diff --git a/.gitignore b/.gitignore index 855cff5..ef17489 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,4 @@ XML-LibXML-1.70.tar.gz /XML-LibXML-2.0128.tar.gz /XML-LibXML-2.0129.tar.gz /XML-LibXML-2.0130.tar.gz +/XML-LibXML-2.0131.tar.gz diff --git a/XML-LibXML-2.0129-CVE-2017-10672.patch b/XML-LibXML-2.0129-CVE-2017-10672.patch deleted file mode 100644 index dd7c702..0000000 --- a/XML-LibXML-2.0129-CVE-2017-10672.patch +++ /dev/null @@ -1,77 +0,0 @@ -diff -urN XML-LibXML-2.0129.orig/LibXML.xs XML-LibXML-2.0129/LibXML.xs ---- XML-LibXML-2.0129.orig/LibXML.xs 2016-06-24 18:01:53.000000000 +0200 -+++ XML-LibXML-2.0129/LibXML.xs 2017-07-13 12:41:48.000000000 +0200 -@@ -4829,38 +4829,42 @@ - PREINIT: - xmlNodePtr ret = NULL; - CODE: -- if ( self->type == XML_DOCUMENT_NODE ) { -- switch ( nNode->type ) { -- case XML_ELEMENT_NODE: -- warn("replaceChild with an element on a document node not supported yet!"); -- XSRETURN_UNDEF; -- break; -- case XML_DOCUMENT_FRAG_NODE: -- warn("replaceChild with a document fragment node on a document node not supported yet!"); -- XSRETURN_UNDEF; -- break; -- case XML_TEXT_NODE: -- case XML_CDATA_SECTION_NODE: -- warn("replaceChild with a text node not supported on a document node!"); -- XSRETURN_UNDEF; -- break; -- default: -- break; -- } -- } -- ret = domReplaceChild( self, nNode, oNode ); -- if (ret == NULL) { -- XSRETURN_UNDEF; -- } -- else { -- LibXML_reparent_removed_node(ret); -- RETVAL = PmmNodeToSv(ret, PmmOWNERPO(PmmPROXYNODE(ret))); -- if (nNode->type == XML_DTD_NODE) { -- LibXML_set_int_subset(nNode->doc, nNode); -+ if( nNode == oNode ) { -+ RETVAL = nNode; -+ }else{ -+ if ( self->type == XML_DOCUMENT_NODE ) { -+ switch ( nNode->type ) { -+ case XML_ELEMENT_NODE: -+ warn("replaceChild with an element on a document node not supported yet!"); -+ XSRETURN_UNDEF; -+ break; -+ case XML_DOCUMENT_FRAG_NODE: -+ warn("replaceChild with a document fragment node on a document node not supported yet!"); -+ XSRETURN_UNDEF; -+ break; -+ case XML_TEXT_NODE: -+ case XML_CDATA_SECTION_NODE: -+ warn("replaceChild with a text node not supported on a document node!"); -+ XSRETURN_UNDEF; -+ break; -+ default: -+ break; -+ } - } -- if ( nNode->_private != NULL ) { -- PmmFixOwner( PmmPROXYNODE(nNode), -- PmmOWNERPO(PmmPROXYNODE(self)) ); -+ ret = domReplaceChild( self, nNode, oNode ); -+ if (ret == NULL) { -+ XSRETURN_UNDEF; -+ } -+ else { -+ LibXML_reparent_removed_node(ret); -+ RETVAL = PmmNodeToSv(ret, PmmOWNERPO(PmmPROXYNODE(ret))); -+ if (nNode->type == XML_DTD_NODE) { -+ LibXML_set_int_subset(nNode->doc, nNode); -+ } -+ if ( nNode->_private != NULL ) { -+ PmmFixOwner( PmmPROXYNODE(nNode), -+ PmmOWNERPO(PmmPROXYNODE(self)) ); -+ } - } - } - OUTPUT: diff --git a/perl-XML-LibXML.spec b/perl-XML-LibXML.spec index bb53c5a..ef51d31 100644 --- a/perl-XML-LibXML.spec +++ b/perl-XML-LibXML.spec @@ -7,7 +7,7 @@ Name: perl-XML-LibXML # https://bugzilla.redhat.com/show_bug.cgi?id=469480 # it might not be needed anymore # this module is maintained, the other is not -Version: 2.0130 +Version: 2.0131 Release: 1%{?dist} Epoch: 1 Summary: Perl interface to the libxml2 library @@ -15,9 +15,6 @@ Group: Development/Libraries License: (GPL+ or Artistic) and MIT URL: http://search.cpan.org/dist/XML-LibXML/ Source0: http://search.cpan.org/CPAN/authors/id/S/SH/SHLOMIF/XML-LibXML-%{version}.tar.gz -# Fix CVE-2017-10672 (use-after-free by controlling the arguments to -# a replaceChild call), bug #1470205 -Patch0: XML-LibXML-2.0129-CVE-2017-10672.patch BuildRequires: coreutils BuildRequires: findutils BuildRequires: glibc-common @@ -96,7 +93,6 @@ validating XML parser and the high performance DOM implementation. %prep %setup -q -n XML-LibXML-%{version} -%patch0 -p1 chmod -x *.c for i in Changes; do /usr/bin/iconv -f iso8859-1 -t utf-8 $i > $i.conv && /bin/mv -f $i.conv $i @@ -140,6 +136,9 @@ fi %{_mandir}/man3/*.3* %changelog +* Wed Oct 25 2017 Jitka Plesnikova - 1:2.0131-1 +- 2.0131 bump + * Thu Oct 19 2017 Jitka Plesnikova - 1:2.0130-1 - 2.0130 bump diff --git a/sources b/sources index 00c5db8..0985da9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (XML-LibXML-2.0130.tar.gz) = 43d6a62021b7a2e9efddaa6c238a873ce4f7fb43ca2985e8ead8a0cab3a54d4efd764cbd027bd4b235b4ad9b525ad075607ef4d08a42839b054715a7f55dcd16 +SHA512 (XML-LibXML-2.0131.tar.gz) = 0e077c278aaeac495f3bf474b610af19377dbe00791157184a83c89905bbfae814fab300323a363902c6507e495cdaa22f55d95b3da42ed22bdf05f15248343f