From e510538dd3af2542c499c360a2eeee7a83f548c5 Mon Sep 17 00:00:00 2001
From: David King <dking@redhat.com>
Date: Thu, 13 May 2021 15:00:32 +0100
Subject: [PATCH] Fix CVE-2021-3516 (#1956969)

Resolves: #1956969
Resolves: CVE-2021-3516
---
 libxml2-2.9.10-CVE-2021-3516.patch | 31 ++++++++++++++++++++++++++++++
 libxml2.spec                       |  7 ++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 libxml2-2.9.10-CVE-2021-3516.patch

diff --git a/libxml2-2.9.10-CVE-2021-3516.patch b/libxml2-2.9.10-CVE-2021-3516.patch
new file mode 100644
index 0000000..10093b6
--- /dev/null
+++ b/libxml2-2.9.10-CVE-2021-3516.patch
@@ -0,0 +1,31 @@
+From 1358d157d0bd83be1dfe356a69213df9fac0b539 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Wed, 21 Apr 2021 13:23:27 +0200
+Subject: [PATCH] Fix use-after-free with `xmllint --html --push`
+
+Call htmlCtxtUseOptions to make sure that names aren't stored in
+dictionaries.
+
+Note that this issue only affects xmllint using the HTML push parser.
+
+Fixes #230.
+---
+ xmllint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xmllint.c b/xmllint.c
+index 6ca1bf54..dbef273a 100644
+--- a/xmllint.c
++++ b/xmllint.c
+@@ -2213,7 +2213,7 @@ static void parseAndPrintFile(char *filename, xmlParserCtxtPtr rectxt) {
+             if (res > 0) {
+                 ctxt = htmlCreatePushParserCtxt(NULL, NULL,
+                             chars, res, filename, XML_CHAR_ENCODING_NONE);
+-                xmlCtxtUseOptions(ctxt, options);
++                htmlCtxtUseOptions(ctxt, options);
+                 while ((res = fread(chars, 1, pushsize, f)) > 0) {
+                     htmlParseChunk(ctxt, chars, res, 0);
+                 }
+-- 
+GitLab
+
diff --git a/libxml2.spec b/libxml2.spec
index 36066a0..0c5120f 100644
--- a/libxml2.spec
+++ b/libxml2.spec
@@ -1,6 +1,6 @@
 Name:           libxml2
 Version:        2.9.10
-Release:        11%{?dist}
+Release:        12%{?dist}
 Summary:        Library providing XML and HTML support
 
 License:        MIT
@@ -22,6 +22,8 @@ Patch6:         libxml2-2.9.10-fix-integer-overflow.patch
 Patch7:         libxml2-2.9.10-CVE-2020-24977.patch
 # https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/87
 Patch8:         python-py_ssize_t.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1956969
+Patch9:         libxml2-2.9.10-CVE-2021-3516.patch
 
 BuildRequires:  gcc
 BuildRequires:  make
@@ -153,6 +155,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
 %{python3_sitearch}/libxml2mod.so
 
 %changelog
+* Thu May 13 2021 David King <dking@redhat.com> - 2.9.10-12
+- Fix CVE-2021-3516 (#1956969)
+
 * Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.9.10-11
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937