ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

libxml2: add upstream patch for CVE-2025-7425

Browse Source 
Change-Id: I84110fc1ed54eac4a0ce4d8b8070a031c761fb39
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189104
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 88e2be781bc22f8500f57c84cec572ead8af32c4)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189118
Tested-by: Jenkins
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
This commit is contained in:
Michael Stahl
2025-08-08 12:02:06 +02:00
committed by Christian Lohmaier
parent ad07f4df8c
commit d6409f6292
2 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
Vendored
+64
View File
@@ -0,0 +1,64 @@
From 9de92ed78d8495527c5d7a4d0cc76c1f83768195 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Tue, 5 Aug 2025 22:26:27 +0200
Subject: [PATCH] tree: Guard against atype corruption
Always remove ids if `id` member is set.
Untested, but this should fix CVE-2025-7425 reported against libxslt:
https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
---
tree.c | 8 ++++----
valid.c | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/tree.c b/tree.c
index 2e8df00b8..ddb8bdb3b 100644
--- a/tree.c
+++ b/tree.c
@@ -1892,8 +1892,8 @@ xmlFreeProp(xmlAttrPtr cur) {
xmlDeregisterNodeDefaultValue((xmlNodePtr)cur);
/* Check for ID removal -> leading to invalid references ! */
- if ((cur->doc != NULL) && (cur->atype == XML_ATTRIBUTE_ID)) {
- xmlRemoveID(cur->doc, cur);
+ if (cur->doc != NULL && cur->id != NULL) {
+ xmlRemoveID(cur->doc, cur);
}
if (cur->children != NULL) xmlFreeNodeList(cur->children);
DICT_FREE(cur->name)
@@ -2736,7 +2736,7 @@ xmlNodeSetDoc(xmlNodePtr node, xmlDocPtr doc) {
* TODO: ID attributes should also be added to the new
* document, but it's not clear how to handle clashes.
*/
- if (attr->atype == XML_ATTRIBUTE_ID)
+ if (attr->id != NULL)
xmlRemoveID(oldDoc, attr);
break;
@@ -6919,7 +6919,7 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar *name,
return(NULL);
}
- if (prop->atype == XML_ATTRIBUTE_ID) {
+ if (prop->id != NULL) {
xmlRemoveID(node->doc, prop);
prop->atype = XML_ATTRIBUTE_ID;
}
diff --git a/valid.c b/valid.c
index 34b6757cb..e625f0c1b 100644
--- a/valid.c
+++ b/valid.c
@@ -4296,7 +4296,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
attr->name, elem->name, NULL);
return(0);
}
- if (attr->atype == XML_ATTRIBUTE_ID)
+ if (attr->id != NULL)
xmlRemoveID(doc, attr);
attr->atype = attrDecl->atype;
--
GitLab
external/libxml2/UnpackedTarball_libxml2.mk
Vendored
+1
View File
@@ -29,6 +29,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
$(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
external/libxml2/libxml2-icu-sym.patch.0, \
external/libxml2/libxml2-icu.patch.0) \
external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 \
))
$(eval $(call gb_UnpackedTarball_add_file,libxml2,xml2-config.in,external/libxml2/xml2-config.in))