From bcbd29232c44d2e0339161c5b8be8ded5deaa815 Mon Sep 17 00:00:00 2001
From: David King <dking@redhat.com>
Date: Mon, 24 Feb 2025 11:43:05 +0000
Subject: [PATCH] Fix CVE-2024-56171 (RHEL-80119)

Resolves: RHEL-80119
---
 libxml2-2.12.5-CVE-2024-56171.patch | 41 +++++++++++++++++++++++++++++
 libxml2.spec                        |  7 ++++-
 2 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 libxml2-2.12.5-CVE-2024-56171.patch

diff --git a/libxml2-2.12.5-CVE-2024-56171.patch b/libxml2-2.12.5-CVE-2024-56171.patch
new file mode 100644
index 0000000..96a2ab1
--- /dev/null
+++ b/libxml2-2.12.5-CVE-2024-56171.patch
@@ -0,0 +1,41 @@
+From 245b70d7d2768572ae1b05b3668ca858b9ec4ed4 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 10 Dec 2024 16:52:05 +0100
+Subject: [PATCH] [CVE-2024-56171] Fix use-after-free after
+ xmlSchemaItemListAdd
+
+xmlSchemaItemListAdd can reallocate the items array. Update local
+variables after adding item in
+
+- xmlSchemaIDCFillNodeTables
+- xmlSchemaBubbleIDCNodeTables
+
+Fixes #828.
+---
+ xmlschemas.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/xmlschemas.c b/xmlschemas.c
+index d276faf10..28b14bd44 100644
+--- a/xmlschemas.c
++++ b/xmlschemas.c
+@@ -23388,6 +23388,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
+ 			}
+ 			if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1)
+ 			    goto internal_error;
++                        dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items;
+ 			/*
+ 			* Remove the duplicate entry from the IDC node-table.
+ 			*/
+@@ -23604,6 +23605,8 @@ xmlSchemaBubbleIDCNodeTables(xmlSchemaValidCtxtPtr vctxt)
+ 				goto internal_error;
+ 			}
+ 			xmlSchemaItemListAdd(parBind->dupls, parNode);
++		        dupls = (xmlSchemaPSVIIDCNodePtr *)
++                            parBind->dupls->items;
+ 		    } else {
+ 			/*
+ 			* Add the node-table entry (node and key-sequence) of
+-- 
+GitLab
+
diff --git a/libxml2.spec b/libxml2.spec
index 7c05e6c..2e37e89 100644
--- a/libxml2.spec
+++ b/libxml2.spec
@@ -1,6 +1,6 @@
 Name:           libxml2
 Version:        2.12.5
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        Library providing XML and HTML support
 
 # list.c, dict.c and few others use ISC-Veillard
@@ -20,6 +20,8 @@ Patch0:         libxml2-multilib.patch
 Patch1:         libxml2-2.12.0-python3-unicode-errors.patch
 # https://issues.redhat.com/browse/RHEL-72060
 Patch2:         libxml2-2.12.5-CVE-2024-40896.patch
+# https://issues.redhat.com/browse/RHEL-80119
+Patch3:         libxml2-2.12.5-CVE-2024-56171.patch
 
 BuildRequires:  cmake-rpm-macros
 BuildRequires:  gcc
@@ -160,6 +162,9 @@ popd
 %{python3_sitelib}/__pycache__/drv_libxml2.*
 
 %changelog
+* Mon Feb 24 2025 David King <dking@redhat.com> - 2.12.5-5
+- Fix CVE-2024-56171 (RHEL-80119)
+
 * Tue Dec 24 2024 David King <amigadave@amigadave.com> - 2.12.5-4
 - Fix CVE-2024-40896 (RHEL-72060)