mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-31 12:49:46 +00:00
Code Issues Projects Releases Wiki Activity

libxslt: Patch for CVE-2025-7424

Browse Source 
This patch is taken from the upstream bug, and is used by Apple in their
build of WebKit.

Origin: https://gitlab.gnome.org/-/project/1762/uploads/627ae84cb0643d9adf6e5c86947f6be6/gnome-libxslt-bug-139-apple-fix.diff

Ref: https://gitlab.gnome.org/GNOME/libxslt/-/issues/139

(From OE-Core rev: 2e2fa1ae7f24dadae9cb8371174aa7744aa42028)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Vijay Anusuri
2025-10-06 14:57:35 +05:30
committed by Steve Sakoman
parent db50dd87bc
commit 4ef41425c6
2 changed files with 106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/libxslt/libxslt/CVE-2025-7424.patch
+105
View File
@@ -0,0 +1,105 @@
From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
From: David Kilzer <ddkilzer@apple.com>
Date: Sat, 24 May 2025 15:06:42 -0700
Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
and source nodes
* libxslt/functions.c:
(xsltDocumentFunctionLoadDocument):
- Implement fix suggested by Ivan Fratric. This copies the xmlDoc,
calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
xmlDoc to tctxt->docList.
- Add error handling for functions that may return NULL.
* libxslt/transform.c:
- Remove static keyword so this can be called from
xsltDocumentFunctionLoadDocument().
* libxslt/transformInternals.h: Add.
(xsltCleanupSourceDoc): Add declaration.
Fixes #139.
Origin: https://gitlab.gnome.org/-/project/1762/uploads/627ae84cb0643d9adf6e5c86947f6be6/gnome-libxslt-bug-139-apple-fix.diff
Upstream-Status: Submitted [https://gitlab.gnome.org/GNOME/libxslt/-/issues/139]
CVE: CVE-2025-7424
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
libxslt/functions.c | 16 +++++++++++++++-
libxslt/transform.c | 3 ++-
libxslt/transformInternals.h | 9 +++++++++
3 files changed, 26 insertions(+), 2 deletions(-)
create mode 100644 libxslt/transformInternals.h
diff --git a/libxslt/functions.c b/libxslt/functions.c
index da25c24..8a9bdc2 100644
--- a/libxslt/functions.c
+++ b/libxslt/functions.c
@@ -41,6 +41,7 @@
#include "numbersInternals.h"
#include "keys.h"
#include "documents.h"
+#include "transformInternals.h"
#ifdef WITH_XSLT_DEBUG
#define WITH_XSLT_DEBUG_FUNCTION
@@ -152,7 +153,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI)
/*
* This selects the stylesheet's doc itself.
*/
- doc = tctxt->style->doc;
+ doc = xmlCopyDoc(tctxt->style->doc, 1);
+ if (doc == NULL) {
+ xsltTransformError(tctxt, NULL, NULL,
+ "document() : failed to copy style doc\n");
+ goto out_fragment;
+ }
+ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
+ idoc = xsltNewDocument(tctxt, doc);
+ if (idoc == NULL) {
+ xsltTransformError(tctxt, NULL, NULL,
+ "document() : failed to create xsltDocument\n");
+ xmlFreeDoc(doc);
+ goto out_fragment;
+ }
} else {
valuePush(ctxt, xmlXPathNewNodeSet(NULL));
diff --git a/libxslt/transform.c b/libxslt/transform.c
index 7299eb5..6976a04 100644
--- a/libxslt/transform.c
+++ b/libxslt/transform.c
@@ -42,6 +42,7 @@
#include "xsltutils.h"
#include "pattern.h"
#include "transform.h"
+#include "transformInternals.h"
#include "variables.h"
#include "numbersInternals.h"
#include "namespaces.h"
@@ -5753,7 +5754,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
*
* Resets source node flags and ids stored in 'psvi' member.
*/
-static void
+void
xsltCleanupSourceDoc(xmlDocPtr doc) {
xmlNodePtr cur = (xmlNodePtr) doc;
void **psviPtr;
diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
new file mode 100644
index 0000000..d0f4282
--- /dev/null
+++ b/libxslt/transformInternals.h
@@ -0,0 +1,9 @@
+/*
+ * Summary: set of internal interfaces for the XSLT engine transformation part.
+ *
+ * Copy: See Copyright for the status of this software.
+ *
+ * Author: David Kilzer <ddkilzer@apple.com>
+ */
+
+void xsltCleanupSourceDoc(xmlDocPtr doc);
--
2.25.1
meta/recipes-support/libxslt/libxslt_1.1.35.bb
+1
View File
@@ -21,6 +21,7 @@ SRC_URI = "https://download.gnome.org/sources/libxslt/1.1/libxslt-${PV}.tar.xz \
file://CVE-2023-40403-003.patch \ file://CVE-2023-40403-003.patch \
file://CVE-2023-40403-004.patch \ file://CVE-2023-40403-004.patch \
file://CVE-2023-40403-005.patch \ file://CVE-2023-40403-005.patch \
file://CVE-2025-7424.patch \
" "
SRC_URI[sha256sum] = "8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79" SRC_URI[sha256sum] = "8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79"