- security patch: Invalid XPath Multiple Memory Corruption

- http://git.gnome.org/browse/libxml2/commit/?id=d7958b21e7f8c447a26bb2436f08402b2c308be4
- http://www.securityfocus.com/bid/48056/info

Changed files:
    libxml2-XPath.patch -> 1.1
    libxml2.spec -> 1.187

diff --git a/libxml2-XPath.patch b/libxml2-XPath.patch
new file mode 100644 (file)
index 0000000..ab39d25
--- /dev/null
+++ b/libxml2-XPath.patch
@@ -0,0 +1,88 @@
+diff --git a/xpath.c b/xpath.c
+index 8b56189..608fe00 100644
+--- a/xpath.c
++++ b/xpath.c
+@@ -3522,13 +3522,13 @@ xmlXPathNodeSetAddNs(xmlNodeSetPtr cur, xmlNodePtr node, xmlNsPtr ns) {
+     } else if (cur->nodeNr == cur->nodeMax) {
+         xmlNodePtr *temp;
+ 
+-        cur->nodeMax *= 2;
+-      temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
++      temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
+                                     sizeof(xmlNodePtr));
+       if (temp == NULL) {
+           xmlXPathErrMemory(NULL, "growing nodeset\n");
+           return;
+       }
++        cur->nodeMax *= 2;
+       cur->nodeTab = temp;
+     }
+     cur->nodeTab[cur->nodeNr++] = xmlXPathNodeSetDupNs(node, ns);
+@@ -3627,14 +3627,14 @@ xmlXPathNodeSetAddUnique(xmlNodeSetPtr cur, xmlNodePtr val) {
+     } else if (cur->nodeNr == cur->nodeMax) {
+         xmlNodePtr *temp;
+ 
+-        cur->nodeMax *= 2;
+-      temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
++      temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
+                                     sizeof(xmlNodePtr));
+       if (temp == NULL) {
+           xmlXPathErrMemory(NULL, "growing nodeset\n");
+           return;
+       }
+       cur->nodeTab = temp;
++        cur->nodeMax *= 2;
+     }
+     if (val->type == XML_NAMESPACE_DECL) {
+       xmlNsPtr ns = (xmlNsPtr) val;
+@@ -3738,14 +3738,14 @@ xmlXPathNodeSetMerge(xmlNodeSetPtr val1, xmlNodeSetPtr val2) {
+       } else if (val1->nodeNr == val1->nodeMax) {
+           xmlNodePtr *temp;
+ 
+-          val1->nodeMax *= 2;
+-          temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
++          temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
+                                            sizeof(xmlNodePtr));
+           if (temp == NULL) {
+               xmlXPathErrMemory(NULL, "merging nodeset\n");
+               return(NULL);
+           }
+           val1->nodeTab = temp;
++          val1->nodeMax *= 2;
+       }
+       if (n2->type == XML_NAMESPACE_DECL) {
+           xmlNsPtr ns = (xmlNsPtr) n2;
+@@ -3907,14 +3907,14 @@ xmlXPathNodeSetMergeAndClear(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
+           } else if (set1->nodeNr >= set1->nodeMax) {
+               xmlNodePtr *temp;
+ 
+-              set1->nodeMax *= 2;
+               temp = (xmlNodePtr *) xmlRealloc(
+-                  set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
++                  set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
+               if (temp == NULL) {
+                   xmlXPathErrMemory(NULL, "merging nodeset\n");
+                   return(NULL);
+               }
+               set1->nodeTab = temp;
++              set1->nodeMax *= 2;
+           }
+           if (n2->type == XML_NAMESPACE_DECL) {
+               xmlNsPtr ns = (xmlNsPtr) n2;
+@@ -3991,14 +3991,14 @@ xmlXPathNodeSetMergeAndClearNoDupls(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
+           } else if (set1->nodeNr >= set1->nodeMax) {
+               xmlNodePtr *temp;
+ 
+-              set1->nodeMax *= 2;
+               temp = (xmlNodePtr *) xmlRealloc(
+-                  set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
++                  set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
+               if (temp == NULL) {
+                   xmlXPathErrMemory(NULL, "merging nodeset\n");
+                   return(NULL);
+               }
+               set1->nodeTab = temp;
++              set1->nodeMax *= 2;
+           }
+           set1->nodeTab[set1->nodeNr++] = n2;
+       }

diff --git a/libxml2.spec b/libxml2.spec
index 4c6945f4287f6957d3537999227ac1973b727a6b..05ed00e0d83046495103892f38e1dd4c99ed470e 100644 (file)
--- a/libxml2.spec
+++ b/libxml2.spec
@@ -14,7 +14,7 @@ Summary(pl.UTF-8):    Biblioteka libXML wersja 2
 Summary(pt_BR.UTF-8):  Biblioteca libXML versão 2
 Name:          libxml2
 Version:       2.7.8
-Release:       1
+Release:       2
 Epoch:         1
 License:       MIT
 Group:         Libraries
@@ -26,6 +26,7 @@ Patch1:               %{name}-man_fixes.patch
 Patch2:                %{name}-open.gz.patch
 Patch3:                %{name}-largefile.patch
 Patch4:                %{name}-version-script.patch
+Patch5:                %{name}-XPath.patch
 URL:           http://xmlsoft.org/
 BuildRequires: autoconf >= 2.2
 BuildRequires: automake >= 1.4
@@ -146,6 +147,7 @@ Moduły języka Python dla biblioteki libxml2.
 %endif
 %patch3 -p1
 %patch4 -p1
+%patch5 -p1
 
 %build
 %{__libtoolize}