From 36ce67f6dcbbc1ac6fca872b99dab9675813c10d Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Wed, 11 Nov 2020 13:33:18 +0000
Subject: [PATCH] Add correct fix for CVE-2020-24977 (RHBZ#1877788), thanks:
 Jan de Groot.

---
 libxml2-2.9.10-CVE-2020-24977.patch       | 61 +++++++++++------------
 libxml2-2.9.10-fix-integer-overflow.patch | 41 +++++++++++++++
 libxml2.spec                              |  8 ++-
 3 files changed, 75 insertions(+), 35 deletions(-)
 create mode 100644 libxml2-2.9.10-fix-integer-overflow.patch

diff --git a/libxml2-2.9.10-CVE-2020-24977.patch b/libxml2-2.9.10-CVE-2020-24977.patch
index b5a7bec..67ef0ac 100644
--- a/libxml2-2.9.10-CVE-2020-24977.patch
+++ b/libxml2-2.9.10-CVE-2020-24977.patch
@@ -1,41 +1,36 @@
-From 8e7c20a1af8776677d7890f30b7a180567701a49 Mon Sep 17 00:00:00 2001
+From 50f06b3efb638efb0abd95dc62dca05ae67882c2 Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Mon, 3 Aug 2020 17:30:41 +0200
-Subject: [PATCH] Fix integer overflow when comparing schema dates
+Date: Fri, 7 Aug 2020 21:54:27 +0200
+Subject: [PATCH] Fix out-of-bounds read with 'xmllint --htmlout'
 
-Found by OSS-Fuzz.
+Make sure that truncated UTF-8 sequences don't cause an out-of-bounds
+array access.
+
+Thanks to @SuhwanSong and the Agency for Defense Development (ADD) for
+the report.
+
+Fixes #178.
 ---
- xmlschemastypes.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
+ xmllint.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
 
-diff --git a/xmlschemastypes.c b/xmlschemastypes.c
-index 4249d700..d6b9f924 100644
---- a/xmlschemastypes.c
-+++ b/xmlschemastypes.c
-@@ -3691,6 +3691,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
- 	minday = 0;
- 	maxday = 0;
-     } else {
-+        if (myear > LONG_MAX / 366)
-+            return -2;
-         /* FIXME: This doesn't take leap year exceptions every 100/400 years
-            into account. */
- 	maxday = 365 * myear + (myear + 3) / 4;
-@@ -4079,6 +4081,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
-     if ((x == NULL) || (y == NULL))
-         return -2;
+diff --git a/xmllint.c b/xmllint.c
+index f6a8e463..c647486f 100644
+--- a/xmllint.c
++++ b/xmllint.c
+@@ -528,6 +528,12 @@ static void
+ xmlHTMLEncodeSend(void) {
+     char *result;
  
-+    if ((x->value.date.year > LONG_MAX / 366) ||
-+        (x->value.date.year < LONG_MIN / 366) ||
-+        (y->value.date.year > LONG_MAX / 366) ||
-+        (y->value.date.year < LONG_MIN / 366)) {
-+        /* Possible overflow when converting to days. */
-+        return -2;
-+    }
-+
-     if (x->value.date.tz_flag) {
- 
-         if (!y->value.date.tz_flag) {
++    /*
++     * xmlEncodeEntitiesReentrant assumes valid UTF-8, but the buffer might
++     * end with a truncated UTF-8 sequence. This is a hack to at least avoid
++     * an out-of-bounds read.
++     */
++    memset(&buffer[sizeof(buffer)-4], 0, 4);
+     result = (char *) xmlEncodeEntitiesReentrant(NULL, BAD_CAST buffer);
+     if (result) {
+ 	xmlGenericError(xmlGenericErrorContext, "%s", result);
 -- 
 2.28.0.rc2
 
diff --git a/libxml2-2.9.10-fix-integer-overflow.patch b/libxml2-2.9.10-fix-integer-overflow.patch
new file mode 100644
index 0000000..b5a7bec
--- /dev/null
+++ b/libxml2-2.9.10-fix-integer-overflow.patch
@@ -0,0 +1,41 @@
+From 8e7c20a1af8776677d7890f30b7a180567701a49 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Mon, 3 Aug 2020 17:30:41 +0200
+Subject: [PATCH] Fix integer overflow when comparing schema dates
+
+Found by OSS-Fuzz.
+---
+ xmlschemastypes.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/xmlschemastypes.c b/xmlschemastypes.c
+index 4249d700..d6b9f924 100644
+--- a/xmlschemastypes.c
++++ b/xmlschemastypes.c
+@@ -3691,6 +3691,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
+ 	minday = 0;
+ 	maxday = 0;
+     } else {
++        if (myear > LONG_MAX / 366)
++            return -2;
+         /* FIXME: This doesn't take leap year exceptions every 100/400 years
+            into account. */
+ 	maxday = 365 * myear + (myear + 3) / 4;
+@@ -4079,6 +4081,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
+     if ((x == NULL) || (y == NULL))
+         return -2;
+ 
++    if ((x->value.date.year > LONG_MAX / 366) ||
++        (x->value.date.year < LONG_MIN / 366) ||
++        (y->value.date.year > LONG_MAX / 366) ||
++        (y->value.date.year < LONG_MIN / 366)) {
++        /* Possible overflow when converting to days. */
++        return -2;
++    }
++
+     if (x->value.date.tz_flag) {
+ 
+         if (!y->value.date.tz_flag) {
+-- 
+2.28.0.rc2
+
diff --git a/libxml2.spec b/libxml2.spec
index d893cf5..c08c7b3 100644
--- a/libxml2.spec
+++ b/libxml2.spec
@@ -1,6 +1,6 @@
 Name:           libxml2
 Version:        2.9.10
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        Library providing XML and HTML support
 
 License:        MIT
@@ -17,8 +17,9 @@ Patch3:         libxml2-2.9.10-CVE-2019-20388.patch
 Patch4:         libxml2-2.9.10-CVE-2020-7595.patch
 # https://gitlab.gnome.org/GNOME/libxml2/merge_requests/71
 Patch5:         libxml2-2.9.10-parenthesize-type-checks.patch
+Patch6:         libxml2-2.9.10-fix-integer-overflow.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1877788
-Patch6:         libxml2-2.9.10-CVE-2020-24977.patch
+Patch7:         libxml2-2.9.10-CVE-2020-24977.patch
 
 BuildRequires:  gcc
 BuildRequires:  make
@@ -147,6 +148,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
 %{python3_sitearch}/libxml2mod.so
 
 %changelog
+* Wed Nov 11 2020 Richard W.M. Jones <rjones@redhat.com> - 2.9.10-8
+- Add correct fix for CVE-2020-24977 (RHBZ#1877788), thanks: Jan de Groot.
+
 * Fri Sep 11 2020 Richard W.M. Jones <rjones@redhat.com> - 2.9.10-7
 - Add fix for CVE-2020-24977 (RHBZ#1877788).