mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-08-30 00:26:36 +00:00
Code Issues Projects Releases Wiki Activity

libxml2: Fix CVE-2026-11979

Browse Source 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-11979

(From OE-Core rev: e2a9a776855ea1de5c7c6817d282ea2f555395ef)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Devansh Patel
2026-07-20 11:42:52 -07:00
committed by Paul Barker
parent e5c6f86964
commit 51d4fee207
2 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
+70
View File
@@ -0,0 +1,70 @@
From d8566dd918c612078dfb3ee1a95d7bb6f0656bfe Mon Sep 17 00:00:00 2001
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
Date: Fri, 22 May 2026 12:21:20 +0200
Subject: [PATCH] xmlcatalog: overflow check for large --shell commands
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
CVE: CVE-2026-11979
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e]
Backport Changes:
- The commit modifies test/catalogs/test.sh.
- test/catalogs/test.sh does not exist in the libxml2 v2.12.10
source used in Scarthgap and was introduced later version
libxml2 v2.14.0 [1].
- The test changes were omitted; only the required fix in
xmlcatalog.c was backported.
[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/f06fc933cdaea2ce8e9cea275fdbf4edb85f9837
(cherry picked from commit c2e233fc1b341685fc99621b2768b503f777a72e)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
xmlcatalog.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/xmlcatalog.c b/xmlcatalog.c
index 588802b41..51569b879 100644
--- a/xmlcatalog.c
+++ b/xmlcatalog.c
@@ -114,6 +114,12 @@ static void usershell(void) {
(*cur != '\n') && (*cur != '\r')) {
if (*cur == 0)
break;
+ /* Do not read beyond the command array capacity */
+ if (i >= (int)sizeof(command) - 2) {
+ printf("Invalid command %s\n", cur);
+ i = 0;
+ break;
+ }
command[i++] = *cur++;
}
command[i] = 0;
@@ -131,6 +137,11 @@ static void usershell(void) {
while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
if (*cur == 0)
break;
+ if (i >= (int)sizeof(arg) - 2) {
+ printf("Invalid arg %s\n", arg);
+ i = 0;
+ break;
+ }
arg[i++] = *cur++;
}
arg[i] = 0;
@@ -143,6 +154,11 @@ static void usershell(void) {
cur = arg;
memset(argv, 0, sizeof(argv));
while (*cur != 0) {
+ if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
+ printf("Too much arguments\n");
+ break;
+ }
+
while ((*cur == ' ') || (*cur == '\t')) cur++;
if (*cur == '\'') {
cur++;
--
2.35.6
meta/recipes-core/libxml/libxml2_2.12.10.bb
+1
View File
@@ -31,6 +31,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2026-0992-02.patch \
file://CVE-2026-0992-03.patch \
file://CVE-2026-1757.patch \
file://CVE-2026-11979.patch \
"
SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"