rpms/libxml2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix a double free in XPath CVE-2010-4494 bug 665965

Browse Source
This commit is contained in:
Daniel Veillard 2011-03-04 21:42:23 +08:00
parent 920599c212
commit c09ec571fd
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libxml2-2.7.7-xpath-double-free.patch Normal file
View File

@ -0,0 +1,22 @@
--- a/xpath.c
+++ a/xpath.c
@@ -11763,11 +11763,16 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt,
if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
xmlXPathObjectPtr tmp;
- /* pop the result */
+ /* pop the result if any */
tmp = valuePop(ctxt);
- xmlXPathReleaseObject(xpctxt, tmp);
- /* then pop off contextObj, which will be freed later */
- valuePop(ctxt);
+ if (tmp != contextObj) {
+ /*
+ * Free up the result
+ * then pop off contextObj, which will be freed later
+ */
+ xmlXPathReleaseObject(xpctxt, tmp);
+ valuePop(ctxt);
+ }
goto evaluation_error;
}

7
libxml2.spec
View File

@ -1,7 +1,7 @@
Summary: Library providing XML and HTML support Summary: Library providing XML and HTML support
Name: libxml2 Name: libxml2
Version: 2.7.8 Version: 2.7.8
Release: 5%{?dist}%{?extra_release} Release: 6%{?dist}%{?extra_release}
License: MIT License: MIT
Group: Development/Libraries Group: Development/Libraries
Source: ftp://xmlsoft.org/libxml2/libxml2-%{version}.tar.gz Source: ftp://xmlsoft.org/libxml2/libxml2-%{version}.tar.gz
@ -10,6 +10,7 @@ BuildRequires: python python-devel zlib-devel pkgconfig
URL: http://xmlsoft.org/ URL: http://xmlsoft.org/
Patch0: libxml2-multilib.patch Patch0: libxml2-multilib.patch
Patch1: libxml2-2.7.8-reactivate-versionning-script.patch Patch1: libxml2-2.7.8-reactivate-versionning-script.patch
Patch2: libxml2-2.7.7-xpath-double-free.patch
%description %description
This library allows to manipulate XML files. It includes support This library allows to manipulate XML files. It includes support
@ -69,6 +70,7 @@ at parse time or later once the document has been modified.
%setup -q %setup -q
%patch0 -p1 %patch0 -p1
%patch1 -p1 %patch1 -p1
%patch2 -p1
%build %build
%configure %configure
@ -143,6 +145,9 @@ rm -fr %{buildroot}
%doc doc/python.html %doc doc/python.html
%changelog %changelog
* Fri Mar 4 2011 Daniel Veillard <veillard@redhat.com> - 2.7.8-6
- fix a double free in XPath CVE-2010-4494 bug 665965
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.7.8-5 * Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.7.8-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild