.gitignore

@@ -1 +1 @@
-SOURCES/libxml2-2.9.13.tar.xz
+SOURCES/libxml2-2.9.7.tar.gz

.libxml2.metadata

@@ -1 +1 @@
-7dced00d88181d559ee76c6d8ef4571eb1bd0b26 SOURCES/libxml2-2.9.13.tar.xz
+ab3325e6cdda50ab2382fdfe0bdb6f7d1b9224a6 SOURCES/libxml2-2.9.7.tar.gz

SOURCES/libxml2-2.9.0-do-not-check-crc.patch

@@ -0,0 +1,35 @@
+diff -up libxml2-2.9.0/xzlib.c.do-not-check-crc libxml2-2.9.0/xzlib.c
+--- libxml2-2.9.0/xzlib.c.do-not-check-crc	2012-09-11 05:52:46.000000000 +0200
++++ libxml2-2.9.0/xzlib.c	2012-11-19 19:28:42.431700534 +0100
+@@ -552,17 +552,20 @@ xz_decomp(xz_statep state)
+ #ifdef HAVE_ZLIB_H
+         if (state->how == GZIP) {
+             if (gz_next4(state, &crc) == -1 || gz_next4(state, &len) == -1) {
+-                xz_error(state, LZMA_DATA_ERROR, "unexpected end of file");
+-                return -1;
+-            }
+-            if (crc != state->zstrm.adler) {
+-                xz_error(state, LZMA_DATA_ERROR, "incorrect data check");
+-                return -1;
+-            }
+-            if (len != (state->zstrm.total_out & 0xffffffffL)) {
+-                xz_error(state, LZMA_DATA_ERROR, "incorrect length check");
+-                return -1;
+-            }
++                /*
++               xz_error(state, LZMA_DATA_ERROR, "unexpected end of file");
++               return -1;
++                */
++            } else {
++               if (crc != state->zstrm.adler) {
++                   xz_error(state, LZMA_DATA_ERROR, "incorrect data check");
++                   return -1;
++               }
++               if (len != (state->zstrm.total_out & 0xffffffffL)) {
++                   xz_error(state, LZMA_DATA_ERROR, "incorrect length check");
++                   return -1;
++               }
++           }
+             state->strm.avail_in = 0;
+             state->strm.next_in = NULL;
+             state->strm.avail_out = 0;

SOURCES/libxml2-2.9.4-remove-pyverify_fd.patch

@@ -0,0 +1,12 @@
+diff -Nur libxml2-2.9.4.orig/python/types.c libxml2-2.9.4/python/types.c
+--- libxml2-2.9.4.orig/python/types.c	2016-02-09 03:17:33.000000000 -0700
++++ libxml2-2.9.4/python/types.c	2016-12-21 12:34:06.755650986 -0700
+@@ -31,8 +31,6 @@
+     const char *mode;
+ 
+     fd = PyObject_AsFileDescriptor(f);
+-    if (!_PyVerify_fd(fd))
+-        return(NULL);
+     /*
+      * Get the flags on the fd to understand how it was opened
+      */

SOURCES/libxml2-2.9.7-CVE-2016-3709.patch

@@ -0,0 +1,88 @@
+From c1ba6f54d32b707ca6d91cb3257ce9de82876b6f Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sat, 15 Aug 2020 18:32:29 +0200
+Subject: [PATCH] Revert "Do not URI escape in server side includes"
+
+This reverts commit 960f0e275616cadc29671a218d7fb9b69eb35588.
+
+This commit introduced
+
+- an infinite loop, found by OSS-Fuzz, which could be easily fixed.
+- an algorithm with quadratic runtime
+- a security issue, see
+  https://bugzilla.gnome.org/show_bug.cgi?id=769760
+
+A better approach is to add an option not to escape URLs at all
+which libxml2 should have possibly done in the first place.
+---
+ HTMLtree.c | 49 +++++++++++--------------------------------------
+ 1 file changed, 11 insertions(+), 38 deletions(-)
+
+diff --git a/HTMLtree.c b/HTMLtree.c
+index 8d236bb3..cdb7f86a 100644
+--- a/HTMLtree.c
++++ b/HTMLtree.c
+@@ -706,49 +706,22 @@ htmlAttrDumpOutput(xmlOutputBufferPtr buf, xmlDocPtr doc, xmlAttrPtr cur,
+ 		 (!xmlStrcasecmp(cur->name, BAD_CAST "src")) ||
+ 		 ((!xmlStrcasecmp(cur->name, BAD_CAST "name")) &&
+ 		  (!xmlStrcasecmp(cur->parent->name, BAD_CAST "a"))))) {
++		xmlChar *escaped;
+ 		xmlChar *tmp = value;
+-		/* xmlURIEscapeStr() escapes '"' so it can be safely used. */
+-		xmlBufCCat(buf->buffer, "\"");
+ 
+ 		while (IS_BLANK_CH(*tmp)) tmp++;
+ 
+-		/* URI Escape everything, except server side includes. */
+-		for ( ; ; ) {
+-		    xmlChar *escaped;
+-		    xmlChar endChar;
+-		    xmlChar *end = NULL;
+-		    xmlChar *start = (xmlChar *)xmlStrstr(tmp, BAD_CAST "<!--");
+-		    if (start != NULL) {
+-			end = (xmlChar *)xmlStrstr(tmp, BAD_CAST "-->");
+-			if (end != NULL) {
+-			    *start = '\0';
+-			}
+-		    }
+-
+-		    /* Escape the whole string, or until start (set to '\0'). */
+-		    escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+");
+-		    if (escaped != NULL) {
+-		        xmlBufCat(buf->buffer, escaped);
+-		        xmlFree(escaped);
+-		    } else {
+-		        xmlBufCat(buf->buffer, tmp);
+-		    }
+-
+-		    if (end == NULL) { /* Everything has been written. */
+-			break;
+-		    }
+-
+-		    /* Do not escape anything within server side includes. */
+-		    *start = '<'; /* Restore the first character of "<!--". */
+-		    end += 3; /* strlen("-->") */
+-		    endChar = *end;
+-		    *end = '\0';
+-		    xmlBufCat(buf->buffer, start);
+-		    *end = endChar;
+-		    tmp = end;
++		/*
++		 * the < and > have already been escaped at the entity level
++		 * And doing so here breaks server side includes
++		 */
++		escaped = xmlURIEscapeStr(tmp, BAD_CAST"@/:=?;#%&,+<>");
++		if (escaped != NULL) {
++		    xmlBufWriteQuotedString(buf->buffer, escaped);
++		    xmlFree(escaped);
++		} else {
++		    xmlBufWriteQuotedString(buf->buffer, value);
+ 		}
+-
+-		xmlBufCCat(buf->buffer, "\"");
+ 	    } else {
+ 		xmlBufWriteQuotedString(buf->buffer, value);
+ 	    }
+-- 
+GitLab
+

SOURCES/libxml2-2.9.7-CVE-2019-20388.patch

@@ -0,0 +1,33 @@
+From 7ffcd44d7e6c46704f8af0321d9314cd26e0e18a Mon Sep 17 00:00:00 2001
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Tue, 20 Aug 2019 16:33:06 +0800
+Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream
+
+When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
+alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
+to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
+vctxt->xsiAssemble to 0 again which cause the alloced schema
+can not be freed anymore.
+
+Found with libFuzzer.
+
+Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
+---
+ xmlschemas.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/xmlschemas.c b/xmlschemas.c
+index 301c8449..39d92182 100644
+--- a/xmlschemas.c
++++ b/xmlschemas.c
+@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) {
+     vctxt->nberrors = 0;
+     vctxt->depth = -1;
+     vctxt->skipDepth = -1;
+-    vctxt->xsiAssemble = 0;
+     vctxt->hasKeyrefs = 0;
+ #ifdef ENABLE_IDC_NODE_TABLES_TEST
+     vctxt->createIDCNodeTables = 1;
+-- 
+2.24.1
+

SOURCES/libxml2-2.9.7-CVE-2020-24977.patch

@@ -0,0 +1,36 @@
+From 50f06b3efb638efb0abd95dc62dca05ae67882c2 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Fri, 7 Aug 2020 21:54:27 +0200
+Subject: [PATCH] Fix out-of-bounds read with 'xmllint --htmlout'
+
+Make sure that truncated UTF-8 sequences don't cause an out-of-bounds
+array access.
+
+Thanks to @SuhwanSong and the Agency for Defense Development (ADD) for
+the report.
+
+Fixes #178.
+---
+ xmllint.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/xmllint.c b/xmllint.c
+index f6a8e4636..c647486f3 100644
+--- a/xmllint.c
++++ b/xmllint.c
+@@ -528,6 +528,12 @@ static void
+ xmlHTMLEncodeSend(void) {
+     char *result;
+ 
++    /*
++     * xmlEncodeEntitiesReentrant assumes valid UTF-8, but the buffer might
++     * end with a truncated UTF-8 sequence. This is a hack to at least avoid
++     * an out-of-bounds read.
++     */
++    memset(&buffer[sizeof(buffer)-4], 0, 4);
+     result = (char *) xmlEncodeEntitiesReentrant(NULL, BAD_CAST buffer);
+     if (result) {
+ 	xmlGenericError(xmlGenericErrorContext, "%s", result);
+-- 
+GitLab
+

SOURCES/libxml2-2.9.7-CVE-2020-7595.patch

@@ -0,0 +1,32 @@
+From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Thu, 12 Dec 2019 17:30:55 +0800
+Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
+
+When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
+return NULL which cause a infinite loop in xmlStringLenDecodeEntities
+
+Found with libFuzzer.
+
+Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
+---
+ parser.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index d1c31963..a34bb6cd 100644
+--- a/parser.c
++++ b/parser.c
+@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
+     else
+         c = 0;
+     while ((c != 0) && (c != end) && /* non input consuming loop */
+-	   (c != end2) && (c != end3)) {
++           (c != end2) && (c != end3) &&
++           (ctxt->instate != XML_PARSER_EOF)) {
+ 
+ 	if (c == 0) break;
+         if ((c == '&') && (str[1] == '#')) {
+-- 
+2.24.1
+

SOURCES/libxml2-2.9.7-CVE-2021-3516.patch

@@ -0,0 +1,31 @@
+From 1358d157d0bd83be1dfe356a69213df9fac0b539 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Wed, 21 Apr 2021 13:23:27 +0200
+Subject: [PATCH] Fix use-after-free with `xmllint --html --push`
+
+Call htmlCtxtUseOptions to make sure that names aren't stored in
+dictionaries.
+
+Note that this issue only affects xmllint using the HTML push parser.
+
+Fixes #230.
+---
+ xmllint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xmllint.c b/xmllint.c
+index 6ca1bf54..dbef273a 100644
+--- a/xmllint.c
++++ b/xmllint.c
+@@ -2213,7 +2213,7 @@ static void parseAndPrintFile(char *filename, xmlParserCtxtPtr rectxt) {
+             if (res > 0) {
+                 ctxt = htmlCreatePushParserCtxt(NULL, NULL,
+                             chars, res, filename, XML_CHAR_ENCODING_NONE);
+-                xmlCtxtUseOptions(ctxt, options);
++                htmlCtxtUseOptions(ctxt, options);
+                 while ((res = fread(chars, 1, pushsize, f)) > 0) {
+                     htmlParseChunk(ctxt, chars, res, 0);
+                 }
+-- 
+GitLab
+

SOURCES/libxml2-2.9.7-CVE-2021-3517.patch

@@ -0,0 +1,49 @@
+From bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2 Mon Sep 17 00:00:00 2001
+From: Joel Hockey <joel.hockey@gmail.com>
+Date: Sun, 16 Aug 2020 17:19:35 -0700
+Subject: [PATCH] Validate UTF8 in xmlEncodeEntities
+
+Code is currently assuming UTF-8 without validating. Truncated UTF-8
+input can cause out-of-bounds array access.
+
+Adds further checks to partial fix in 50f06b3e.
+
+Fixes #178
+---
+ entities.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/entities.c b/entities.c
+index 37b99a56..1a8f86f0 100644
+--- a/entities.c
++++ b/entities.c
+@@ -704,11 +704,25 @@ xmlEncodeEntitiesInternal(xmlDocPtr doc, const xmlChar *input, int attr) {
+ 	    } else {
+ 		/*
+ 		 * We assume we have UTF-8 input.
++		 * It must match either:
++		 *   110xxxxx 10xxxxxx
++		 *   1110xxxx 10xxxxxx 10xxxxxx
++		 *   11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
++		 * That is:
++		 *   cur[0] is 11xxxxxx
++		 *   cur[1] is 10xxxxxx
++		 *   cur[2] is 10xxxxxx if cur[0] is 111xxxxx
++		 *   cur[3] is 10xxxxxx if cur[0] is 1111xxxx
++		 *   cur[0] is not 11111xxx
+ 		 */
+ 		char buf[11], *ptr;
+ 		int val = 0, l = 1;
+ 
+-		if (*cur < 0xC0) {
++		if (((cur[0] & 0xC0) != 0xC0) ||
++		    ((cur[1] & 0xC0) != 0x80) ||
++		    (((cur[0] & 0xE0) == 0xE0) && ((cur[2] & 0xC0) != 0x80)) ||
++		    (((cur[0] & 0xF0) == 0xF0) && ((cur[3] & 0xC0) != 0x80)) ||
++		    (((cur[0] & 0xF8) == 0xF8))) {
+ 		    xmlEntitiesErr(XML_CHECK_NOT_UTF8,
+ 			    "xmlEncodeEntities: input not UTF-8");
+ 		    if (doc != NULL)
+-- 
+GitLab
+

SOURCES/libxml2-2.9.7-CVE-2021-3518.patch

@@ -0,0 +1,247 @@
+From 752e5f71d7cea2ca5a7e7c0b8f72ed04ce654be4 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Wed, 10 Jun 2020 16:34:52 +0200
+Subject: [PATCH 1/2] Don't recurse into xi:include children in
+ xmlXIncludeDoProcess
+
+Otherwise, nested xi:include nodes might result in a use-after-free
+if XML_PARSE_NOXINCNODE is specified.
+
+Found with libFuzzer and ASan.
+---
+ result/XInclude/fallback3.xml     |  8 ++++++++
+ result/XInclude/fallback3.xml.err |  0
+ result/XInclude/fallback3.xml.rdr | 25 +++++++++++++++++++++++++
+ result/XInclude/fallback4.xml     | 10 ++++++++++
+ result/XInclude/fallback4.xml.err |  0
+ result/XInclude/fallback4.xml.rdr | 29 +++++++++++++++++++++++++++++
+ test/XInclude/docs/fallback3.xml  |  9 +++++++++
+ test/XInclude/docs/fallback4.xml  |  7 +++++++
+ xinclude.c                        | 24 ++++++++++--------------
+ 9 files changed, 98 insertions(+), 14 deletions(-)
+ create mode 100644 result/XInclude/fallback3.xml
+ create mode 100644 result/XInclude/fallback3.xml.err
+ create mode 100644 result/XInclude/fallback3.xml.rdr
+ create mode 100644 result/XInclude/fallback4.xml
+ create mode 100644 result/XInclude/fallback4.xml.err
+ create mode 100644 result/XInclude/fallback4.xml.rdr
+ create mode 100644 test/XInclude/docs/fallback3.xml
+ create mode 100644 test/XInclude/docs/fallback4.xml
+
+diff --git a/result/XInclude/fallback3.xml b/result/XInclude/fallback3.xml
+new file mode 100644
+index 00000000..b4235514
+--- /dev/null
++++ b/result/XInclude/fallback3.xml
+@@ -0,0 +1,8 @@
++<?xml version="1.0"?>
++<a>
++    <doc xml:base="../ents/something.xml">
++<p>something</p>
++<p>really</p>
++<p>simple</p>
++</doc>
++</a>
+diff --git a/result/XInclude/fallback3.xml.err b/result/XInclude/fallback3.xml.err
+new file mode 100644
+index 00000000..e69de29b
+diff --git a/result/XInclude/fallback3.xml.rdr b/result/XInclude/fallback3.xml.rdr
+new file mode 100644
+index 00000000..aa2f1374
+--- /dev/null
++++ b/result/XInclude/fallback3.xml.rdr
+@@ -0,0 +1,25 @@
++0 1 a 0 0
++1 14 #text 0 1 
++    
++1 1 doc 0 0
++2 14 #text 0 1 
++
++2 1 p 0 0
++3 3 #text 0 1 something
++2 15 p 0 0
++2 14 #text 0 1 
++
++2 1 p 0 0
++3 3 #text 0 1 really
++2 15 p 0 0
++2 14 #text 0 1 
++
++2 1 p 0 0
++3 3 #text 0 1 simple
++2 15 p 0 0
++2 14 #text 0 1 
++
++1 15 doc 0 0
++1 14 #text 0 1 
++
++0 15 a 0 0
+diff --git a/result/XInclude/fallback4.xml b/result/XInclude/fallback4.xml
+new file mode 100644
+index 00000000..9883fd54
+--- /dev/null
++++ b/result/XInclude/fallback4.xml
+@@ -0,0 +1,10 @@
++<?xml version="1.0"?>
++<a>
++    
++            <doc xml:base="../ents/something.xml">
++<p>something</p>
++<p>really</p>
++<p>simple</p>
++</doc>
++        
++</a>
+diff --git a/result/XInclude/fallback4.xml.err b/result/XInclude/fallback4.xml.err
+new file mode 100644
+index 00000000..e69de29b
+diff --git a/result/XInclude/fallback4.xml.rdr b/result/XInclude/fallback4.xml.rdr
+new file mode 100644
+index 00000000..628b9513
+--- /dev/null
++++ b/result/XInclude/fallback4.xml.rdr
+@@ -0,0 +1,29 @@
++0 1 a 0 0
++1 14 #text 0 1 
++    
++1 14 #text 0 1 
++            
++1 1 doc 0 0
++2 14 #text 0 1 
++
++2 1 p 0 0
++3 3 #text 0 1 something
++2 15 p 0 0
++2 14 #text 0 1 
++
++2 1 p 0 0
++3 3 #text 0 1 really
++2 15 p 0 0
++2 14 #text 0 1 
++
++2 1 p 0 0
++3 3 #text 0 1 simple
++2 15 p 0 0
++2 14 #text 0 1 
++
++1 15 doc 0 0
++1 14 #text 0 1 
++        
++1 14 #text 0 1 
++
++0 15 a 0 0
+diff --git a/test/XInclude/docs/fallback3.xml b/test/XInclude/docs/fallback3.xml
+new file mode 100644
+index 00000000..0c8b6c9e
+--- /dev/null
++++ b/test/XInclude/docs/fallback3.xml
+@@ -0,0 +1,9 @@
++<a>
++    <xi:include href="../ents/something.xml" xmlns:xi="http://www.w3.org/2001/XInclude">
++        <xi:fallback>
++            <xi:include href="c.xml">
++                <xi:fallback>There is no c.xml ... </xi:fallback>
++            </xi:include>
++        </xi:fallback>
++    </xi:include>
++</a>
+diff --git a/test/XInclude/docs/fallback4.xml b/test/XInclude/docs/fallback4.xml
+new file mode 100644
+index 00000000..b500a635
+--- /dev/null
++++ b/test/XInclude/docs/fallback4.xml
+@@ -0,0 +1,7 @@
++<a>
++    <xi:include href="c.xml" xmlns:xi="http://www.w3.org/2001/XInclude">
++        <xi:fallback>
++            <xi:include href="../ents/something.xml"/>
++        </xi:fallback>
++    </xi:include>
++</a>
+diff --git a/xinclude.c b/xinclude.c
+index ba850fa5..f260c1a7 100644
+--- a/xinclude.c
++++ b/xinclude.c
+@@ -2392,21 +2392,19 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
+      * First phase: lookup the elements in the document
+      */
+     cur = tree;
+-    if (xmlXIncludeTestNode(ctxt, cur) == 1)
+-	xmlXIncludePreProcessNode(ctxt, cur);
+     while ((cur != NULL) && (cur != tree->parent)) {
+ 	/* TODO: need to work on entities -> stack */
+-	if ((cur->children != NULL) &&
+-	    (cur->children->type != XML_ENTITY_DECL) &&
+-	    (cur->children->type != XML_XINCLUDE_START) &&
+-	    (cur->children->type != XML_XINCLUDE_END)) {
+-	    cur = cur->children;
+-	    if (xmlXIncludeTestNode(ctxt, cur))
+-		xmlXIncludePreProcessNode(ctxt, cur);
+-	} else if (cur->next != NULL) {
++        if (xmlXIncludeTestNode(ctxt, cur) == 1) {
++            xmlXIncludePreProcessNode(ctxt, cur);
++        } else if ((cur->children != NULL) &&
++                   (cur->children->type != XML_ENTITY_DECL) &&
++                   (cur->children->type != XML_XINCLUDE_START) &&
++                   (cur->children->type != XML_XINCLUDE_END)) {
++            cur = cur->children;
++            continue;
++        }
++	if (cur->next != NULL) {
+ 	    cur = cur->next;
+-	    if (xmlXIncludeTestNode(ctxt, cur))
+-		xmlXIncludePreProcessNode(ctxt, cur);
+ 	} else {
+ 	    if (cur == tree)
+ 	        break;
+@@ -2416,8 +2414,6 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
+ 		    break; /* do */
+ 		if (cur->next != NULL) {
+ 		    cur = cur->next;
+-		    if (xmlXIncludeTestNode(ctxt, cur))
+-			xmlXIncludePreProcessNode(ctxt, cur);
+ 		    break; /* do */
+ 		}
+ 	    } while (cur != NULL);
+-- 
+2.31.1
+
+
+From 49cc4182543dba73216add4021994a81678763bd Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Thu, 22 Apr 2021 19:26:28 +0200
+Subject: [PATCH 2/2] Fix user-after-free with `xmllint --xinclude --dropdtd`
+
+The --dropdtd option can leave dangling pointers in entity reference
+nodes. Make sure to skip these nodes when processing XIncludes.
+
+This also avoids scanning entity declarations and even modifying
+them inadvertently during XInclude processing.
+
+Move from a block list to an allow list approach to avoid descending
+into other node types that can't contain elements.
+
+Fixes #237.
+---
+ xinclude.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/xinclude.c b/xinclude.c
+index f260c1a7..d7648529 100644
+--- a/xinclude.c
++++ b/xinclude.c
+@@ -2397,9 +2397,8 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
+         if (xmlXIncludeTestNode(ctxt, cur) == 1) {
+             xmlXIncludePreProcessNode(ctxt, cur);
+         } else if ((cur->children != NULL) &&
+-                   (cur->children->type != XML_ENTITY_DECL) &&
+-                   (cur->children->type != XML_XINCLUDE_START) &&
+-                   (cur->children->type != XML_XINCLUDE_END)) {
++                   ((cur->type == XML_DOCUMENT_NODE) ||
++                    (cur->type == XML_ELEMENT_NODE))) {
+             cur = cur->children;
+             continue;
+         }
+-- 
+2.31.1
+

SOURCES/libxml2-2.9.7-CVE-2021-3537.patch

@@ -0,0 +1,44 @@
+From babe75030c7f64a37826bb3342317134568bef61 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sat, 1 May 2021 16:53:33 +0200
+Subject: [PATCH] Propagate error in xmlParseElementChildrenContentDeclPriv
+
+Check return value of recursive calls to
+xmlParseElementChildrenContentDeclPriv and return immediately in case
+of errors. Otherwise, struct xmlElementContent could contain unexpected
+null pointers, leading to a null deref when post-validating documents
+which aren't well-formed and parsed in recovery mode.
+
+Fixes #243.
+---
+ parser.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/parser.c b/parser.c
+index b42e6043..73c27edd 100644
+--- a/parser.c
++++ b/parser.c
+@@ -6208,6 +6208,8 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPtr ctxt, int inputchk,
+ 	SKIP_BLANKS;
+         cur = ret = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
+                                                            depth + 1);
++        if (cur == NULL)
++            return(NULL);
+ 	SKIP_BLANKS;
+ 	GROW;
+     } else {
+@@ -6341,6 +6343,11 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPtr ctxt, int inputchk,
+ 	    SKIP_BLANKS;
+ 	    last = xmlParseElementChildrenContentDeclPriv(ctxt, inputid,
+                                                           depth + 1);
++            if (last == NULL) {
++		if (ret != NULL)
++		    xmlFreeDocElementContent(ctxt->myDoc, ret);
++		return(NULL);
++            }
+ 	    SKIP_BLANKS;
+ 	} else {
+ 	    elem = xmlParseName(ctxt);
+-- 
+GitLab
+

SOURCES/libxml2-2.9.7-CVE-2021-3541.patch

@@ -0,0 +1,67 @@
+From 8598060bacada41a0eb09d95c97744ff4e428f8e Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Thu, 13 May 2021 14:55:12 +0200
+Subject: [PATCH] Patch for security issue CVE-2021-3541
+
+This is relapted to parameter entities expansion and following
+the line of the billion laugh attack. Somehow in that path the
+counting of parameters was missed and the normal algorithm based
+on entities "density" was useless.
+---
+ parser.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/parser.c b/parser.c
+index f5e5e169..c9312fa4 100644
+--- a/parser.c
++++ b/parser.c
+@@ -140,6 +140,7 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+                      xmlEntityPtr ent, size_t replacement)
+ {
+     size_t consumed = 0;
++    int i;
+ 
+     if ((ctxt == NULL) || (ctxt->options & XML_PARSE_HUGE))
+         return (0);
+@@ -177,6 +178,28 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+ 	    rep = NULL;
+ 	}
+     }
++
++    /*
++     * Prevent entity exponential check, not just replacement while
++     * parsing the DTD
++     * The check is potentially costly so do that only once in a thousand
++     */
++    if ((ctxt->instate == XML_PARSER_DTD) && (ctxt->nbentities > 10000) &&
++        (ctxt->nbentities % 1024 == 0)) {
++	for (i = 0;i < ctxt->inputNr;i++) {
++	    consumed += ctxt->inputTab[i]->consumed +
++	               (ctxt->inputTab[i]->cur - ctxt->inputTab[i]->base);
++	}
++	if (ctxt->nbentities > consumed * XML_PARSER_NON_LINEAR) {
++	    xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
++	    ctxt->instate = XML_PARSER_EOF;
++	    return (1);
++	}
++	consumed = 0;
++    }
++
++
++
+     if (replacement != 0) {
+ 	if (replacement < XML_MAX_TEXT_LENGTH)
+ 	    return(0);
+@@ -7963,6 +7986,9 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
+             xmlChar start[4];
+             xmlCharEncoding enc;
+ 
++	    if (xmlParserEntityCheck(ctxt, 0, entity, 0))
++	        return;
++
+ 	    if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
+ 	        ((ctxt->options & XML_PARSE_NOENT) == 0) &&
+ 		((ctxt->options & XML_PARSE_DTDVALID) == 0) &&
+-- 
+GitLab
+

SOURCES/libxml2-2.9.7-CVE-2022-23308.patch

@@ -0,0 +1,196 @@
+From 7f70302bfa9faeac9c9f7be8adf96d32c16acb72 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 8 Feb 2022 03:29:24 +0100
+Subject: [PATCH] [CVE-2022-23308] Use-after-free of ID and IDREF attributes
+
+If a document is parsed with XML_PARSE_DTDVALID and without
+XML_PARSE_NOENT, the value of ID attributes has to be normalized after
+potentially expanding entities in xmlRemoveID. Otherwise, later calls
+to xmlGetID can return a pointer to previously freed memory.
+
+ID attributes which are empty or contain only whitespace after
+entity expansion are affected in a similar way. This is fixed by
+not storing such attributes in the ID table.
+
+The test to detect streaming mode when validating against a DTD was
+broken. In connection with the defects above, this could result in a
+use-after-free when using the xmlReader interface with validation.
+Fix detection of streaming mode to avoid similar issues. (This changes
+the expected result of a test case. But as far as I can tell, using the
+XML reader with XIncludes referencing the root document never worked
+properly, anyway.)
+
+All of these issues can result in denial of service. Using xmlReader
+with validation could result in disclosure of memory via the error
+channel, typically stderr. The security impact of xmlGetID returning
+a pointer to freed memory depends on the application. The typical use
+case of calling xmlGetID on an unmodified document is not affected.
+---
+ valid.c | 88 +++++++++++++++++++++++++++++++++++----------------------
+ 1 file changed, 55 insertions(+), 33 deletions(-)
+
+diff --git a/valid.c b/valid.c
+index a64b96be..5b81059f 100644
+--- a/valid.c
++++ b/valid.c
+@@ -479,6 +479,35 @@ nodeVPop(xmlValidCtxtPtr ctxt)
+     return (ret);
+ }
+ 
++/**
++ * xmlValidNormalizeString:
++ * @str: a string
++ *
++ * Normalize a string in-place.
++ */
++static void
++xmlValidNormalizeString(xmlChar *str) {
++    xmlChar *dst;
++    const xmlChar *src;
++
++    if (str == NULL)
++        return;
++    src = str;
++    dst = str;
++
++    while (*src == 0x20) src++;
++    while (*src != 0) {
++	if (*src == 0x20) {
++	    while (*src == 0x20) src++;
++	    if (*src != 0)
++		*dst++ = 0x20;
++	} else {
++	    *dst++ = *src++;
++	}
++    }
++    *dst = 0;
++}
++
+ #ifdef DEBUG_VALID_ALGO
+ static void
+ xmlValidPrintNode(xmlNodePtr cur) {
+@@ -2546,6 +2575,24 @@ xmlDumpNotationTable(xmlBufferPtr buf, xmlNotationTablePtr table) {
+ 	    (xmlDictOwns(dict, (const xmlChar *)(str)) == 0)))	\
+ 	    xmlFree((char *)(str));
+ 
++static int
++xmlIsStreaming(xmlValidCtxtPtr ctxt) {
++    xmlParserCtxtPtr pctxt;
++
++    if (ctxt == NULL)
++        return(0);
++    /*
++     * These magic values are also abused to detect whether we're validating
++     * while parsing a document. In this case, userData points to the parser
++     * context.
++     */
++    if ((ctxt->finishDtd != XML_CTXT_FINISH_DTD_0) &&
++        (ctxt->finishDtd != XML_CTXT_FINISH_DTD_1))
++        return(0);
++    pctxt = ctxt->userData;
++    return(pctxt->parseMode == XML_PARSE_READER);
++}
++
+ /**
+  * xmlFreeID:
+  * @not:  A id
+@@ -2589,7 +2636,7 @@ xmlAddID(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value,
+     if (doc == NULL) {
+ 	return(NULL);
+     }
+-    if (value == NULL) {
++    if ((value == NULL) || (value[0] == 0)) {
+ 	return(NULL);
+     }
+     if (attr == NULL) {
+@@ -2620,7 +2667,7 @@ xmlAddID(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value,
+      */
+     ret->value = xmlStrdup(value);
+     ret->doc = doc;
+-    if ((ctxt != NULL) && (ctxt->vstateNr != 0)) {
++    if (xmlIsStreaming(ctxt)) {
+ 	/*
+ 	 * Operating in streaming mode, attr is gonna disapear
+ 	 */
+@@ -2754,6 +2801,7 @@ xmlRemoveID(xmlDocPtr doc, xmlAttrPtr attr) {
+     ID = xmlNodeListGetString(doc, attr->children, 1);
+     if (ID == NULL)
+         return(-1);
++    xmlValidNormalizeString(ID);
+ 
+     id = xmlHashLookup(table, ID);
+     if (id == NULL || id->attr != attr) {
+@@ -2942,7 +2990,7 @@ xmlAddRef(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value,
+      * fill the structure.
+      */
+     ret->value = xmlStrdup(value);
+-    if ((ctxt != NULL) && (ctxt->vstateNr != 0)) {
++    if (xmlIsStreaming(ctxt)) {
+ 	/*
+ 	 * Operating in streaming mode, attr is gonna disapear
+ 	 */
+@@ -3962,8 +4010,7 @@ xmlValidateAttributeValue2(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ xmlChar *
+ xmlValidCtxtNormalizeAttributeValue(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ 	     xmlNodePtr elem, const xmlChar *name, const xmlChar *value) {
+-    xmlChar *ret, *dst;
+-    const xmlChar *src;
++    xmlChar *ret;
+     xmlAttributePtr attrDecl = NULL;
+     int extsubset = 0;
+ 
+@@ -4004,19 +4051,7 @@ xmlValidCtxtNormalizeAttributeValue(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+     ret = xmlStrdup(value);
+     if (ret == NULL)
+ 	return(NULL);
+-    src = value;
+-    dst = ret;
+-    while (*src == 0x20) src++;
+-    while (*src != 0) {
+-	if (*src == 0x20) {
+-	    while (*src == 0x20) src++;
+-	    if (*src != 0)
+-		*dst++ = 0x20;
+-	} else {
+-	    *dst++ = *src++;
+-	}
+-    }
+-    *dst = 0;
++    xmlValidNormalizeString(ret);
+     if ((doc->standalone) && (extsubset == 1) && (!xmlStrEqual(value, ret))) {
+ 	xmlErrValidNode(ctxt, elem, XML_DTD_NOT_STANDALONE,
+ "standalone: %s on %s value had to be normalized based on external subset declaration\n",
+@@ -4048,8 +4083,7 @@ xmlValidCtxtNormalizeAttributeValue(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ xmlChar *
+ xmlValidNormalizeAttributeValue(xmlDocPtr doc, xmlNodePtr elem,
+ 			        const xmlChar *name, const xmlChar *value) {
+-    xmlChar *ret, *dst;
+-    const xmlChar *src;
++    xmlChar *ret;
+     xmlAttributePtr attrDecl = NULL;
+ 
+     if (doc == NULL) return(NULL);
+@@ -4079,19 +4113,7 @@ xmlValidNormalizeAttributeValue(xmlDocPtr doc, xmlNodePtr elem,
+     ret = xmlStrdup(value);
+     if (ret == NULL)
+ 	return(NULL);
+-    src = value;
+-    dst = ret;
+-    while (*src == 0x20) src++;
+-    while (*src != 0) {
+-	if (*src == 0x20) {
+-	    while (*src == 0x20) src++;
+-	    if (*src != 0)
+-		*dst++ = 0x20;
+-	} else {
+-	    *dst++ = *src++;
+-	}
+-    }
+-    *dst = 0;
++    xmlValidNormalizeString(ret);
+     return(ret);
+ }
+ 
+-- 
+2.35.1
+

SOURCES/libxml2-2.9.7-CVE-2022-29824.patch

@@ -1,4 +1,4 @@
-From ecc43dce8e2cd19f635841e788421d0f4bd72cce Mon Sep 17 00:00:00 2001
+From d410ac5b7ef6ecf1254606408d55f98547c22bda Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Tue, 8 Mar 2022 20:10:02 +0100
 Subject: [PATCH] [CVE-2022-29824] Fix integer overflows in xmlBuf and
@@ -16,7 +16,7 @@ Thanks to Felix Wilhelm for the report.
  2 files changed, 61 insertions(+), 97 deletions(-)
 
 diff --git a/buf.c b/buf.c
-index 24368d37..40a5ee06 100644
+index 21cb9d80..f861d79b 100644
 --- a/buf.c
 +++ b/buf.c
 @@ -30,6 +30,10 @@
@@ -192,10 +192,10 @@ index 24368d37..40a5ee06 100644
  
  /**
 diff --git a/tree.c b/tree.c
-index 9d94aa42..86afb7d6 100644
+index 86a8da79..fc75f962 100644
 --- a/tree.c
 +++ b/tree.c
-@@ -7104,6 +7104,8 @@ xmlBufferPtr
+@@ -7049,6 +7049,8 @@ xmlBufferPtr
  xmlBufferCreateSize(size_t size) {
      xmlBufferPtr ret;
  
@@ -204,7 +204,7 @@ index 9d94aa42..86afb7d6 100644
      ret = (xmlBufferPtr) xmlMalloc(sizeof(xmlBuffer));
      if (ret == NULL) {
  	xmlTreeErrMemory("creating buffer");
-@@ -7111,7 +7113,7 @@ xmlBufferCreateSize(size_t size) {
+@@ -7056,7 +7058,7 @@ xmlBufferCreateSize(size_t size) {
      }
      ret->use = 0;
      ret->alloc = xmlBufferAllocScheme;
@@ -213,7 +213,7 @@ index 9d94aa42..86afb7d6 100644
      if (ret->size){
          ret->content = (xmlChar *) xmlMallocAtomic(ret->size * sizeof(xmlChar));
          if (ret->content == NULL) {
-@@ -7171,6 +7173,8 @@ xmlBufferCreateStatic(void *mem, size_t size) {
+@@ -7116,6 +7118,8 @@ xmlBufferCreateStatic(void *mem, size_t size) {
  
      if ((mem == NULL) || (size == 0))
          return(NULL);
@@ -222,7 +222,7 @@ index 9d94aa42..86afb7d6 100644
  
      ret = (xmlBufferPtr) xmlMalloc(sizeof(xmlBuffer));
      if (ret == NULL) {
-@@ -7318,28 +7322,23 @@ xmlBufferShrink(xmlBufferPtr buf, unsigned int len) {
+@@ -7263,28 +7267,23 @@ xmlBufferShrink(xmlBufferPtr buf, unsigned int len) {
   */
  int
  xmlBufferGrow(xmlBufferPtr buf, unsigned int len) {
@@ -262,11 +262,11 @@ index 9d94aa42..86afb7d6 100644
  
      if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) {
          size_t start_buf = buf->content - buf->contentIO;
-@@ -7466,7 +7465,10 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+@@ -7406,7 +7405,10 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
  	case XML_BUFFER_ALLOC_IO:
  	case XML_BUFFER_ALLOC_DOUBLEIT:
  	    /*take care of empty case*/
--	    newSize = (buf->size ? buf->size : size + 10);
+-	    newSize = (buf->size ? buf->size*2 : size + 10);
 +            if (buf->size == 0)
 +                newSize = (size > UINT_MAX - 10 ? UINT_MAX : size + 10);
 +            else
@@ -274,7 +274,7 @@ index 9d94aa42..86afb7d6 100644
  	    while (size > newSize) {
  	        if (newSize > UINT_MAX / 2) {
  	            xmlTreeErrMemory("growing buffer");
-@@ -7476,7 +7478,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+@@ -7416,7 +7418,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
  	    }
  	    break;
  	case XML_BUFFER_ALLOC_EXACT:
@@ -283,7 +283,7 @@ index 9d94aa42..86afb7d6 100644
  	    break;
          case XML_BUFFER_ALLOC_HYBRID:
              if (buf->use < BASE_BUFFER_SIZE)
-@@ -7494,7 +7496,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+@@ -7434,7 +7436,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
              break;
  
  	default:
@@ -292,7 +292,7 @@ index 9d94aa42..86afb7d6 100644
  	    break;
      }
  
-@@ -7580,8 +7582,10 @@ xmlBufferAdd(xmlBufferPtr buf, const xmlChar *str, int len) {
+@@ -7520,8 +7522,10 @@ xmlBufferAdd(xmlBufferPtr buf, const xmlChar *str, int len) {
      if (len < 0) return -1;
      if (len == 0) return 0;
  
@@ -305,7 +305,7 @@ index 9d94aa42..86afb7d6 100644
          if (!xmlBufferResize(buf, needSize)){
  	    xmlTreeErrMemory("growing buffer");
              return XML_ERR_NO_MEMORY;
-@@ -7694,29 +7698,7 @@ xmlBufferCat(xmlBufferPtr buf, const xmlChar *str) {
+@@ -7634,29 +7638,7 @@ xmlBufferCat(xmlBufferPtr buf, const xmlChar *str) {
   */
  int
  xmlBufferCCat(xmlBufferPtr buf, const char *str) {
@@ -337,5 +337,5 @@ index 9d94aa42..86afb7d6 100644
  
  /**
 -- 
-2.36.0
+2.36.1
 

SOURCES/libxml2-2.9.7-CVE-2022-40303.patch

@@ -1,28 +1,18 @@
-From c846986356fc149915a74972bf198abc266bc2c0 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Thu, 25 Aug 2022 17:43:08 +0200
-Subject: [PATCH] [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
+From 7afb666b26cfb17689e5da98bed610a417083f9d Mon Sep 17 00:00:00 2001
+From: David King <amigadave@amigadave.com>
+Date: Tue, 3 Jan 2023 09:57:28 +0000
+Subject: [PATCH 1/2] Fix CVE-2022-40303
 
-Also impose size limits when XML_PARSE_HUGE is set. Limit size of names
-to XML_MAX_TEXT_LENGTH (10 million bytes) and other content to
-XML_MAX_HUGE_LENGTH (1 billion bytes).
-
-Move some the length checks to the end of the respective loop to make
-them strict.
-
-xmlParseEntityValue didn't have a length limitation at all. But without
-XML_PARSE_HUGE, this should eventually trigger an error in xmlGROW.
-
-Thanks to Maddie Stone working with Google Project Zero for the report!
+Adapted from https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0
 ---
- parser.c | 233 +++++++++++++++++++++++++++++--------------------------
- 1 file changed, 121 insertions(+), 112 deletions(-)
+ parser.c | 232 +++++++++++++++++++++++++++++--------------------------
+ 1 file changed, 121 insertions(+), 111 deletions(-)
 
 diff --git a/parser.c b/parser.c
-index 93f031be..79479979 100644
+index 1c5e036e..e66e4196 100644
 --- a/parser.c
 +++ b/parser.c
-@@ -102,6 +102,8 @@ xmlParseElementEnd(xmlParserCtxtPtr ctxt);
+@@ -108,6 +108,8 @@ static void xmlHaltParser(xmlParserCtxtPtr ctxt);
   *									*
   ************************************************************************/
  
@@ -31,7 +21,7 @@ index 93f031be..79479979 100644
  #define XML_PARSER_BIG_ENTITY 1000
  #define XML_PARSER_LOT_ENTITY 5000
  
-@@ -552,7 +554,7 @@ xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info)
+@@ -532,7 +534,7 @@ xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info)
              errmsg = "Malformed declaration expecting version";
              break;
          case XML_ERR_NAME_TOO_LONG:
@@ -40,7 +30,7 @@ index 93f031be..79479979 100644
              break;
  #if 0
          case:
-@@ -3202,6 +3204,9 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
+@@ -3150,6 +3152,9 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
      int len = 0, l;
      int c;
      int count = 0;
@@ -50,17 +40,7 @@ index 93f031be..79479979 100644
  
  #ifdef DEBUG
      nbParseNameComplex++;
-@@ -3267,7 +3272,8 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
-                 if (ctxt->instate == XML_PARSER_EOF)
-                     return(NULL);
- 	    }
--	    len += l;
-+            if (len <= INT_MAX - l)
-+	        len += l;
- 	    NEXTL(l);
- 	    c = CUR_CHAR(l);
- 	}
-@@ -3293,13 +3299,13 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
+@@ -3241,13 +3246,13 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
                  if (ctxt->instate == XML_PARSER_EOF)
                      return(NULL);
  	    }
@@ -77,7 +57,7 @@ index 93f031be..79479979 100644
          xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");
          return(NULL);
      }
-@@ -3338,7 +3344,10 @@ const xmlChar *
+@@ -3286,7 +3291,10 @@ const xmlChar *
  xmlParseName(xmlParserCtxtPtr ctxt) {
      const xmlChar *in;
      const xmlChar *ret;
@@ -89,7 +69,7 @@ index 93f031be..79479979 100644
  
      GROW;
  
-@@ -3362,8 +3371,7 @@ xmlParseName(xmlParserCtxtPtr ctxt) {
+@@ -3310,8 +3318,7 @@ xmlParseName(xmlParserCtxtPtr ctxt) {
  	    in++;
  	if ((*in > 0) && (*in < 0x80)) {
  	    count = in - ctxt->input->cur;
@@ -99,7 +79,7 @@ index 93f031be..79479979 100644
                  xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");
                  return(NULL);
              }
-@@ -3384,6 +3392,9 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
+@@ -3333,6 +3340,9 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
      int len = 0, l;
      int c;
      int count = 0;
@@ -109,7 +89,7 @@ index 93f031be..79479979 100644
      size_t startPosition = 0;
  
  #ifdef DEBUG
-@@ -3404,17 +3415,13 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
+@@ -3353,17 +3363,13 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
      while ((c != ' ') && (c != '>') && (c != '/') && /* test bigname.xml */
  	   (xmlIsNameChar(ctxt, c) && (c != ':'))) {
  	if (count++ > XML_PARSER_CHUNK_SIZE) {
@@ -129,7 +109,7 @@ index 93f031be..79479979 100644
  	NEXTL(l);
  	c = CUR_CHAR(l);
  	if (c == 0) {
-@@ -3432,8 +3439,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
+@@ -3381,8 +3387,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
  	    c = CUR_CHAR(l);
  	}
      }
@@ -139,7 +119,7 @@ index 93f031be..79479979 100644
          xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
          return(NULL);
      }
-@@ -3459,7 +3465,10 @@ static const xmlChar *
+@@ -3408,7 +3413,10 @@ static const xmlChar *
  xmlParseNCName(xmlParserCtxtPtr ctxt) {
      const xmlChar *in, *e;
      const xmlChar *ret;
@@ -151,7 +131,7 @@ index 93f031be..79479979 100644
  
  #ifdef DEBUG
      nbParseNCName++;
-@@ -3484,8 +3493,7 @@ xmlParseNCName(xmlParserCtxtPtr ctxt) {
+@@ -3433,8 +3441,7 @@ xmlParseNCName(xmlParserCtxtPtr ctxt) {
  	    goto complex;
  	if ((*in > 0) && (*in < 0x80)) {
  	    count = in - ctxt->input->cur;
@@ -161,7 +141,7 @@ index 93f031be..79479979 100644
                  xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
                  return(NULL);
              }
-@@ -3567,6 +3575,9 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {
+@@ -3517,6 +3524,9 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {
      const xmlChar *cur = *str;
      int len = 0, l;
      int c;
@@ -171,7 +151,7 @@ index 93f031be..79479979 100644
  
  #ifdef DEBUG
      nbParseStringName++;
-@@ -3602,12 +3613,6 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {
+@@ -3552,12 +3562,6 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {
  		if (len + 10 > max) {
  		    xmlChar *tmp;
  
@@ -184,7 +164,7 @@ index 93f031be..79479979 100644
  		    max *= 2;
  		    tmp = (xmlChar *) xmlRealloc(buffer,
  			                            max * sizeof(xmlChar));
-@@ -3621,14 +3626,18 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {
+@@ -3571,14 +3575,18 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {
  		COPY_BUF(l,buffer,len,c);
  		cur += l;
  		c = CUR_SCHAR(cur, l);
@@ -205,7 +185,7 @@ index 93f031be..79479979 100644
          xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
          return(NULL);
      }
-@@ -3655,6 +3664,9 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
+@@ -3605,6 +3613,9 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
      int len = 0, l;
      int c;
      int count = 0;
@@ -215,7 +195,7 @@ index 93f031be..79479979 100644
  
  #ifdef DEBUG
      nbParseNmToken++;
-@@ -3706,12 +3718,6 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
+@@ -3656,12 +3667,6 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
  		if (len + 10 > max) {
  		    xmlChar *tmp;
  
@@ -228,7 +208,7 @@ index 93f031be..79479979 100644
  		    max *= 2;
  		    tmp = (xmlChar *) xmlRealloc(buffer,
  			                            max * sizeof(xmlChar));
-@@ -3725,6 +3731,11 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
+@@ -3675,6 +3680,11 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
  		COPY_BUF(l,buffer,len,c);
  		NEXTL(l);
  		c = CUR_CHAR(l);
@@ -240,7 +220,7 @@ index 93f031be..79479979 100644
  	    }
  	    buffer[len] = 0;
  	    return(buffer);
-@@ -3732,8 +3743,7 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
+@@ -3682,8 +3692,7 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {
      }
      if (len == 0)
          return(NULL);
@@ -250,7 +230,7 @@ index 93f031be..79479979 100644
          xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken");
          return(NULL);
      }
-@@ -3759,6 +3769,9 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) {
+@@ -3709,6 +3718,9 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) {
      int len = 0;
      int size = XML_PARSER_BUFFER_SIZE;
      int c, l;
@@ -260,7 +240,7 @@ index 93f031be..79479979 100644
      xmlChar stop;
      xmlChar *ret = NULL;
      const xmlChar *cur = NULL;
-@@ -3818,6 +3831,12 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) {
+@@ -3768,6 +3780,14 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) {
  	    GROW;
  	    c = CUR_CHAR(l);
  	}
@@ -268,12 +248,14 @@ index 93f031be..79479979 100644
 +        if (len > maxLength) {
 +            xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
 +                           "entity value too long\n");
-+            goto error;
++        if (buf != NULL)
++            xmlFree(buf);
++        return(ret);
 +        }
      }
      buf[len] = 0;
      if (ctxt->instate == XML_PARSER_EOF)
-@@ -3905,6 +3924,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
+@@ -3855,6 +3875,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
      xmlChar *rep = NULL;
      size_t len = 0;
      size_t buf_size = 0;
@@ -283,7 +265,7 @@ index 93f031be..79479979 100644
      int c, l, in_space = 0;
      xmlChar *current = NULL;
      xmlEntityPtr ent;
-@@ -3936,16 +3958,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
+@@ -3886,16 +3909,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
      while (((NXT(0) != limit) && /* checked */
              (IS_CHAR(c)) && (c != '<')) &&
              (ctxt->instate != XML_PARSER_EOF)) {
@@ -297,10 +279,10 @@ index 93f031be..79479979 100644
 -                           "AttValue length too long\n");
 -            goto mem_error;
 -        }
+ 	if (c == 0) break;
  	if (c == '&') {
  	    in_space = 0;
- 	    if (NXT(1) == '#') {
-@@ -4093,6 +4105,11 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
+@@ -4041,6 +4054,11 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
  	}
  	GROW;
  	c = CUR_CHAR(l);
@@ -312,13 +294,13 @@ index 93f031be..79479979 100644
      }
      if (ctxt->instate == XML_PARSER_EOF)
          goto error;
-@@ -4114,16 +4131,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
+@@ -4062,16 +4080,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
      } else
  	NEXT;
  
 -    /*
 -     * There we potentially risk an overflow, don't allow attribute value of
--     * length more than INT_MAX it is a very reasonable assumption !
+-     * length more than INT_MAX it is a very reasonnable assumption !
 -     */
 -    if (len >= INT_MAX) {
 -        xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
@@ -329,7 +311,7 @@ index 93f031be..79479979 100644
      if (attlen != NULL) *attlen = (int) len;
      return(buf);
  
-@@ -4194,6 +4201,9 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {
+@@ -4142,6 +4150,9 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {
      int len = 0;
      int size = XML_PARSER_BUFFER_SIZE;
      int cur, l;
@@ -339,7 +321,7 @@ index 93f031be..79479979 100644
      xmlChar stop;
      int state = ctxt->instate;
      int count = 0;
-@@ -4221,13 +4231,6 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {
+@@ -4169,13 +4180,6 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {
  	if (len + 5 >= size) {
  	    xmlChar *tmp;
  
@@ -353,7 +335,7 @@ index 93f031be..79479979 100644
  	    size *= 2;
  	    tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
  	    if (tmp == NULL) {
-@@ -4256,6 +4259,12 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {
+@@ -4203,6 +4207,12 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {
  	    SHRINK;
  	    cur = CUR_CHAR(l);
  	}
@@ -366,7 +348,7 @@ index 93f031be..79479979 100644
      }
      buf[len] = 0;
      ctxt->instate = (xmlParserInputState) state;
-@@ -4283,6 +4292,9 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {
+@@ -4230,6 +4240,9 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {
      xmlChar *buf = NULL;
      int len = 0;
      int size = XML_PARSER_BUFFER_SIZE;
@@ -376,7 +358,7 @@ index 93f031be..79479979 100644
      xmlChar cur;
      xmlChar stop;
      int count = 0;
-@@ -4310,12 +4322,6 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {
+@@ -4257,12 +4270,6 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {
  	if (len + 1 >= size) {
  	    xmlChar *tmp;
  
@@ -389,7 +371,7 @@ index 93f031be..79479979 100644
  	    size *= 2;
  	    tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
  	    if (tmp == NULL) {
-@@ -4343,6 +4349,11 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {
+@@ -4289,6 +4296,11 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {
  	    SHRINK;
  	    cur = CUR;
  	}
@@ -401,7 +383,7 @@ index 93f031be..79479979 100644
      }
      buf[len] = 0;
      if (cur != stop) {
-@@ -4742,6 +4753,9 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,
+@@ -4686,6 +4698,9 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,
      int r, rl;
      int cur, l;
      size_t count = 0;
@@ -411,7 +393,7 @@ index 93f031be..79479979 100644
      int inputid;
  
      inputid = ctxt->input->id;
-@@ -4787,13 +4801,6 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,
+@@ -4731,13 +4746,6 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,
  	if ((r == '-') && (q == '-')) {
  	    xmlFatalErr(ctxt, XML_ERR_HYPHEN_IN_COMMENT, NULL);
  	}
@@ -425,7 +407,7 @@ index 93f031be..79479979 100644
  	if (len + 5 >= size) {
  	    xmlChar *new_buf;
              size_t new_size;
-@@ -4831,6 +4838,13 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,
+@@ -4774,6 +4782,13 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,
  	    GROW;
  	    cur = CUR_CHAR(l);
  	}
@@ -439,7 +421,7 @@ index 93f031be..79479979 100644
      }
      buf[len] = 0;
      if (cur == 0) {
-@@ -4875,6 +4889,9 @@ xmlParseComment(xmlParserCtxtPtr ctxt) {
+@@ -4818,6 +4833,9 @@ xmlParseComment(xmlParserCtxtPtr ctxt) {
      xmlChar *buf = NULL;
      size_t size = XML_PARSER_BUFFER_SIZE;
      size_t len = 0;
@@ -449,7 +431,7 @@ index 93f031be..79479979 100644
      xmlParserInputState state;
      const xmlChar *in;
      size_t nbchar = 0;
-@@ -4958,8 +4975,7 @@ get_more:
+@@ -4901,8 +4919,7 @@ get_more:
  		buf[len] = 0;
  	    }
  	}
@@ -459,7 +441,7 @@ index 93f031be..79479979 100644
              xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
                           "Comment too big found", NULL);
              xmlFree (buf);
-@@ -5159,6 +5175,9 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {
+@@ -5098,6 +5115,9 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {
      xmlChar *buf = NULL;
      size_t len = 0;
      size_t size = XML_PARSER_BUFFER_SIZE;
@@ -469,7 +451,7 @@ index 93f031be..79479979 100644
      int cur, l;
      const xmlChar *target;
      xmlParserInputState state;
-@@ -5234,14 +5253,6 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {
+@@ -5172,14 +5192,6 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {
                          return;
                      }
  		    count = 0;
@@ -484,7 +466,7 @@ index 93f031be..79479979 100644
  		}
  		COPY_BUF(l,buf,len,cur);
  		NEXTL(l);
-@@ -5251,15 +5262,14 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {
+@@ -5189,15 +5201,14 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {
  		    GROW;
  		    cur = CUR_CHAR(l);
  		}
@@ -507,7 +489,7 @@ index 93f031be..79479979 100644
  	    buf[len] = 0;
  	    if (cur != '?') {
  		xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,
-@@ -8954,6 +8964,9 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
+@@ -8851,6 +8862,9 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
      const xmlChar *in = NULL, *start, *end, *last;
      xmlChar *ret = NULL;
      int line, col;
@@ -517,27 +499,27 @@ index 93f031be..79479979 100644
  
      GROW;
      in = (xmlChar *) CUR_PTR;
-@@ -8993,8 +9006,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
- 	    start = in;
- 	    if (in >= end) {
-                 GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end)
+@@ -8906,8 +8920,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
+ 		    in = in + delta;
+ 		}
+ 		end = ctxt->input->end;
 -                if (((in - start) > XML_MAX_TEXT_LENGTH) &&
 -                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {
 +                if ((in - start) > maxLength) {
                      xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
                                     "AttValue length too long\n");
                      return(NULL);
-@@ -9007,8 +9019,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
- 	    if ((*in++ == 0x20) && (*in == 0x20)) break;
- 	    if (in >= end) {
-                 GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end)
+@@ -8929,8 +8942,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
+ 		    in = in + delta;
+ 		}
+ 		end = ctxt->input->end;
 -                if (((in - start) > XML_MAX_TEXT_LENGTH) &&
 -                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {
 +                if ((in - start) > maxLength) {
                      xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
                                     "AttValue length too long\n");
                      return(NULL);
-@@ -9041,16 +9052,14 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
+@@ -8963,16 +8975,14 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
  		    last = last + delta;
  		}
  		end = ctxt->input->end;
@@ -556,17 +538,17 @@ index 93f031be..79479979 100644
              xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
                             "AttValue length too long\n");
              return(NULL);
-@@ -9063,8 +9072,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
- 	    col++;
- 	    if (in >= end) {
-                 GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end)
+@@ -8994,8 +9004,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
+ 		    in = in + delta;
+ 		}
+ 		end = ctxt->input->end;
 -                if (((in - start) > XML_MAX_TEXT_LENGTH) &&
 -                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {
 +                if ((in - start) > maxLength) {
                      xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
                                     "AttValue length too long\n");
                      return(NULL);
-@@ -9072,8 +9080,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
+@@ -9003,8 +9012,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
  	    }
  	}
  	last = in;
@@ -576,7 +558,7 @@ index 93f031be..79479979 100644
              xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
                             "AttValue length too long\n");
              return(NULL);
-@@ -9763,6 +9770,9 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {
+@@ -9711,6 +9719,9 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {
      int	s, sl;
      int cur, l;
      int count = 0;
@@ -586,7 +568,7 @@ index 93f031be..79479979 100644
  
      /* Check 2.6.0 was NXT(0) not RAW */
      if (CMP9(CUR_PTR, '<', '!', '[', 'C', 'D', 'A', 'T', 'A', '[')) {
-@@ -9796,13 +9806,6 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {
+@@ -9744,13 +9755,6 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {
  	if (len + 5 >= size) {
  	    xmlChar *tmp;
  
@@ -600,7 +582,7 @@ index 93f031be..79479979 100644
  	    tmp = (xmlChar *) xmlRealloc(buf, size * 2 * sizeof(xmlChar));
  	    if (tmp == NULL) {
  	        xmlFree(buf);
-@@ -9829,6 +9832,12 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {
+@@ -9776,6 +9780,12 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {
  	}
  	NEXTL(l);
  	cur = CUR_CHAR(l);
@@ -614,5 +596,5 @@ index 93f031be..79479979 100644
      buf[len] = 0;
      ctxt->instate = XML_PARSER_CONTENT;
 -- 
-GitLab
+2.39.0
 

SOURCES/libxml2-2.9.7-CVE-2022-40304.patch

@@ -1,8 +1,7 @@
-From 1b41ec4e9433b05bb0376be4725804c54ef1d80b Mon Sep 17 00:00:00 2001
+From a8fa5f7b5c3c745397b3178405d6be9fdb3cfcbc Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Wed, 31 Aug 2022 22:11:25 +0200
-Subject: [PATCH] [CVE-2022-40304] Fix dict corruption caused by entity
- reference cycles
+Subject: [PATCH 2/2] Fix dict corruption caused by entity reference cycles
 
 When an entity reference cycle is detected, the entity content is
 cleared by setting its first byte to zero. But the entity content might
@@ -21,10 +20,10 @@ Zero for the report!
  1 file changed, 16 insertions(+), 39 deletions(-)
 
 diff --git a/entities.c b/entities.c
-index 84435515..d4e5412e 100644
+index c8193376..3bf1c3ce 100644
 --- a/entities.c
 +++ b/entities.c
-@@ -128,36 +128,19 @@ xmlFreeEntity(xmlEntityPtr entity)
+@@ -112,36 +112,19 @@ xmlFreeEntity(xmlEntityPtr entity)
      if ((entity->children) && (entity->owner == 1) &&
          (entity == (xmlEntityPtr) entity->children->parent))
          xmlFreeNodeList(entity->children);
@@ -74,7 +73,7 @@ index 84435515..d4e5412e 100644
      xmlFree(entity);
  }
  
-@@ -193,18 +176,12 @@ xmlCreateEntity(xmlDictPtr dict, const xmlChar *name, int type,
+@@ -177,18 +160,12 @@ xmlCreateEntity(xmlDictPtr dict, const xmlChar *name, int type,
  	    ret->SystemID = xmlStrdup(SystemID);
      } else {
          ret->name = xmlDictLookup(dict, name, -1);
@@ -97,5 +96,5 @@ index 84435515..d4e5412e 100644
          ret->length = 0;
          ret->content = NULL;
 -- 
-GitLab
+2.39.0
 

SOURCES/libxml2-2.9.7-CVE-2023-29469.patch

@@ -1,4 +1,4 @@
-From 09a2dd453007f9c7205274623acdd73747c22d64 Mon Sep 17 00:00:00 2001
+From a40db8fde759261b042138646da36c632a739f31 Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Fri, 7 Apr 2023 11:49:27 +0200
 Subject: [PATCH] [CVE-2023-29469] Hashing of empty dict strings isn't
@@ -14,24 +14,29 @@ have an impact on security.
 Found by OSS-Fuzz.
 
 Fixes #510.
+
+Incorporates change from commit
+09a2dd453007f9c7205274623acdd73747c22d64.
 ---
- dict.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
+ dict.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/dict.c b/dict.c
-index c29d2af7..12ba94fd 100644
+index 0ef3718d..5e84cfca 100644
 --- a/dict.c
 +++ b/dict.c
-@@ -453,7 +453,8 @@ static unsigned long
+@@ -444,8 +444,9 @@ static unsigned long
  xmlDictComputeFastKey(const xmlChar *name, int namelen, int seed) {
      unsigned long value = seed;
  
 -    if (name == NULL) return(0);
+-    value = *name;
 +    if ((name == NULL) || (namelen <= 0))
 +        return(value);
-     value += *name;
++    value += *name;
      value <<= 5;
      if (namelen > 10) {
+         value += name[namelen - 1];
 -- 
-GitLab
+2.41.0
 

SOURCES/libxml2-2.9.7-CVE-2024-25062.patch

@@ -1,4 +1,4 @@
-From 2b0aac140d739905c7848a42efc60bfe783a39b7 Mon Sep 17 00:00:00 2001
+From b9d4ab2fd6b7da380edab777a0414ef254804f0d Mon Sep 17 00:00:00 2001
 From: Nick Wellnhofer <wellnhofer@aevum.de>
 Date: Sat, 14 Oct 2023 22:45:54 +0200
 Subject: [PATCH] [CVE-2024-25062] xmlreader: Don't expand XIncludes when
@@ -13,17 +13,17 @@ Fixes #604.
  1 file changed, 1 insertion(+)
 
 diff --git a/xmlreader.c b/xmlreader.c
-index 979385a13..fefd68e0b 100644
+index 34c4c6bc..8f2f9131 100644
 --- a/xmlreader.c
 +++ b/xmlreader.c
-@@ -1443,6 +1443,7 @@ node_found:
+@@ -1511,6 +1511,7 @@ node_found:
       * Handle XInclude if asked for
       */
-     if ((reader->xinclude) && (reader->in_xinclude == 0) &&
+     if ((reader->xinclude) && (reader->node != NULL) &&
 +        (reader->state != XML_TEXTREADER_BACKTRACK) &&
-         (reader->node != NULL) &&
  	(reader->node->type == XML_ELEMENT_NODE) &&
  	(reader->node->ns != NULL) &&
+ 	((xmlStrEqual(reader->node->ns->href, XINCLUDE_NS)) ||
 -- 
-GitLab
+2.44.0
 

SOURCES/libxml2-CVE-2016-9597.patch

@@ -0,0 +1,191 @@
+Make the XML entity recursion check more precise.
+
+libxml doesn't detect entity recursion specifically but has a variety
+of related checks, such as entities not expanding too deeply or
+producing exponential blow-ups in content.
+
+Because entity declarations are parsed in a separate context with
+their own element recursion budget, a recursive entity can overflow
+the stack using a lot of open elements (but within the per-context
+limit) as it slowly consumes (but does not exhaust) the entity depth
+budget.
+
+This adds a specific, precise check for recursive entities that
+detects entity recursion specifically and fails immediately.
+
+The existing entity expansion depth checks are still relevant for long
+chains of different entities.
+
+BUG=628581
+
+Review-Url: https://codereview.chromium.org/2539003002
+Cr-Commit-Position: refs/heads/master@{#436899}
+
+
+Index: libxml2-2.9.4/entities.c
+===================================================================
+--- libxml2-2.9.4.orig/entities.c
++++ libxml2-2.9.4/entities.c
+@@ -159,6 +159,7 @@ xmlCreateEntity(xmlDictPtr dict, const x
+     memset(ret, 0, sizeof(xmlEntity));
+     ret->type = XML_ENTITY_DECL;
+     ret->checked = 0;
++    ret->guard = XML_ENTITY_NOT_BEING_CHECKED;
+ 
+     /*
+      * fill the structure.
+@@ -931,6 +932,7 @@ xmlCopyEntity(xmlEntityPtr ent) {
+ 	cur->orig = xmlStrdup(ent->orig);
+     if (ent->URI != NULL)
+ 	cur->URI = xmlStrdup(ent->URI);
++    cur->guard = 0;
+     return(cur);
+ }
+ 
+Index: libxml2-2.9.4/include/libxml/entities.h
+===================================================================
+--- libxml2-2.9.4.orig/include/libxml/entities.h
++++ libxml2-2.9.4/include/libxml/entities.h
+@@ -30,6 +30,11 @@ typedef enum {
+     XML_INTERNAL_PREDEFINED_ENTITY = 6
+ } xmlEntityType;
+ 
++typedef enum {
++  XML_ENTITY_NOT_BEING_CHECKED,
++  XML_ENTITY_BEING_CHECKED              /* entity check is in progress */
++} xmlEntityRecursionGuard;
++
+ /*
+  * An unit of storage for an entity, contains the string, the value
+  * and the linkind data needed for the linking in the hash table.
+@@ -60,6 +65,7 @@ struct _xmlEntity {
+ 					/* this is also used to count entities
+ 					 * references done from that entity
+ 					 * and if it contains '<' */
++     xmlEntityRecursionGuard guard;
+ };
+ 
+ /*
+Index: libxml2-2.9.4/parser.c
+===================================================================
+--- libxml2-2.9.4.orig/parser.c
++++ libxml2-2.9.4/parser.c
+@@ -133,6 +133,10 @@ xmlParserEntityCheck(xmlParserCtxtPtr ct
+     if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+         return (1);
+ 
++	if ((ent != NULL) && (ent->guard == XML_ENTITY_BEING_CHECKED)) {
++        xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
++        return (1);
++    }
+     /*
+      * This may look absurd but is needed to detect
+      * entities problems
+@@ -143,12 +147,14 @@ xmlParserEntityCheck(xmlParserCtxtPtr ct
+ 	unsigned long oldnbent = ctxt->nbentities;
+ 	xmlChar *rep;
+ 
++    ent->guard = XML_ENTITY_BEING_CHECKED;
+ 	ent->checked = 1;
+ 
+         ++ctxt->depth;
+ 	rep = xmlStringDecodeEntities(ctxt, ent->content,
+ 				  XML_SUBSTITUTE_REF, 0, 0, 0);
+         --ctxt->depth;
++	ent->guard = XML_ENTITY_NOT_BEING_CHECKED;
+ 	if (ctxt->errNo == XML_ERR_ENTITY_LOOP) {
+ 	    ent->content[0] = 0;
+ 	}
+@@ -7337,23 +7343,28 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
+ 	 * if its replacement text matches the production labeled
+ 	 * content.
+ 	 */
+-	if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
+-	    ctxt->depth++;
+-	    ret = xmlParseBalancedChunkMemoryInternal(ctxt, ent->content,
+-	                                              user_data, &list);
+-	    ctxt->depth--;
+-
+-	} else if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
+-	    ctxt->depth++;
+-	    ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt, ctxt->sax,
+-	                                   user_data, ctxt->depth, ent->URI,
+-					   ent->ExternalID, &list);
+-	    ctxt->depth--;
+-	} else {
+-	    ret = XML_ERR_ENTITY_PE_INTERNAL;
+-	    xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
+-			 "invalid entity type found\n", NULL);
+-	}
++    if (ent->guard == XML_ENTITY_BEING_CHECKED) {
++        ret = XML_ERR_ENTITY_LOOP;
++    } else {
++        ent->guard = XML_ENTITY_BEING_CHECKED;
++        if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
++            ctxt->depth++;
++            ret = xmlParseBalancedChunkMemoryInternal(ctxt, ent->content,
++                                                      user_data, &list);
++            ctxt->depth--;
++        } else if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
++            ctxt->depth++;
++            ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt, ctxt->sax,
++                                           user_data, ctxt->depth, ent->URI,
++                                           ent->ExternalID, &list);
++            ctxt->depth--;
++        } else {
++            ret = XML_ERR_ENTITY_PE_INTERNAL;
++            xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
++                         "invalid entity type found\n", NULL);
++        }
++        ent->guard = XML_ENTITY_NOT_BEING_CHECKED;
++    }
+ 
+ 	/*
+ 	 * Store the number of entities needing parsing for this entity
+@@ -7456,23 +7467,29 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
+ 	    else
+ 		user_data = ctxt->userData;
+ 
+-	    if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
+-		ctxt->depth++;
+-		ret = xmlParseBalancedChunkMemoryInternal(ctxt,
+-				   ent->content, user_data, NULL);
+-		ctxt->depth--;
+-	    } else if (ent->etype ==
+-		       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
+-		ctxt->depth++;
+-		ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt,
+-			   ctxt->sax, user_data, ctxt->depth,
+-			   ent->URI, ent->ExternalID, NULL);
+-		ctxt->depth--;
+-	    } else {
+-		ret = XML_ERR_ENTITY_PE_INTERNAL;
+-		xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
+-			     "invalid entity type found\n", NULL);
+-	    }
++        if (ent->guard == XML_ENTITY_BEING_CHECKED) {
++            ret = XML_ERR_ENTITY_LOOP;
++        } else {
++            ent->guard = XML_ENTITY_BEING_CHECKED;
++            if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
++                ctxt->depth++;
++                ret = xmlParseBalancedChunkMemoryInternal(ctxt,
++                                   ent->content, user_data, NULL);
++                ctxt->depth--;
++            } else if (ent->etype ==
++                       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
++                ctxt->depth++;
++                ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt,
++                           ctxt->sax, user_data, ctxt->depth,
++                           ent->URI, ent->ExternalID, NULL);
++                ctxt->depth--;
++            } else {
++                ret = XML_ERR_ENTITY_PE_INTERNAL;
++                xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
++                             "invalid entity type found\n", NULL);
++            }
++            ent->guard = XML_ENTITY_NOT_BEING_CHECKED;
++        }
+ 	    if (ret == XML_ERR_ENTITY_LOOP) {
+ 		xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+ 		return;

SOURCES/libxml2-CVE-2018-14404.patch

@@ -0,0 +1,54 @@
+From a436374994c47b12d5de1b8b1d191a098fa23594 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Mon, 30 Jul 2018 12:54:38 +0200
+Subject: [PATCH] Fix nullptr deref with XPath logic ops
+
+If the XPath stack is corrupted, for example by a misbehaving extension
+function, the "and" and "or" XPath operators could dereference NULL
+pointers. Check that the XPath stack isn't empty and optimize the
+logic operators slightly.
+
+Closes: https://gitlab.gnome.org/GNOME/libxml2/issues/5
+
+Also see
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817
+https://bugzilla.redhat.com/show_bug.cgi?id=1595985
+
+This is CVE-2018-14404.
+
+Thanks to Guy Inbar for the report.
+---
+ xpath.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/xpath.c b/xpath.c
+index 3fae0bf4..5e3bb9ff 100644
+--- a/xpath.c
++++ b/xpath.c
+@@ -13234,9 +13234,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
+ 		return(0);
+ 	    }
+             xmlXPathBooleanFunction(ctxt, 1);
+-            arg1 = valuePop(ctxt);
+-            arg1->boolval &= arg2->boolval;
+-            valuePush(ctxt, arg1);
++            if (ctxt->value != NULL)
++                ctxt->value->boolval &= arg2->boolval;
+ 	    xmlXPathReleaseObject(ctxt->context, arg2);
+             return (total);
+         case XPATH_OP_OR:
+@@ -13252,9 +13251,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
+ 		return(0);
+ 	    }
+             xmlXPathBooleanFunction(ctxt, 1);
+-            arg1 = valuePop(ctxt);
+-            arg1->boolval |= arg2->boolval;
+-            valuePush(ctxt, arg1);
++            if (ctxt->value != NULL)
++                ctxt->value->boolval |= arg2->boolval;
+ 	    xmlXPathReleaseObject(ctxt->context, arg2);
+             return (total);
+         case XPATH_OP_EQUAL:
+-- 
+2.22.0
+

SOURCES/libxml2-CVE-2018-9251.patch

@@ -0,0 +1,50 @@
+From 2240fbf5912054af025fb6e01e26375100275e74 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Mon, 30 Jul 2018 13:14:11 +0200
+Subject: [PATCH] Fix infinite loop in LZMA decompression
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Check the liblzma error code more thoroughly to avoid infinite loops.
+
+Closes: https://gitlab.gnome.org/GNOME/libxml2/issues/13
+Closes: https://bugzilla.gnome.org/show_bug.cgi?id=794914
+
+This is CVE-2018-9251 and CVE-2018-14567.
+
+Thanks to Dongliang Mu and Simon Wörner for the reports.
+---
+ xzlib.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/xzlib.c b/xzlib.c
+index a839169e..0ba88cfa 100644
+--- a/xzlib.c
++++ b/xzlib.c
+@@ -562,6 +562,10 @@ xz_decomp(xz_statep state)
+                          "internal error: inflate stream corrupt");
+                 return -1;
+             }
++            /*
++             * FIXME: Remapping a couple of error codes and falling through
++             * to the LZMA error handling looks fragile.
++             */
+             if (ret == Z_MEM_ERROR)
+                 ret = LZMA_MEM_ERROR;
+             if (ret == Z_DATA_ERROR)
+@@ -587,6 +591,11 @@ xz_decomp(xz_statep state)
+             xz_error(state, LZMA_PROG_ERROR, "compression error");
+             return -1;
+         }
++        if ((state->how != GZIP) &&
++            (ret != LZMA_OK) && (ret != LZMA_STREAM_END)) {
++            xz_error(state, ret, "lzma error");
++            return -1;
++        }
+     } while (strm->avail_out && ret != LZMA_STREAM_END);
+ 
+     /* update available output and crc check value */
+-- 
+2.22.0
+

SOURCES/libxml2-CVE-2019-19956.patch

@@ -0,0 +1,33 @@
+From 5a02583c7e683896d84878bd90641d8d9b0d0549 Mon Sep 17 00:00:00 2001
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Wed, 7 Aug 2019 17:39:17 +0800
+Subject: [PATCH] Fix memory leak in xmlParseBalancedChunkMemoryRecover
+
+When doc is NULL, namespace created in xmlTreeEnsureXMLDecl
+is bind to newDoc->oldNs, in this case, set newDoc->oldNs to
+NULL and free newDoc will cause a memory leak.
+
+Found with libFuzzer.
+
+Closes #82.
+---
+ parser.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index 1ce1ccf1..26d9f4e3 100644
+--- a/parser.c
++++ b/parser.c
+@@ -13894,7 +13894,8 @@ xmlParseBalancedChunkMemoryRecover(xmlDocPtr doc, xmlSAXHandlerPtr sax,
+     xmlFreeParserCtxt(ctxt);
+     newDoc->intSubset = NULL;
+     newDoc->extSubset = NULL;
+-    newDoc->oldNs = NULL;
++    if(doc != NULL)
++	newDoc->oldNs = NULL;
+     xmlFreeDoc(newDoc);
+ 
+     return(ret);
+-- 
+2.24.1
+

SOURCES/libxml2-multilib.patch

@@ -6,9 +6,9 @@
   exec_prefix=@exec_prefix@
   includedir=@includedir@
 ! libdir=@libdir@
-  cflags=
-  libs=
   
+  usage()
+  {
 --- 3,14 ----
   prefix=@prefix@
   exec_prefix=@exec_prefix@
@@ -19,6 +19,6 @@
 ! else
 !     libdir=${exec_prefix}/lib64
 ! fi
-  cflags=
-  libs=
   
+  usage()
+  {

SPECS/libxml2.spec

@@ -1,33 +1,72 @@
+%if 0%{?rhel} > 7
+# Disable python2 build by default
+%bcond_with python2
+%else
+%bcond_without python2
+%endif
+
 Name:           libxml2
-Version:        2.9.13
-Release:        6%{?dist}
+Version:        2.9.7
+Release:        18%{?dist}.1
 Summary:        Library providing XML and HTML support
 
 License:        MIT
 URL:            http://xmlsoft.org/
-Source0:        https://download.gnome.org/sources/%{name}/2.9/%{name}-%{version}.tar.xz
+Source:         ftp://xmlsoft.org/libxml2/libxml2-%{version}.tar.gz
 Patch0:         libxml2-multilib.patch
-# Patch from openSUSE.
-# See:  https://bugzilla.gnome.org/show_bug.cgi?id=789714
-Patch1:         libxml2-2.9.8-python3-unicode-errors.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2082300
-Patch2:         libxml2-2.9.13-CVE-2022-29824.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2136564
-Patch3:         libxml2-2.9.13-CVE-2022-40303.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2136569
-Patch4:         libxml2-2.9.13-CVE-2022-40304.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=2186694
-Patch5:         libxml2-2.9.13-CVE-2023-28484.patch
-Patch6:         libxml2-2.9.13-CVE-2023-28484.2.patch
-Patch7:         libxml2-2.9.13-CVE-2023-29469.patch
-# https://issues.redhat.com/browse/RHEL-5180
-Patch8:         libxml2-2.11.0-fix-CVE-2023-39615.patch
-# https://issues.redhat.com/browse/RHEL-34457
-Patch9:         libxml2-2.11.6-CVE-2024-25062.patch
+# workaround for #877567 - Very weird bug gzip decompression bug in "recent" libxml2 versions
+Patch1:         libxml2-2.9.0-do-not-check-crc.patch
+# In python3.6 _PyVerify_fd is no more
+#  http://bugs.python.org/issue23524
+Patch2:         libxml2-2.9.4-remove-pyverify_fd.patch
+# https://codereview.chromium.org/2539003002
+Patch3:         libxml2-CVE-2016-9597.patch
+# Fix some crashes under Python 3
+# https://bugzilla.gnome.org/show_bug.cgi?id=789714
+Patch4:         libxml2-python3-unicode-errors.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1565322
+Patch5:         libxml2-CVE-2018-9251.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1595989
+Patch6:         libxml2-CVE-2018-14404.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1793001
+Patch7:         libxml2-CVE-2019-19956.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1799786
+Patch8:         libxml2-2.9.7-CVE-2020-7595.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1810058
+Patch9:         libxml2-2.9.7-CVE-2019-20388.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1878252
+Patch10:        libxml2-2.9.7-CVE-2020-24977.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1956976
+Patch11:        libxml2-2.9.7-CVE-2021-3516.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1957001
+Patch12:        libxml2-2.9.7-CVE-2021-3517.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1957028
+Patch13:        libxml2-2.9.7-CVE-2021-3518.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1957284
+Patch14:        libxml2-2.9.7-CVE-2021-3537.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1958783
+Patch15:        libxml2-2.9.7-CVE-2021-3541.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2057664
+Patch16:        libxml2-2.9.7-CVE-2022-23308.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2082298
+Patch17:        libxml2-2.9.7-CVE-2022-29824.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2120781
+Patch18:        libxml2-2.9.7-CVE-2016-3709.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2136563
+Patch19:        libxml2-2.9.7-CVE-2022-40303.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2136568
+Patch20:        libxml2-2.9.7-CVE-2022-40304.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2186692
+Patch21:         libxml2-2.9.13-CVE-2023-28484.patch
+Patch22:         libxml2-2.9.13-CVE-2023-28484.2.patch
+Patch23:         libxml2-2.9.7-CVE-2023-29469.patch
+# https://issues.redhat.com/browse/RHEL-5179
+Patch24:         libxml2-2.11.0-fix-CVE-2023-39615.patch
+# https://issues.redhat.com/browse/RHEL-31056
+Patch25:         libxml2-2.9.7-CVE-2024-25062.patch
 
-BuildRequires:  cmake-rpm-macros
 BuildRequires:  gcc
-BuildRequires:  make
+BuildRequires:  cmake-rpm-macros
 BuildRequires:  pkgconfig(zlib)
 BuildRequires:  pkgconfig(liblzma)
 
@@ -67,6 +106,26 @@ Summary:        Static library for libxml2
 Static library for libxml2 provided for specific uses or shaving a few
 microseconds when parsing, do not link to them for generic purpose packages.
 
+%if %{with python2}
+%package -n python2-%{name}
+%{?python_provide:%python_provide python2-%{name}}
+Summary:        Python bindings for the libxml2 library
+BuildRequires:  python2-devel
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+Obsoletes:      %{name}-python < %{version}-%{release}
+Provides:       %{name}-python = %{version}-%{release}
+
+%description -n python2-%{name}
+The libxml2-python package contains a Python 2 module that permits applications
+written in the Python programming language, version 2, to use the interface
+supplied by the libxml2 library to manipulate XML files.
+
+This library allows to manipulate XML files. It includes support
+to read, modify and write XML and HTML files. There is DTDs support
+this includes parsing and validation even with complex DTDs, either
+at parse time or later once the document has been modified.
+%endif # with python2
+
 %package -n python3-%{name}
 Summary:        Python 3 bindings for the libxml2 library
 BuildRequires:  python3-devel
@@ -88,15 +147,27 @@ at parse time or later once the document has been modified.
 %autosetup -p1
 find doc -type f -executable -print -exec chmod 0644 {} ';'
 
-# Remove files generated by python/generator.py to force regenerating them
-rm python/{libxml2-py.c,libxml2-py.h,libxml2-export.c}
-
 %build
-%configure --with-python=%{__python3}
-%make_build
+%if %{with python2}
+mkdir py2
+%endif # with python2
+mkdir py3
+%global _configure ../configure
+%global _configure_disable_silent_rules 1
+%if %{with python2}
+( cd py2 && %configure --cache-file=../config.cache --with-python=%{__python2} )
+%endif # with python2
+( cd py3 && %configure --cache-file=../config.cache --with-python=%{__python3} )
+%if %{with python2}
+%make_build -C py2
+%endif # with python2
+%make_build -C py3
 
 %install
-%make_install
+%if %{with python2}
+%make_install -C py2
+%endif # with python2
+%make_install -C py3
 
 # multiarch crazyness on timestamp differences or Makefile/binaries for examples
 touch -m --reference=%{buildroot}%{_includedir}/libxml2/libxml/parser.h %{buildroot}%{_bindir}/xml2-config
@@ -104,17 +175,20 @@ touch -m --reference=%{buildroot}%{_includedir}/libxml2/libxml/parser.h %{buildr
 find %{buildroot} -type f -name '*.la' -print -delete
 rm -vf %{buildroot}{%{python2_sitearch},%{python3_sitearch}}/*.a
 rm -vrf %{buildroot}%{_datadir}/doc/
-(cd doc/examples ; make clean ; rm -rf .deps Makefile)
+#(cd doc/examples ; make clean ; rm -rf .deps Makefile)
 gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
 
 %check
-%make_build runtests
+%if %{with python2}
+%make_build runtests -C py2
+%endif # with python2
+%make_build runtests -C py3
 
 %ldconfig_scriptlets
 
 %files
 %license Copyright
-%doc NEWS README.md TODO
+%doc AUTHORS NEWS README TODO
 %{_libdir}/libxml2.so.2*
 %{_mandir}/man3/libxml.3*
 %{_bindir}/xmllint
@@ -142,6 +216,15 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
 %license Copyright
 %{_libdir}/libxml2.a
 
+%if %{with python2}
+%files -n python2-%{name}
+%doc python/TODO python/libxml2class.txt
+%doc doc/*.py doc/python.html
+%{python2_sitearch}/libxml2.py*
+%{python2_sitearch}/drv_libxml2.py*
+%{python2_sitearch}/libxml2mod.so
+%endif # with python2
+
 %files -n python3-%{name}
 %doc python/TODO python/libxml2class.txt
 %doc doc/*.py doc/python.html
@@ -152,117 +235,58 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
 %{python3_sitearch}/libxml2mod.so
 
 %changelog
-* Mon Apr 29 2024 David King <amigadave@amigadave.com> - 2.9.13-6
-- Fix CVE-2024-25062 (RHEL-29196)
+* Mon Apr 29 2024 David King <amigadave@amigadave.com> - 2.9.7-18.1
+- Fix CVE-2024-25062 (RHEL-31056)
 
-* Thu Sep 14 2023 David King <amigadave@amigadave.com> - 2.9.13-5
-- Fix CVE-2023-39615 (RHEL-5180)
+* Thu Sep 14 2023 David King <amigadave@amigadave.com> - 2.9.7-18
+- Fix CVE-2023-39615 (RHEL-5179)
 
-* Fri Apr 14 2023 David King <amigadave@amigadave.com> - 2.9.13-4
-- Fix CVE-2023-28484 (#2186694)
-- Fix CVE-2023-29469 (#2186694)
+* Fri Jul 14 2023 David King <amigadave@amigadave.com> - 2.9.7-17
+- Fix CVE-2023-28484 (#2186692)
+- Fix CVE-2023-29469 (#2186692)
 
-* Tue Nov 01 2022 David King <amigadave@amigadave.com> - 2.9.13-3
-- Fix CVE-2022-40303 (#2136564)
-- Fix CVE-2022-40304 (#2136569)
+* Wed Nov 02 2022 David King <dking@redhat.com> - 2.9.7-16
+- Fix CVE-2022-40303 (#2136563)
+- Fix CVE-2022-40304 (#2136568)
 
-* Tue May 10 2022 David King <amigadave@amigadave.com> - 2.9.13-2
-- Fix CVE-2022-29824 (#2082300)
+* Wed Aug 24 2022 David King <dking@redhat.com> - 2.9.7-15
+- Fix CVE-2016-3709 (#2120781)
 
-* Thu Feb 24 2022 David King <amigadave@amigadave.com> - 2.9.13-1
-- Update to 2.9.13 (#2057665)
+* Thu May 12 2022 David King <dking@redhat.com> - 2.9.7-14
+- Fix CVE-2022-29824 (#2082298)
 
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.9.12-4
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
+* Thu Feb 24 2022 David King <dking@redhat.com> - 2.9.7-13
+- Bump release (#2057664)
 
-* Wed Jun 09 2021 David King <dking@redhat.com> - 2.9.12-3
-- Fix xmlNodeDumpOutputInternal regression (#1969892)
+* Thu Feb 24 2022 David King <dking@redhat.com> - 2.9.7-12
+- Fix CVE-2022-23308 (#2057664)
 
-* Tue May 25 2021 David King <dking@redhat.com> - 2.9.12-2
-- Fix multiarch conflict in devel subpackage (#1964346)
+* Wed May 19 2021 David King <dking@redhat.com> - 2.9.7-11
+- Fix CVE-2021-3541 (#1958783)
 
-* Fri May 14 2021 David King <dking@redhat.com> - 2.9.12-1
-- Rebase to 2.9.12 (#1960623)
+* Fri May 07 2021 David King <dking@redhat.com> - 2.9.7-10
+- Fix CVE-2021-3516 (#1956976)
+- Fix CVE-2021-3517 (#1957001)
+- Fix CVE-2021-3518 (#1957028)
+- Fix CVE-2021-3537 (#1957284)
 
-* Thu May 13 2021 David King <dking@redhat.com> - 2.9.10-12
-- Fix CVE-2021-3516 (#1956969)
-- Fix CVE-2021-3517 (#1957002)
-- Fix CVE-2021-3518 (#1957029)
-- Fix CVE-2021-3537 (#1957285)
+* Mon Oct 19 2020 David King <dking@redhat.com> - 2.9.7-9
+- Fix CVE-2020-24977 (#1878252)
 
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.9.10-11
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.10-10
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Thu Nov 12 11:57:41 CET 2020 Victor Stinner <vstinner@python.org> - 2.9.10-9
-- Build the Python extension with the PY_SSIZE_T_CLEAN macro to make it
-  compatible with Python 3.10.
-- Fixes: rhbz#1890878.
-
-* Wed Nov 11 2020 Richard W.M. Jones <rjones@redhat.com> - 2.9.10-8
-- Add correct fix for CVE-2020-24977 (RHBZ#1877788), thanks: Jan de Groot.
-
-* Fri Sep 11 2020 Richard W.M. Jones <rjones@redhat.com> - 2.9.10-7
-- Add fix for CVE-2020-24977 (RHBZ#1877788).
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.10-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Sat May 23 2020 Miro Hrončok <mhroncok@redhat.com> - 2.9.10-5
-- Rebuilt for Python 3.9
-
-* Mon Feb 10 2020 David King <amigadave@amigadave.com> - 2.9.10-4
-- Fix CVE-2019-20388 (#1799736)
+* Mon Jan 20 2020 David King <dking@redhat.com> - 2.9.7-8
+- Fix CVE-2019-19956 (#1793001)
 - Fix CVE-2020-7595 (#1799786)
+- Fix CVE-2019-20388 (#1810058)
 
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.10-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+* Thu Oct 24 2019 David King <dking@redhat.com> - 2.9.7-7
+- Fix CVE-2018-14404 (#1595989)
 
-* Fri Jan 03 2020 Jan Pokorny <jpokorny@fedoraproject.org> - 2.9.10-2
-- Fix relaxed approach to nested documents on object disposal (#1780573)
+* Thu Oct 24 2019 David King <dking@redhat.com> - 2.9.7-6
+- Fix CVE-2018-9251 (#1565322)
 
-* Fri Nov 01 2019 David King <amigadave@amigadave.com> - 2.9.10-1
-- Update to 2.9.10 (#1767151)
-
-* Thu Oct 31 2019 Miro Hrončok <mhroncok@redhat.com> - 2.9.9-7
-- Subpackage python2-libxml2 has been removed
-  See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal
-
-* Thu Oct 03 2019 Miro Hrončok <mhroncok@redhat.com> - 2.9.9-6
-- Rebuilt for Python 3.8.0rc1 (#1748018)
-
-* Fri Aug 23 2019 Florian Weimer <fweimer@redhat.com> - 2.9.9-5
-- Rebuild to fix corrupted libxml2-static package on aarch64 (#1745020)
-
-* Fri Aug 16 2019 Miro Hrončok <mhroncok@redhat.com> - 2.9.9-4
-- Rebuilt for Python 3.8
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.9-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.9-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Fri Jan 25 2019 David King <amigadave@amigadave.com> - 2.9.9-1
-- Update to 2.9.9
-
-* Sun Jan 06 2019 Björn Esser <besser82@fedoraproject.org> - 2.9.8-5
-- Add patch to fix crash: xmlParserPrintFileContextInternal mangles utf8
-
-* Thu Aug 02 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.9.8-4
-- Backport patches from upstream
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.8-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 2.9.8-2
-- Rebuilt for Python 3.7
-
-* Tue Apr 03 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.9.8-1
-- Update to 2.9.8
+* Fri Aug 03 2018 Charalampos Stratakis <cstratak@redhat.com> - 2.9.7-5
+- Fix some crashes under Python 3
+- Conditionalize the python2 subpackage
 
 * Sat Feb 24 2018 Florian Weimer <fweimer@redhat.com> - 2.9.7-4
 - Rebuild with new LDFLAGS from redhat-rpm-config