import CS git libxslt-1.1.32-6.4.el8_10

SOURCES/libxslt-1.1.32-CVE-2023-40403.patch

@@ -1,4 +1,4 @@
-From e494220e4a57e87e8561e6798f57f4dcf91762b3 Mon Sep 17 00:00:00 2001
+From 72b05dd35f10467b9c58a7eb1b548cef94453f3b Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Wed, 31 Aug 2022 15:29:57 +0200
 Subject: [PATCH 1/5] Infrastructure to store extra data in source nodes
@@ -13,8 +13,8 @@ Revert any changes to the source document after the transformation.
  libxslt/transform.c     |  34 ++++++++++
  libxslt/xsltInternals.h |   3 +
  libxslt/xsltutils.c     | 135 ++++++++++++++++++++++++++++++++++++++++
- libxslt/xsltutils.h     |  15 ++++-
+ libxslt/xsltutils.h     |  13 ++++
- 4 files changed, 186 insertions(+), 1 deletion(-)
+ 4 files changed, 185 insertions(+)
 
 diff --git a/libxslt/transform.c b/libxslt/transform.c
 index f748f2df..8634b09e 100644
@@ -229,7 +229,7 @@ index 2154b238..a0d9d331 100644
   *									*
   *		Generating profiling informations			*
 diff --git a/libxslt/xsltutils.h b/libxslt/xsltutils.h
-index 789865a6..df89aeb1 100644
+index 789865a6..0ba068d9 100644
 --- a/libxslt/xsltutils.h
 +++ b/libxslt/xsltutils.h
 @@ -247,6 +247,19 @@ XSLTPUBFUN xmlXPathCompExprPtr XSLTCALL
@@ -252,27 +252,11 @@ index 789865a6..df89aeb1 100644
  /*
   * Profiling.
   */
-@@ -267,6 +280,7 @@ XSLTPUBFUN void XSLTCALL
-  * Sampling precision for profiling
-  */
- #define XSLT_TIMESTAMP_TICS_PER_SEC 100000l
-+#endif
- 
- /*
-  * Hooks for the debugger.
-@@ -306,7 +320,6 @@ XSLTPUBFUN void XSLTCALL
- 
- #ifdef __cplusplus
- }
--#endif
- 
- #endif /* __XML_XSLTUTILS_H__ */
- 
 -- 
 2.49.0
 
 
-From 5895aaae58025fa35a540f6f922f9137505f1e27 Mon Sep 17 00:00:00 2001
+From c563ed48d08db0322b8be09896c49ce233212a9e Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Wed, 31 Aug 2022 15:34:47 +0200
 Subject: [PATCH 2/5] Store key status of source nodes as bit flag
@@ -403,7 +387,7 @@ index c094e974..11d8c3e5 100644
  	}
  	if (ret != NULL)
 diff --git a/libxslt/xsltutils.h b/libxslt/xsltutils.h
-index df89aeb1..80194891 100644
+index 0ba068d9..4285814a 100644
 --- a/libxslt/xsltutils.h
 +++ b/libxslt/xsltutils.h
 @@ -249,6 +249,7 @@ XSLTPUBFUN xmlXPathCompExprPtr XSLTCALL
@@ -418,7 +402,7 @@ index df89aeb1..80194891 100644
 2.49.0
 
 
-From 5bdb3e5c9a0a4bc42dd14fe07cf594298a79edce Mon Sep 17 00:00:00 2001
+From cee66d9c12805c0fda674118365c4d5130c598c7 Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Wed, 31 Aug 2022 15:35:37 +0200
 Subject: [PATCH 3/5] Store RVT ownership in 'compression' member
@@ -658,7 +642,7 @@ index 39b488c0..e7a058cc 100644
 2.49.0
 
 
-From 957e111edb935259e777c15e809b1d4de8ee2f3f Mon Sep 17 00:00:00 2001
+From c28cfebd3503133a17345fef6a0b24084cca78a0 Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Wed, 31 Aug 2022 13:35:23 +0200
 Subject: [PATCH 4/5] Make generate-id() deterministic
@@ -857,7 +841,7 @@ index e7a058cc..ae9b76af 100644
  
  /**
 diff --git a/libxslt/xsltutils.h b/libxslt/xsltutils.h
-index 80194891..bae9ad75 100644
+index 4285814a..9709b63e 100644
 --- a/libxslt/xsltutils.h
 +++ b/libxslt/xsltutils.h
 @@ -250,6 +250,7 @@ XSLTPUBFUN xmlXPathCompExprPtr XSLTCALL
@@ -1006,7 +990,7 @@ index 00000000..8478f6af
 2.49.0
 
 
-From 7eff64281f0bcd4c6a452dc04f3250037d28786e Mon Sep 17 00:00:00 2001
+From 9177859200d47e52571dfeaaf13c0674ca70cc85 Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Wed, 31 Aug 2022 21:37:44 +0200
 Subject: [PATCH 5/5] Clean up attributes in source doc
@@ -1040,7 +1024,7 @@ index a631529c..8a424773 100644
              cur = cur->children;
          } else {
 diff --git a/libxslt/xsltutils.h b/libxslt/xsltutils.h
-index bae9ad75..98ca83a1 100644
+index 9709b63e..e60de8ec 100644
 --- a/libxslt/xsltutils.h
 +++ b/libxslt/xsltutils.h
 @@ -248,9 +248,9 @@ XSLTPUBFUN xmlXPathCompExprPtr XSLTCALL

SOURCES/libxslt-1.1.32-CVE-2025-10911.patch

@@ -0,0 +1,718 @@
+From 5a50e73fa2e48e5ccdb8f36ebaeeaf8404e33879 Mon Sep 17 00:00:00 2001
+From: Daniel Cheng <zetafunction@gmail.com>
+Date: Thu, 5 Jun 2025 09:43:53 -0700
+Subject: [PATCH] Use a dedicated node type to maintain the list of cached RVTs
+
+While evaluating a stylesheet, result value trees (result tree fragments
+in the XSLT spec) are represented as xmlDocs and cached on the transform
+context in a linked list, using xmlDoc's prev and next pointers to
+maintain the list.
+
+However, XPath evaluations can inadvertently traverse these links, which
+are an implementation detail and do not reflect the actual document
+structure. Using a dedicated node type avoids these unintended
+traversals.
+
+Fixes #144.
+---
+ libxslt/transform.c     |  93 ++++++++---------
+ libxslt/variables.c     | 224 +++++++++++++++++++++++++---------------
+ libxslt/xsltInternals.h |  23 +++--
+ 3 files changed, 201 insertions(+), 139 deletions(-)
+
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 8a424773..b500b35d 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -521,19 +521,20 @@ xsltTransformCacheFree(xsltTransformCachePtr cache)
+     /*
+     * Free tree fragments.
+     */
+-    if (cache->RVT) {
+-	xmlDocPtr tmp, cur = cache->RVT;
++    if (cache->rvtList) {
++	xsltRVTListPtr tmp, cur = cache->rvtList;
+ 	while (cur) {
+ 	    tmp = cur;
+-	    cur = (xmlDocPtr) cur->next;
+-	    if (tmp->_private != NULL) {
++	    cur = cur->next;
++	    if (tmp->RVT->_private != NULL) {
+ 		/*
+-		* Tree the document info.
++		* Free the document info.
+ 		*/
+-		xsltFreeDocumentKeys((xsltDocumentPtr) tmp->_private);
+-		xmlFree(tmp->_private);
++		xsltFreeDocumentKeys((xsltDocumentPtr) tmp->RVT->_private);
++		xmlFree(tmp->RVT->_private);
+ 	    }
+-	    xmlFreeDoc(tmp);
++            xmlFreeDoc(tmp->RVT);
++            xmlFree(tmp);
+ 	}
+     }
+     /*
+@@ -2294,43 +2295,39 @@ xsltLocalVariablePush(xsltTransformContextPtr ctxt,
+  * are preserved; all other fragments are freed/cached.
+  */
+ static void
+-xsltReleaseLocalRVTs(xsltTransformContextPtr ctxt, xmlDocPtr base)
++xsltReleaseLocalRVTs(xsltTransformContextPtr ctxt, xsltRVTListPtr base)
+ {
+-    xmlDocPtr cur = ctxt->localRVT, tmp;
+-    xmlDocPtr prev = NULL;
++    xsltRVTListPtr cur = ctxt->localRVTList, tmp;
+ 
+     if (cur == base)
+         return;
+-    if (cur->prev != NULL)
+-        xsltTransformError(ctxt, NULL, NULL, "localRVT not head of list\n");
++
++    /* Reset localRVTList early because some RVTs might be registered again. */
++    ctxt->localRVTList = base;
++
+ 
+     do {
+         tmp = cur;
+-        cur = (xmlDocPtr) cur->next;
+-        if (tmp->compression == XSLT_RVT_LOCAL) {
+-            xsltReleaseRVT(ctxt, tmp);
+-        } else if (tmp->compression == XSLT_RVT_GLOBAL) {
+-            xsltRegisterPersistRVT(ctxt, tmp);
+-        } else if (tmp->compression == XSLT_RVT_FUNC_RESULT) {
++        cur = cur->next;
++        if (tmp->RVT->compression == XSLT_RVT_LOCAL) {
++            xsltReleaseRVTList(ctxt, tmp);
++        } else if (tmp->RVT->compression == XSLT_RVT_GLOBAL) {
++            xsltRegisterPersistRVT(ctxt, tmp->RVT);
++            xmlFree(tmp);
++        } else if (tmp->RVT->compression == XSLT_RVT_FUNC_RESULT) {
+             /*
+              * This will either register the RVT again or move it to the
+              * context variable.
+              */
+-            xsltRegisterLocalRVT(ctxt, tmp);
+-            tmp->compression = XSLT_RVT_FUNC_RESULT;
++            xsltRegisterLocalRVT(ctxt, tmp->RVT);
++            tmp->RVT->compression = XSLT_RVT_FUNC_RESULT;
++            xmlFree(tmp);
+         } else {
+             xmlGenericError(xmlGenericErrorContext,
+-                    "xsltReleaseLocalRVTs: Unexpected RVT flag %p\n",
+-                    tmp->compression);
++                    "xsltReleaseLocalRVTs: Unexpected RVT flag %d\n",
++                    tmp->RVT->compression);
+         }
+     } while (cur != base);
+-
+-    if (prev == NULL)
+-        ctxt->localRVT = base;
+-    else
+-        prev->next = (xmlNodePtr) base;
+-    if (base != NULL)
+-        base->prev = (xmlNodePtr) prev;
+ }
+ 
+ /**
+@@ -2356,7 +2353,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
+     xmlNodePtr oldInsert, oldInst, oldCurInst, oldContextNode;
+     xmlNodePtr cur, insert, copy = NULL;
+     int level = 0, oldVarsNr;
+-    xmlDocPtr oldLocalFragmentTop;
++    xsltRVTListPtr oldLocalFragmentTop;
+ 
+ #ifdef XSLT_REFACTORED
+     xsltStylePreCompPtr info;
+@@ -2402,7 +2399,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
+     }
+     ctxt->depth++;
+ 
+-    oldLocalFragmentTop = ctxt->localRVT;
++    oldLocalFragmentTop = ctxt->localRVTList;
+     oldInsert = insert = ctxt->insert;
+     oldInst = oldCurInst = ctxt->inst;
+     oldContextNode = ctxt->node;
+@@ -2625,7 +2622,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
+ 		    /*
+ 		    * Cleanup temporary tree fragments.
+ 		    */
+-		    if (oldLocalFragmentTop != ctxt->localRVT)
++		    if (oldLocalFragmentTop != ctxt->localRVTList)
+ 			xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+ 		    ctxt->insert = oldInsert;
+@@ -2720,7 +2717,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
+ 		    /*
+ 		    * Cleanup temporary tree fragments.
+ 		    */
+-		    if (oldLocalFragmentTop != ctxt->localRVT)
++		    if (oldLocalFragmentTop != ctxt->localRVTList)
+ 			xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+ 		    ctxt->insert = oldInsert;
+@@ -2786,7 +2783,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
+ 		/*
+ 		* Cleanup temporary tree fragments.
+ 		*/
+-		if (oldLocalFragmentTop != ctxt->localRVT)
++		if (oldLocalFragmentTop != ctxt->localRVTList)
+ 		    xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+                 ctxt->insert = oldInsert;
+@@ -2914,7 +2911,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr ctxt,
+ 		/*
+ 		* Cleanup temporary tree fragments.
+ 		*/
+-		if (oldLocalFragmentTop != ctxt->localRVT)
++		if (oldLocalFragmentTop != ctxt->localRVTList)
+ 		    xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+                 ctxt->insert = oldInsert;
+@@ -3094,7 +3091,7 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
+     long start = 0;
+     xmlNodePtr cur;
+     xsltStackElemPtr tmpParam = NULL;
+-    xmlDocPtr oldUserFragmentTop;
++    xsltRVTListPtr oldUserFragmentTop;
+ 
+ #ifdef XSLT_REFACTORED
+     xsltStyleItemParamPtr iparam;
+@@ -3139,8 +3136,8 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
+         return;
+ 	}
+ 
+-    oldUserFragmentTop = ctxt->tmpRVT;
+-    ctxt->tmpRVT = NULL;
++    oldUserFragmentTop = ctxt->tmpRVTList;
++    ctxt->tmpRVTList = NULL;
+ 
+     /*
+     * Initiate a distinct scope of local params/variables.
+@@ -3247,16 +3244,16 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
+     * user code should now use xsltRegisterLocalRVT() instead
+     * of the obsolete xsltRegisterTmpRVT().
+     */
+-    if (ctxt->tmpRVT) {
+-	xmlDocPtr curdoc = ctxt->tmpRVT, tmp;
++    if (ctxt->tmpRVTList) {
++	xsltRVTListPtr curRVTList = ctxt->tmpRVTList, tmp;
+ 
+-	while (curdoc != NULL) {
+-	    tmp = curdoc;
+-	    curdoc = (xmlDocPtr) curdoc->next;
+-	    xsltReleaseRVT(ctxt, tmp);
++	while (curRVTList != NULL) {
++	    tmp = curRVTList;
++	    curRVTList = curRVTList->next;
++	    xsltReleaseRVTList(ctxt, tmp);
+ 	}
+     }
+-    ctxt->tmpRVT = oldUserFragmentTop;
++    ctxt->tmpRVTList = oldUserFragmentTop;
+ 
+     /*
+     * Pop the xsl:template declaration from the stack.
+@@ -5392,7 +5389,7 @@ xsltIf(xsltTransformContextPtr ctxt, xmlNodePtr contextNode,
+ 
+ #ifdef XSLT_FAST_IF
+     {
+-	xmlDocPtr oldLocalFragmentTop = ctxt->localRVT;
++	xsltRVTListPtr oldLocalFragmentTop = ctxt->localRVTList;
+ 
+ 	res = xsltPreCompEvalToBoolean(ctxt, contextNode, comp);
+ 
+@@ -5400,7 +5397,7 @@ xsltIf(xsltTransformContextPtr ctxt, xmlNodePtr contextNode,
+ 	* Cleanup fragments created during evaluation of the
+ 	* "select" expression.
+ 	*/
+-	if (oldLocalFragmentTop != ctxt->localRVT)
++	if (oldLocalFragmentTop != ctxt->localRVTList)
+ 	    xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+     }
+ 
+diff --git a/libxslt/variables.c b/libxslt/variables.c
+index 0f4b72f3..e1d9938c 100644
+--- a/libxslt/variables.c
++++ b/libxslt/variables.c
+@@ -47,6 +47,21 @@ static const xmlChar *xsltComputingGlobalVarMarker =
+ #define XSLT_VAR_IN_SELECT (1<<1)
+ #define XSLT_TCTXT_VARIABLE(c) ((xsltStackElemPtr) (c)->contextVariable)
+ 
++static xsltRVTListPtr
++xsltRVTListCreate(void)
++{
++    xsltRVTListPtr ret;
++
++    ret = (xsltRVTListPtr) xmlMalloc(sizeof(xsltRVTList));
++    if (ret == NULL) {
++	xsltTransformError(NULL, NULL, NULL,
++	    "xsltRVTListCreate: malloc failed\n");
++	return(NULL);
++    }
++    memset(ret, 0, sizeof(xsltRVTList));
++    return(ret);
++}
++
+ /************************************************************************
+  *									*
+  *  Result Value Tree (Result Tree Fragment) interfaces			*
+@@ -64,6 +79,7 @@ static const xmlChar *xsltComputingGlobalVarMarker =
+ xmlDocPtr
+ xsltCreateRVT(xsltTransformContextPtr ctxt)
+ {
++    xsltRVTListPtr rvtList;
+     xmlDocPtr container;
+ 
+     /*
+@@ -76,12 +92,11 @@ xsltCreateRVT(xsltTransformContextPtr ctxt)
+     /*
+     * Reuse a RTF from the cache if available.
+     */
+-    if (ctxt->cache->RVT) {
+-	container = ctxt->cache->RVT;
+-	ctxt->cache->RVT = (xmlDocPtr) container->next;
+-	/* clear the internal pointers */
+-	container->next = NULL;
+-	container->prev = NULL;
++    if (ctxt->cache->rvtList) {
++        rvtList = ctxt->cache->rvtList;
++	container = ctxt->cache->rvtList->RVT;
++	ctxt->cache->rvtList = rvtList->next;
++        xmlFree(rvtList);
+ 	if (ctxt->cache->nbRVT > 0)
+ 	    ctxt->cache->nbRVT--;
+ #ifdef XSLT_DEBUG_PROFILE_CACHE
+@@ -119,11 +134,16 @@ xsltCreateRVT(xsltTransformContextPtr ctxt)
+ int
+ xsltRegisterTmpRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+ {
++    xsltRVTListPtr list;
++
+     if ((ctxt == NULL) || (RVT == NULL))
+ 	return(-1);
+ 
+-    RVT->prev = NULL;
++    list = xsltRVTListCreate();
++    if (list == NULL) return(-1);
++
+     RVT->compression = XSLT_RVT_LOCAL;
++    list->RVT = RVT;
+ 
+     /*
+     * We'll restrict the lifetime of user-created fragments
+@@ -131,15 +151,13 @@ xsltRegisterTmpRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+     * var/param itself.
+     */
+     if (ctxt->contextVariable != NULL) {
+-	RVT->next = (xmlNodePtr) XSLT_TCTXT_VARIABLE(ctxt)->fragment;
+-	XSLT_TCTXT_VARIABLE(ctxt)->fragment = RVT;
++	list->next = XSLT_TCTXT_VARIABLE(ctxt)->fragment;
++	XSLT_TCTXT_VARIABLE(ctxt)->fragment = list;
+ 	return(0);
+     }
+ 
+-    RVT->next = (xmlNodePtr) ctxt->tmpRVT;
+-    if (ctxt->tmpRVT != NULL)
+-	ctxt->tmpRVT->prev = (xmlNodePtr) RVT;
+-    ctxt->tmpRVT = RVT;
++    list->next = ctxt->tmpRVTList;
++    ctxt->tmpRVTList = list;
+     return(0);
+ }
+ 
+@@ -159,11 +177,16 @@ int
+ xsltRegisterLocalRVT(xsltTransformContextPtr ctxt,
+ 		     xmlDocPtr RVT)
+ {
++    xsltRVTListPtr list;
++
+     if ((ctxt == NULL) || (RVT == NULL))
+ 	return(-1);
+ 
+-    RVT->prev = NULL;
++    list = xsltRVTListCreate();
++    if (list == NULL) return(-1);
++
+     RVT->compression = XSLT_RVT_LOCAL;
++    list->RVT = RVT;
+ 
+     /*
+     * When evaluating "select" expressions of xsl:variable
+@@ -174,8 +197,8 @@ xsltRegisterLocalRVT(xsltTransformContextPtr ctxt,
+     if ((ctxt->contextVariable != NULL) &&
+ 	(XSLT_TCTXT_VARIABLE(ctxt)->flags & XSLT_VAR_IN_SELECT))
+     {
+-	RVT->next = (xmlNodePtr) XSLT_TCTXT_VARIABLE(ctxt)->fragment;
+-	XSLT_TCTXT_VARIABLE(ctxt)->fragment = RVT;
++	list->next = XSLT_TCTXT_VARIABLE(ctxt)->fragment;
++	XSLT_TCTXT_VARIABLE(ctxt)->fragment = list;
+ 	return(0);
+     }
+     /*
+@@ -183,10 +206,8 @@ xsltRegisterLocalRVT(xsltTransformContextPtr ctxt,
+     * If not reference by a returning instruction (like EXSLT's function),
+     * then this fragment will be freed, when the instruction exits.
+     */
+-    RVT->next = (xmlNodePtr) ctxt->localRVT;
+-    if (ctxt->localRVT != NULL)
+-	ctxt->localRVT->prev = (xmlNodePtr) RVT;
+-    ctxt->localRVT = RVT;
++    list->next = ctxt->localRVTList;
++    ctxt->localRVTList = list;
+     return(0);
+ }
+ 
+@@ -340,8 +361,9 @@ xsltFlagRVTs(xsltTransformContextPtr ctxt, xmlXPathObjectPtr obj, int val) {
+  * @ctxt:  an XSLT transformation context
+  * @RVT:  a result value tree (Result Tree Fragment)
+  *
+- * Either frees the RVT (which is an xmlDoc) or stores
+- * it in the context's cache for later reuse.
++ * Either frees the RVT (which is an xmlDoc) or stores it in the context's
++ * cache for later reuse. Preserved for ABI/API compatibility; internal use
++ * has all migrated to xsltReleaseRVTList().
+  */
+ void
+ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+@@ -349,41 +371,64 @@ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+     if (RVT == NULL)
+ 	return;
+ 
++    xsltRVTListPtr list = xsltRVTListCreate();
++    if (list == NULL) {
++        if (RVT->_private != NULL) {
++            xsltFreeDocumentKeys((xsltDocumentPtr) RVT->_private);
++            xmlFree(RVT->_private);
++        }
++        xmlFreeDoc(RVT);
++        return;
++    }
++
++    xsltReleaseRVTList(ctxt, list);
++}
++
++/**
++ * xsltReleaseRVTList:
++ * @ctxt:  an XSLT transformation context
++ * @list:  a list node containing a result value tree (Result Tree Fragment)
++ *
++ * Either frees the list node or stores it in the context's cache for later
++ * reuse. Optimization to avoid adding a fallible allocation path when the
++ * caller already has a RVT list node.
++ */
++void
++xsltReleaseRVTList(xsltTransformContextPtr ctxt, xsltRVTListPtr list)
++{
++    if (list == NULL)
++	return;
++
+     if (ctxt && (ctxt->cache->nbRVT < 40)) {
+ 	/*
+ 	* Store the Result Tree Fragment.
+ 	* Free the document info.
+ 	*/
+-	if (RVT->_private != NULL) {
+-	    xsltFreeDocumentKeys((xsltDocumentPtr) RVT->_private);
+-	    xmlFree(RVT->_private);
+-	    RVT->_private = NULL;
++	if (list->RVT->_private != NULL) {
++	    xsltFreeDocumentKeys((xsltDocumentPtr) list->RVT->_private);
++	    xmlFree(list->RVT->_private);
++	    list->RVT->_private = NULL;
+ 	}
+ 	/*
+ 	* Clear the document tree.
+-	* REVISIT TODO: Do we expect ID/IDREF tables to be existent?
+ 	*/
+-	if (RVT->children != NULL) {
+-	    xmlFreeNodeList(RVT->children);
+-	    RVT->children = NULL;
+-	    RVT->last = NULL;
++	if (list->RVT->children != NULL) {
++	    xmlFreeNodeList(list->RVT->children);
++	    list->RVT->children = NULL;
++	    list->RVT->last = NULL;
+ 	}
+-	if (RVT->ids != NULL) {
+-	    xmlFreeIDTable((xmlIDTablePtr) RVT->ids);
+-	    RVT->ids = NULL;
+-	}
+-	if (RVT->refs != NULL) {
+-	    xmlFreeRefTable((xmlRefTablePtr) RVT->refs);
+-	    RVT->refs = NULL;
++	if (list->RVT->ids != NULL) {
++	    xmlFreeIDTable((xmlIDTablePtr) list->RVT->ids);
++	    list->RVT->ids = NULL;
+ 	}
+ 
+ 	/*
+ 	* Reset the ownership information.
+ 	*/
+-	RVT->compression = 0;
++	list->RVT->compression = 0;
+ 
+-	RVT->next = (xmlNodePtr) ctxt->cache->RVT;
+-	ctxt->cache->RVT = RVT;
++	list->next = ctxt->cache->rvtList;
++	ctxt->cache->rvtList = list;
+ 
+ 	ctxt->cache->nbRVT++;
+ 
+@@ -395,11 +440,12 @@ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+     /*
+     * Free it.
+     */
+-    if (RVT->_private != NULL) {
+-	xsltFreeDocumentKeys((xsltDocumentPtr) RVT->_private);
+-	xmlFree(RVT->_private);
++    if (list->RVT->_private != NULL) {
++	xsltFreeDocumentKeys((xsltDocumentPtr) list->RVT->_private);
++	xmlFree(list->RVT->_private);
+     }
+-    xmlFreeDoc(RVT);
++    xmlFreeDoc(list->RVT);
++    xmlFree(list);
+ }
+ 
+ /**
+@@ -417,14 +463,17 @@ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+ int
+ xsltRegisterPersistRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+ {
++    xsltRVTListPtr list;
++
+     if ((ctxt == NULL) || (RVT == NULL)) return(-1);
+ 
++    list = xsltRVTListCreate();
++    if (list == NULL) return(-1);
++
+     RVT->compression = XSLT_RVT_GLOBAL;
+-    RVT->prev = NULL;
+-    RVT->next = (xmlNodePtr) ctxt->persistRVT;
+-    if (ctxt->persistRVT != NULL)
+-	ctxt->persistRVT->prev = (xmlNodePtr) RVT;
+-    ctxt->persistRVT = RVT;
++    list->RVT = RVT;
++    list->next = ctxt->persistRVTList;
++    ctxt->persistRVTList = list;
+     return(0);
+ }
+ 
+@@ -439,52 +488,55 @@ xsltRegisterPersistRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+ void
+ xsltFreeRVTs(xsltTransformContextPtr ctxt)
+ {
+-    xmlDocPtr cur, next;
++    xsltRVTListPtr cur, next;
+ 
+     if (ctxt == NULL)
+ 	return;
+     /*
+     * Local fragments.
+     */
+-    cur = ctxt->localRVT;
++    cur = ctxt->localRVTList;
+     while (cur != NULL) {
+-        next = (xmlDocPtr) cur->next;
+-	if (cur->_private != NULL) {
+-	    xsltFreeDocumentKeys(cur->_private);
+-	    xmlFree(cur->_private);
++        next = cur->next;
++	if (cur->RVT->_private != NULL) {
++	    xsltFreeDocumentKeys(cur->RVT->_private);
++	    xmlFree(cur->RVT->_private);
+ 	}
+-	xmlFreeDoc(cur);
++	xmlFreeDoc(cur->RVT);
++        xmlFree(cur);
+ 	cur = next;
+     }
+-    ctxt->localRVT = NULL;
++    ctxt->localRVTList = NULL;
+     /*
+     * User-created per-template fragments.
+     */
+-    cur = ctxt->tmpRVT;
++    cur = ctxt->tmpRVTList;
+     while (cur != NULL) {
+-        next = (xmlDocPtr) cur->next;
+-	if (cur->_private != NULL) {
+-	    xsltFreeDocumentKeys(cur->_private);
+-	    xmlFree(cur->_private);
++        next = cur->next;
++	if (cur->RVT->_private != NULL) {
++	    xsltFreeDocumentKeys(cur->RVT->_private);
++	    xmlFree(cur->RVT->_private);
+ 	}
+-	xmlFreeDoc(cur);
++	xmlFreeDoc(cur->RVT);
++        xmlFree(cur);
+ 	cur = next;
+     }
+-    ctxt->tmpRVT = NULL;
++    ctxt->tmpRVTList = NULL;
+     /*
+     * Global fragments.
+     */
+-    cur = ctxt->persistRVT;
++    cur = ctxt->persistRVTList;
+     while (cur != NULL) {
+-        next = (xmlDocPtr) cur->next;
+-	if (cur->_private != NULL) {
+-	    xsltFreeDocumentKeys(cur->_private);
+-	    xmlFree(cur->_private);
++        next = cur->next;
++	if (cur->RVT->_private != NULL) {
++	    xsltFreeDocumentKeys(cur->RVT->_private);
++	    xmlFree(cur->RVT->_private);
+ 	}
+-	xmlFreeDoc(cur);
++	xmlFreeDoc(cur->RVT);
++        xmlFree(cur);
+ 	cur = next;
+     }
+-    ctxt->persistRVT = NULL;
++    ctxt->persistRVTList = NULL;
+ }
+ 
+ /************************************************************************
+@@ -572,21 +624,22 @@ xsltFreeStackElem(xsltStackElemPtr elem) {
+     * Release the list of temporary Result Tree Fragments.
+     */
+     if (elem->context) {
+-	xmlDocPtr cur;
++	xsltRVTListPtr cur;
+ 
+ 	while (elem->fragment != NULL) {
+ 	    cur = elem->fragment;
+-	    elem->fragment = (xmlDocPtr) cur->next;
+-
+-            if (cur->compression == XSLT_RVT_LOCAL) {
+-		xsltReleaseRVT(elem->context, cur);
+-            } else if (cur->compression == XSLT_RVT_FUNC_RESULT) {
+-                xsltRegisterLocalRVT(elem->context, cur);
+-                cur->compression = XSLT_RVT_FUNC_RESULT;
++	    elem->fragment = cur->next;
++
++            if (cur->RVT->compression == XSLT_RVT_LOCAL) {
++		xsltReleaseRVTList(elem->context, cur);
++            } else if (cur->RVT->compression == XSLT_RVT_FUNC_RESULT) {
++                xsltRegisterLocalRVT(elem->context, cur->RVT);
++                cur->RVT->compression = XSLT_RVT_FUNC_RESULT;
++                xmlFree(cur);
+             } else {
+                 xmlGenericError(xmlGenericErrorContext,
+                         "xsltFreeStackElem: Unexpected RVT flag %d\n",
+-                        cur->compression);
++                        cur->RVT->compression);
+             }
+ 	}
+     }
+@@ -958,6 +1011,7 @@ xsltEvalVariable(xsltTransformContextPtr ctxt, xsltStackElemPtr variable,
+ 	} else {
+ 	    if (variable->tree) {
+ 		xmlDocPtr container;
++                xsltRVTListPtr rvtList;
+ 		xmlNodePtr oldInsert;
+ 		xmlDocPtr  oldOutput;
+ 		xsltStackElemPtr oldVar = ctxt->contextVariable;
+@@ -980,7 +1034,11 @@ xsltEvalVariable(xsltTransformContextPtr ctxt, xsltStackElemPtr variable,
+ 		* when the variable is freed, it will also free
+ 		* the Result Tree Fragment.
+ 		*/
+-		variable->fragment = container;
++                rvtList = xsltRVTListCreate();
++                if (rvtList == NULL)
++                    goto error;
++                rvtList->RVT = container;
++		variable->fragment = rvtList;
+                 container->compression = XSLT_RVT_LOCAL;
+ 
+ 		oldOutput = ctxt->output;
+@@ -2356,5 +2414,3 @@ local_variable_found:
+ 
+     return(valueObj);
+ }
+-
+-
+diff --git a/libxslt/xsltInternals.h b/libxslt/xsltInternals.h
+index ae9b76af..f512ed41 100644
+--- a/libxslt/xsltInternals.h
++++ b/libxslt/xsltInternals.h
+@@ -1421,6 +1421,8 @@ struct _xsltStylePreComp {
+ 
+ #endif /* XSLT_REFACTORED */
+ 
++typedef struct _xsltRVTList xsltRVTList;
++typedef xsltRVTList *xsltRVTListPtr;
+ 
+ /*
+  * The in-memory structure corresponding to an XSLT Variable
+@@ -1438,7 +1440,7 @@ struct _xsltStackElem {
+     xmlNodePtr tree;		/* the sequence constructor if no eval
+ 				    string or the location */
+     xmlXPathObjectPtr value;	/* The value if computed */
+-    xmlDocPtr fragment;		/* The Result Tree Fragments (needed for XSLT 1.0)
++    xsltRVTListPtr fragment;	/* The Result Tree Fragments (needed for XSLT 1.0)
+ 				   which are bound to the variable's lifetime. */
+     int level;                  /* the depth in the tree;
+                                    -1 if persistent (e.g. a given xsl:with-param) */
+@@ -1644,10 +1646,15 @@ struct _xsltStylesheet {
+     xmlHashTablePtr namedTemplates; /* hash table of named templates */
+ };
+ 
++struct _xsltRVTList {
++  xmlDocPtr RVT;
++  xsltRVTListPtr next;
++};
++
+ typedef struct _xsltTransformCache xsltTransformCache;
+ typedef xsltTransformCache *xsltTransformCachePtr;
+ struct _xsltTransformCache {
+-    xmlDocPtr RVT;
++    xsltRVTListPtr rvtList;
+     int nbRVT;
+     xsltStackElemPtr stackItems;
+     int nbStackItems;
+@@ -1747,8 +1754,8 @@ struct _xsltTransformContext {
+      * handling of temporary Result Value Tree
+      * (XSLT 1.0 term: "Result Tree Fragment")
+      */
+-    xmlDocPtr       tmpRVT;		/* list of RVT without persistance */
+-    xmlDocPtr       persistRVT;		/* list of persistant RVTs */
++    xsltRVTListPtr  tmpRVTList;	        /* list of RVT without persistance */
++    xsltRVTListPtr  persistRVTList;     /* list of persistant RVTs */
+     int             ctxtflags;          /* context processing flags */
+ 
+     /*
+@@ -1781,7 +1788,7 @@ struct _xsltTransformContext {
+     xmlDocPtr initialContextDoc;
+     xsltTransformCachePtr cache;
+     void *contextVariable; /* the current variable item */
+-    xmlDocPtr localRVT; /* list of local tree fragments; will be freed when
++    xsltRVTListPtr localRVTList; /* list of local tree fragments; will be freed when
+ 			   the instruction which created the fragment
+                            exits */
+     xmlDocPtr localRVTBase; /* Obsolete */
+@@ -1923,8 +1930,11 @@ XSLTPUBFUN int XSLTCALL
+ XSLTPUBFUN void XSLTCALL
+ 			xsltFreeRVTs		(xsltTransformContextPtr ctxt);
+ XSLTPUBFUN void XSLTCALL
+-			xsltReleaseRVT		(xsltTransformContextPtr ctxt,
++			xsltReleaseRVT          (xsltTransformContextPtr ctxt,
+ 						 xmlDocPtr RVT);
++XSLTPUBFUN void XSLTCALL
++			xsltReleaseRVTList	(xsltTransformContextPtr ctxt,
++						 xsltRVTListPtr list);
+ /*
+  * Extra functions for Attribute Value Templates
+  */
+@@ -1983,4 +1993,3 @@ XSLTPUBFUN int XSLTCALL
+ #endif
+ 
+ #endif /* __XML_XSLT_H__ */
+-
+-- 
+2.54.0
+

SPECS/libxslt.spec

@@ -8,7 +8,7 @@
 Name:           libxslt
 Summary:        Library providing the Gnome XSLT engine
 Version:        1.1.32
-Release:        6.2%{?dist}
+Release:        6.4%{?dist}
 
 License:        MIT
 URL:            http://xmlsoft.org/XSLT
@@ -39,6 +39,8 @@ Patch6:         libxslt-1.1.32-CVE-2024-55549.patch
 Patch7:         libxslt-1.1.32-CVE-2025-24855.patch
 # https://issues.redhat.com/browse/RHEL-89374
 Patch8:         libxslt-1.1.32-CVE-2023-40403.patch
+# https://redhat.atlassian.net/browse/RHEL-171739
+Patch9:         libxslt-1.1.32-CVE-2025-10911.patch
 
 %description
 This C library allows to transform XML files into other XML files
@@ -143,6 +145,12 @@ rm -vrf %{buildroot}%{_docdir}
 %endif # with python2
 
 %changelog
+* Tue May 19 2026 David King <dking@redhat.com> - 1.1.32-6.4
+- Fix CVE-2025-10911 (RHEL-171739)
+
+* Thu Aug 07 2025 David King <dking@redhat.com> - 1.1.32-6.3
+- Fix misplaced endif (RHEL-107912)
+
 * Tue Jun 03 2025 David King <dking@redhat.com> - 1.1.32-6.2
 - Fix CVE-2023-40403 (aka 2022-4909) (RHEL-89374)