLim - *toP) << 1) \25+ if (fromLim - *fromP > ((toLim - *toP) << 1) \
26-- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \26+- && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
27-+ && /* are the last two bytes a high surrogate (0xD800-0xDBFF)? */ \27++ && /* are the last two bytes a high surrogate (0xD800-0xDBFF)? */ \
28-+ (GET_HI(fromLim - 2) & 0xFC) == 0xD8) \28++ (GET_HI(fromLim - 2) & 0xFC) == 0xD8) \
29- fromLim -= 2; \29+ fromLim -= 2; \
30- for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \30+ for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \
31- *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \31+ *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
32--- 32+--
33-2.43.033+2.43.0
Dxmlrpc-1.64.03.tgz+0-0
Binary files do not support preview
Axmlrpc-c-1.64.04.tgz+0-0
Binary files do not support preview
Mxmlrpc-c.spec+19-13
@@ -1,20 +1,24 @@
1Name: xmlrpc-c1Name: xmlrpc-c
2-Version: 1.64.032+Version: 1.64.04
3-Release: 33+Release: 1
4Summary: Library implementing XML-based Remote Procedure Calls4Summary: Library implementing XML-based Remote Procedure Calls
5-License: BSD and MIT5+License: BSD-3-Clause
6-URL: http://xmlrpc-c.sourceforge.net/6+URL: https://xmlrpc-c.sourceforge.net/
7-Source0: https://sourceforge.net/projects/xmlrpc-c/files/Xmlrpc-c%20Super%20Stable/%version/xmlrpc-%version.tgz 7+Source0: https://downloads.sourceforge.net/sourceforge/xmlrpc-c/xmlrpc-c-%{version}.tgz
8 8 
9Patch0003: backport-0001-add-meson-buildsystem-definitions.patch9Patch0003: backport-0001-add-meson-buildsystem-definitions.patch
10Patch0004: backport-0002-chmod-x-xml-rpc-api2txt.patch10Patch0004: backport-0002-chmod-x-xml-rpc-api2txt.patch
11Patch0005: backport-CVE-2024-45490-lib-Reject-negative-len-for-XML_ParseBuffer.patch11Patch0005: backport-CVE-2024-45490-lib-Reject-negative-len-for-XML_ParseBuffer.patch
12Patch0006: backport-CVE-2024-45491-lib-Detect-integer-overflow-in-dtdCopy.patch12Patch0006: backport-CVE-2024-45491-lib-Detect-integer-overflow-in-dtdCopy.patch
13-Patch0007: backport-CVE-2026-15928.patch13+Patch0007: backport-CVE-2026-72522.patch
14-Patch0008: backport-CVE-2026-72522.patch
15 14 
16-BuildRequires: git-core meson >= 0.36.0 gcc gcc-c++ ncurses-devel 15+BuildRequires: meson >= 0.36.0
17-BuildRequires: libcurl-devel readline-devel pkgconfig(openssl)16+BuildRequires: gcc
17+BuildRequires: pkgconfig(libcurl)
18+BuildRequires: pkgconfig(libxml-2.0)
19+BuildRequires: pkgconfig(openssl)
20+BuildRequires: ncurses-devel
21+BuildRequires: readline-devel
18 22 
19Provides: xmlrpc-c-c++ = %{version}-%{release} xmlrpc-c-c++%{?_isa} = %{version}-%{release}23Provides: xmlrpc-c-c++ = %{version}-%{release} xmlrpc-c-c++%{?_isa} = %{version}-%{release}
20Obsoletes: xmlrpc-c-c++ < %{version}-%{release} 24Obsoletes: xmlrpc-c-c++ < %{version}-%{release}
@@ -28,8 +32,6 @@ Obsoletes: xmlrpc-c-client++ < %{version}-%{release}
28Provides: xmlrpc-c-apps = %{version}-%{release} xmlrpc-c-apps%{?_isa} = %{version}-%{release}32Provides: xmlrpc-c-apps = %{version}-%{release} xmlrpc-c-apps%{?_isa} = %{version}-%{release}
29Obsoletes: xmlrpc-c-apps < %{version}-%{release} 33Obsoletes: xmlrpc-c-apps < %{version}-%{release}
30 34 
31-Provides: bundled(expat)
32- 
33%description35%description
34XML-RPC is a quick-and-easy way to make procedure calls 36XML-RPC is a quick-and-easy way to make procedure calls
35over the Internet. It converts the procedure call into 37over the Internet. It converts the procedure call into
@@ -46,10 +48,10 @@ Header files for xmlrpc-c.
46%package_help48%package_help
47 49 
48%prep50%prep
49-%autosetup -n xmlrpc-%{version} -p151+%autosetup -n xmlrpc-c-%{version} -p1
50 52 
51%build53%build
52-%meson54+%meson -Dlibxml2-backend=true
53%meson_build55%meson_build
54 56 
55%install57%install
@@ -74,6 +76,10 @@ Header files for xmlrpc-c.
74%{_mandir}/man1/*76%{_mandir}/man1/*
75 77 
76%changelog78%changelog
79+* Fri Oct 02 2026 Funda Wang <fundawang@yeah.net> - 1.64.04-1
80+- update to 1.64.04
81+- build with external libxml2 per next version series of upstream
82+ 
77* Tue Sep 08 2026 zhouyihang <zhouyihang_z@163.com> - 1.64.03-383* Tue Sep 08 2026 zhouyihang <zhouyihang_z@163.com> - 1.64.03-3
78- Type:CVE84- Type:CVE
79- CVE:CVE-2026-7252285- CVE:CVE-2026-72522