|
@@ -0,0 +1,164 @@
|
|
|
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
+From: Joey Arhar <[email protected]>
|
|
|
+Date: Fri, 21 Apr 2023 20:53:40 +0000
|
|
|
+Subject: M112: Cherry pick libxml CVE fix
|
|
|
+
|
|
|
+This patch cherry-picks a fix for [CVE-2023-29469] from libxml:
|
|
|
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/547edbf1cbdccd46b2e8ff322a456eaa5931c5df
|
|
|
+
|
|
|
+I cherry-picked these by going into my libxml checkout, checking out the
|
|
|
+commit that libxml is at for this M112 branch, cherry-picking the CVE
|
|
|
+fixes, then running the roll script on all platforms.
|
|
|
+
|
|
|
+Bug: 1433328
|
|
|
+Change-Id: Iaee58b0890f7190386cca3e430286f39ccbbdb02
|
|
|
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4456592
|
|
|
+Commit-Queue: David Baron <[email protected]>
|
|
|
+Reviewed-by: David Baron <[email protected]>
|
|
|
+Commit-Queue: Joey Arhar <[email protected]>
|
|
|
+Auto-Submit: Joey Arhar <[email protected]>
|
|
|
+Cr-Commit-Position: refs/branch-heads/5615@{#1325}
|
|
|
+Cr-Branched-From: 9c6408ef696e83a9936b82bbead3d41c93c82ee4-refs/heads/main@{#1109224}
|
|
|
+
|
|
|
+diff --git a/third_party/libxml/README.chromium b/third_party/libxml/README.chromium
|
|
|
+index 6d0a1facabe938afa2dfa58b2c6f65e18243c851..d1002e2a08e4fb3ecef9a9ac0671ee6cdc746285 100644
|
|
|
+--- a/third_party/libxml/README.chromium
|
|
|
++++ b/third_party/libxml/README.chromium
|
|
|
+@@ -19,5 +19,6 @@ Modifications:
|
|
|
+ in chromium's copy of maldoca. See https://github.com/google/maldoca/issues/87
|
|
|
+ - Add helper classes in the chromium/ subdirectory.
|
|
|
+ - Delete various unused files, see chromium/roll.py
|
|
|
++- Cherry picked fix for CVE-2023-29469
|
|
|
+
|
|
|
+ This import was generated by the chromium/roll.py script.
|
|
|
+diff --git a/third_party/libxml/linux/doc/Makefile b/third_party/libxml/linux/doc/Makefile
|
|
|
+index 4ab8a0eb13bc31abfe79e328c9afc61d9845ac65..b2859bd28a50239e63f2668163ddca5c133c358a 100644
|
|
|
+--- a/third_party/libxml/linux/doc/Makefile
|
|
|
++++ b/third_party/libxml/linux/doc/Makefile
|
|
|
+@@ -308,7 +308,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/doc/devhelp/Makefile b/third_party/libxml/linux/doc/devhelp/Makefile
|
|
|
+index 09140c4cd6773549410b1017b97ced52ad90f0ed..35157eba6d3ab653355a1e82b3fa427beeb2d003 100644
|
|
|
+--- a/third_party/libxml/linux/doc/devhelp/Makefile
|
|
|
++++ b/third_party/libxml/linux/doc/devhelp/Makefile
|
|
|
+@@ -247,7 +247,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/doc/examples/Makefile b/third_party/libxml/linux/doc/examples/Makefile
|
|
|
+index de49a6e20c57088655833a43259e76a0adab8c8d..fc3112d9e1383024a1bf6804dd41a4fd3670037a 100644
|
|
|
+--- a/third_party/libxml/linux/doc/examples/Makefile
|
|
|
++++ b/third_party/libxml/linux/doc/examples/Makefile
|
|
|
+@@ -339,7 +339,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/example/Makefile b/third_party/libxml/linux/example/Makefile
|
|
|
+index 64704cce138f7eeca660ce28366105455c8f24b8..12da414dc30364443b7dbe9e7937322f16223ef2 100644
|
|
|
+--- a/third_party/libxml/linux/example/Makefile
|
|
|
++++ b/third_party/libxml/linux/example/Makefile
|
|
|
+@@ -264,7 +264,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/fuzz/Makefile b/third_party/libxml/linux/fuzz/Makefile
|
|
|
+index 1a2b430f7cc4f7954898022deec15059a85c1905..f7bad838caf820a077efda559aad183375845b3c 100644
|
|
|
+--- a/third_party/libxml/linux/fuzz/Makefile
|
|
|
++++ b/third_party/libxml/linux/fuzz/Makefile
|
|
|
+@@ -328,7 +328,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/include/private/Makefile b/third_party/libxml/linux/include/private/Makefile
|
|
|
+index f510bae409b2e49f1ff8d4925267c0be5fdb758a..99296fc22961d0fee4864417aef7d9a354abd743 100644
|
|
|
+--- a/third_party/libxml/linux/include/private/Makefile
|
|
|
++++ b/third_party/libxml/linux/include/private/Makefile
|
|
|
+@@ -216,7 +216,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/python/Makefile b/third_party/libxml/linux/python/Makefile
|
|
|
+index e8a0aa098fefec080827eb516dcde4c3d1bdc04e..cd842b78e6d899feb0365c029600e0260c487559 100644
|
|
|
+--- a/third_party/libxml/linux/python/Makefile
|
|
|
++++ b/third_party/libxml/linux/python/Makefile
|
|
|
+@@ -355,7 +355,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/python/tests/Makefile b/third_party/libxml/linux/python/tests/Makefile
|
|
|
+index fe38ee497ff9d8a4c54a8ddda067b250761ac6f5..d2b2db6581ad663442c29ba8f08b2eac8aa87e49 100644
|
|
|
+--- a/third_party/libxml/linux/python/tests/Makefile
|
|
|
++++ b/third_party/libxml/linux/python/tests/Makefile
|
|
|
+@@ -247,7 +247,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/linux/xstc/Makefile b/third_party/libxml/linux/xstc/Makefile
|
|
|
+index ccb07dc02091b03d13b4d97a3c6bbe5532429d16..51c32e7a2efd1f9aa9b10f41dc51ffc75431b501 100644
|
|
|
+--- a/third_party/libxml/linux/xstc/Makefile
|
|
|
++++ b/third_party/libxml/linux/xstc/Makefile
|
|
|
+@@ -216,7 +216,7 @@ PYTHON_VERSION = 3.10
|
|
|
+ RANLIB = ranlib
|
|
|
+ RDL_CFLAGS =
|
|
|
+ RDL_LIBS =
|
|
|
+-RELDATE = Wed Feb 22 2023
|
|
|
++RELDATE = Thu Apr 20 2023
|
|
|
+ SED = /usr/bin/sed
|
|
|
+ SET_MAKE =
|
|
|
+ SHELL = /bin/sh
|
|
|
+diff --git a/third_party/libxml/src/dict.c b/third_party/libxml/src/dict.c
|
|
|
+index 1335387243469b7e8510beefed6444b5f46900d5..d0208da1f40257e111518c5e0daa4c2b841449ee 100644
|
|
|
+--- a/third_party/libxml/src/dict.c
|
|
|
++++ b/third_party/libxml/src/dict.c
|
|
|
+@@ -431,7 +431,8 @@ static unsigned long
|
|
|
+ xmlDictComputeFastKey(const xmlChar *name, int namelen, int seed) {
|
|
|
+ unsigned long value = seed;
|
|
|
+
|
|
|
+- if (name == NULL) return(0);
|
|
|
++ if ((name == NULL) || (namelen <= 0))
|
|
|
++ return(value);
|
|
|
+ value += *name;
|
|
|
+ value <<= 5;
|
|
|
+ if (namelen > 10) {
|