forked from rpms/libxslt
Fix CVE-2025-24855 (RHEL-83489)
Resolves: RHEL-83489
This commit is contained in:
David King
parent
bd7aac166c
commit
15c6b90115
130
libxslt-1.1.39-CVE-2025-24855.patch
Normal file
130
libxslt-1.1.39-CVE-2025-24855.patch
Normal file
@ -0,0 +1,130 @@
|
||||
From 1dbe5519852f9c24706ca55ab01367acc1a7ee0a Mon Sep 17 00:00:00 2001
|
||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
||||
Date: Tue, 17 Dec 2024 15:56:21 +0100
|
||||
Subject: [PATCH] [CVE-2025-24855] Fix use-after-free of XPath context node
|
||||
|
||||
There are several places where the XPath context node isn't restored
|
||||
after modifying it, leading to use-after-free errors with nested XPath
|
||||
evaluations and dynamically allocated context nodes.
|
||||
|
||||
Restore XPath context node in
|
||||
|
||||
- xsltNumberFormatGetValue
|
||||
- xsltEvalXPathPredicate
|
||||
- xsltEvalXPathStringNs
|
||||
- xsltComputeSortResultInternal
|
||||
|
||||
In some places, the transformation context node was saved and restored
|
||||
which shouldn't be necessary.
|
||||
|
||||
Thanks to Ivan Fratric for the report!
|
||||
|
||||
Fixes #128.
|
||||
---
|
||||
libxslt/numbers.c | 5 +++++
|
||||
libxslt/templates.c | 9 ++++++---
|
||||
libxslt/xsltutils.c | 4 ++--
|
||||
3 files changed, 13 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/libxslt/numbers.c b/libxslt/numbers.c
|
||||
index 3cd881e3..566df030 100644
|
||||
--- a/libxslt/numbers.c
|
||||
+++ b/libxslt/numbers.c
|
||||
@@ -713,9 +713,12 @@ xsltNumberFormatGetValue(xmlXPathContextPtr context,
|
||||
int amount = 0;
|
||||
xmlBufferPtr pattern;
|
||||
xmlXPathObjectPtr obj;
|
||||
+ xmlNodePtr oldNode;
|
||||
|
||||
pattern = xmlBufferCreate();
|
||||
if (pattern != NULL) {
|
||||
+ oldNode = context->node;
|
||||
+
|
||||
xmlBufferCCat(pattern, "number(");
|
||||
xmlBufferCat(pattern, value);
|
||||
xmlBufferCCat(pattern, ")");
|
||||
@@ -728,6 +731,8 @@ xsltNumberFormatGetValue(xmlXPathContextPtr context,
|
||||
xmlXPathFreeObject(obj);
|
||||
}
|
||||
xmlBufferFree(pattern);
|
||||
+
|
||||
+ context->node = oldNode;
|
||||
}
|
||||
return amount;
|
||||
}
|
||||
diff --git a/libxslt/templates.c b/libxslt/templates.c
|
||||
index f08b9bda..1c8d96e2 100644
|
||||
--- a/libxslt/templates.c
|
||||
+++ b/libxslt/templates.c
|
||||
@@ -61,6 +61,7 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp,
|
||||
int oldNsNr;
|
||||
xmlNsPtr *oldNamespaces;
|
||||
xmlNodePtr oldInst;
|
||||
+ xmlNodePtr oldNode;
|
||||
int oldProximityPosition, oldContextSize;
|
||||
|
||||
if ((ctxt == NULL) || (ctxt->inst == NULL)) {
|
||||
@@ -69,6 +70,7 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp,
|
||||
return(0);
|
||||
}
|
||||
|
||||
+ oldNode = ctxt->xpathCtxt->node;
|
||||
oldContextSize = ctxt->xpathCtxt->contextSize;
|
||||
oldProximityPosition = ctxt->xpathCtxt->proximityPosition;
|
||||
oldNsNr = ctxt->xpathCtxt->nsNr;
|
||||
@@ -96,8 +98,9 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp,
|
||||
ctxt->state = XSLT_STATE_STOPPED;
|
||||
ret = 0;
|
||||
}
|
||||
- ctxt->xpathCtxt->nsNr = oldNsNr;
|
||||
|
||||
+ ctxt->xpathCtxt->node = oldNode;
|
||||
+ ctxt->xpathCtxt->nsNr = oldNsNr;
|
||||
ctxt->xpathCtxt->namespaces = oldNamespaces;
|
||||
ctxt->inst = oldInst;
|
||||
ctxt->xpathCtxt->contextSize = oldContextSize;
|
||||
@@ -137,7 +140,7 @@ xsltEvalXPathStringNs(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp,
|
||||
}
|
||||
|
||||
oldInst = ctxt->inst;
|
||||
- oldNode = ctxt->node;
|
||||
+ oldNode = ctxt->xpathCtxt->node;
|
||||
oldPos = ctxt->xpathCtxt->proximityPosition;
|
||||
oldSize = ctxt->xpathCtxt->contextSize;
|
||||
oldNsNr = ctxt->xpathCtxt->nsNr;
|
||||
@@ -167,7 +170,7 @@ xsltEvalXPathStringNs(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp,
|
||||
"xsltEvalXPathString: returns %s\n", ret));
|
||||
#endif
|
||||
ctxt->inst = oldInst;
|
||||
- ctxt->node = oldNode;
|
||||
+ ctxt->xpathCtxt->node = oldNode;
|
||||
ctxt->xpathCtxt->contextSize = oldSize;
|
||||
ctxt->xpathCtxt->proximityPosition = oldPos;
|
||||
ctxt->xpathCtxt->nsNr = oldNsNr;
|
||||
diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c
|
||||
index 3705d28f..9afb4520 100644
|
||||
--- a/libxslt/xsltutils.c
|
||||
+++ b/libxslt/xsltutils.c
|
||||
@@ -1065,8 +1065,8 @@ xsltComputeSortResultInternal(xsltTransformContextPtr ctxt, xmlNodePtr sort,
|
||||
return(NULL);
|
||||
}
|
||||
|
||||
- oldNode = ctxt->node;
|
||||
oldInst = ctxt->inst;
|
||||
+ oldNode = ctxt->xpathCtxt->node;
|
||||
oldPos = ctxt->xpathCtxt->proximityPosition;
|
||||
oldSize = ctxt->xpathCtxt->contextSize;
|
||||
oldNsNr = ctxt->xpathCtxt->nsNr;
|
||||
@@ -1137,8 +1137,8 @@ xsltComputeSortResultInternal(xsltTransformContextPtr ctxt, xmlNodePtr sort,
|
||||
results[i] = NULL;
|
||||
}
|
||||
}
|
||||
- ctxt->node = oldNode;
|
||||
ctxt->inst = oldInst;
|
||||
+ ctxt->xpathCtxt->node = oldNode;
|
||||
ctxt->xpathCtxt->contextSize = oldSize;
|
||||
ctxt->xpathCtxt->proximityPosition = oldPos;
|
||||
ctxt->xpathCtxt->nsNr = oldNsNr;
|
||||
--
|
||||
2.49.0
|
||||
|
||||
@ -23,6 +23,8 @@ Patch0: multilib.patch
|
||||
Patch1: multilib2.patch
|
||||
# https://issues.redhat.com/browse/RHEL-83503
|
||||
Patch2: libxslt-1.1.39-CVE-2024-55549.patch
|
||||
# https://issues.redhat.com/browse/RHEL-83489
|
||||
Patch3: libxslt-1.1.39-CVE-2025-24855.patch
|
||||
|
||||
%description
|
||||
This C library allows to transform XML files into other XML files
|
||||
@ -138,6 +140,7 @@ rm -vrf %{buildroot}%{_docdir}
|
||||
%changelog
|
||||
* Fri Apr 04 2025 David King <dking@redhat.com> - 1.1.39-7
|
||||
- Fix CVE-2024-55549 (RHEL-83503)
|
||||
- Fix CVE-2025-24855 (RHEL-83489)
|
||||
|
||||
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.1.39-6
|
||||
- Bump release for October 2024 mass rebuild:
|
||||
|
||||
Loading…
Reference in New Issue
Block a user