From fe82a7d33c83837c0d5769d74a1ccdd872b55ec6 Mon Sep 17 00:00:00 2001
From: David King <dking@redhat.com>
Date: Wed, 26 Feb 2025 08:44:35 +0000
Subject: [PATCH] Fix CVE-2025-24928 (RHEL-80142)

Resolves: RHEL-80142
---
 libxml2-2.9.13-CVE-2025-24928.patch | 57 +++++++++++++++++++++++++++++
 libxml2.spec                        |  7 +++-
 2 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 libxml2-2.9.13-CVE-2025-24928.patch

diff --git a/libxml2-2.9.13-CVE-2025-24928.patch b/libxml2-2.9.13-CVE-2025-24928.patch
new file mode 100644
index 0000000..22e5686
--- /dev/null
+++ b/libxml2-2.9.13-CVE-2025-24928.patch
@@ -0,0 +1,57 @@
+From 858ca26c0689161a6b903a6682cc8a1cc10a0ea8 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 11 Feb 2025 17:30:40 +0100
+Subject: [PATCH] [CVE-2025-24928] Fix stack-buffer-overflow in
+ xmlSnprintfElements
+
+Fixes #847.
+---
+ valid.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/valid.c b/valid.c
+index 76d657d62..abefdc50a 100644
+--- a/valid.c
++++ b/valid.c
+@@ -5057,25 +5057,26 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
+ 	    return;
+ 	}
+         switch (cur->type) {
+-            case XML_ELEMENT_NODE:
++            case XML_ELEMENT_NODE: {
++                int qnameLen = xmlStrlen(cur->name);
++
++                if ((cur->ns != NULL) && (cur->ns->prefix != NULL))
++                    qnameLen += xmlStrlen(cur->ns->prefix) + 1;
++                if (size - len < qnameLen + 10) {
++                    if ((size - len > 4) && (buf[len - 1] != '.'))
++                        strcat(buf, " ...");
++                    return;
++                }
+ 		if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) {
+-		    if (size - len < xmlStrlen(cur->ns->prefix) + 10) {
+-			if ((size - len > 4) && (buf[len - 1] != '.'))
+-			    strcat(buf, " ...");
+-			return;
+-		    }
+ 		    strcat(buf, (char *) cur->ns->prefix);
+ 		    strcat(buf, ":");
+ 		}
+-                if (size - len < xmlStrlen(cur->name) + 10) {
+-		    if ((size - len > 4) && (buf[len - 1] != '.'))
+-			strcat(buf, " ...");
+-		    return;
+-		}
+-	        strcat(buf, (char *) cur->name);
++                if (cur->name != NULL)
++	            strcat(buf, (char *) cur->name);
+ 		if (cur->next != NULL)
+ 		    strcat(buf, " ");
+ 		break;
++            }
+             case XML_TEXT_NODE:
+ 		if (xmlIsBlankNode(cur))
+ 		    break;
+-- 
+GitLab
+
diff --git a/libxml2.spec b/libxml2.spec
index 012bab2..ead81e5 100644
--- a/libxml2.spec
+++ b/libxml2.spec
@@ -1,6 +1,6 @@
 Name:           libxml2
 Version:        2.9.13
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        Library providing XML and HTML support
 
 License:        MIT
@@ -28,6 +28,8 @@ Patch9:         libxml2-2.11.6-CVE-2024-25062.patch
 Patch10:        libxml2-2.9.13-CVE-2022-49043.patch
 # https://issues.redhat.com/browse/RHEL-80127
 Patch11:        libxml2-2.9.13-CVE-2024-56171.patch
+# https://issues.redhat.com/browse/RHEL-80142
+Patch12:        libxml2-2.9.13-CVE-2025-24928.patch
 
 BuildRequires:  cmake-rpm-macros
 BuildRequires:  gcc
@@ -156,6 +158,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
 %{python3_sitearch}/libxml2mod.so
 
 %changelog
+* Wed Feb 26 2025 David King <dking@redhat.com> - 2.9.13-9
+- Fix CVE-2025-24928 (RHEL-80142)
+
 * Tue Feb 25 2025 David King <dking@redhat.com> - 2.9.13-8
 - Fix CVE-2024-56171 (RHEL-80127)