Package init
This commit is contained in:
overweight
commit
2363062f00
24
CVE-2018-20843.patch
Normal file
24
CVE-2018-20843.patch
Normal file
@ -0,0 +1,24 @@
|
||||
From 11f8838bf99ea0a6f0b76f9760c43704d00c4ff6 Mon Sep 17 00:00:00 2001
|
||||
From: Sebastian Pipping <sebastian@pipping.org>
|
||||
Date: Wed, 12 Jun 2019 15:42:22 +0200
|
||||
Subject: [PATCH] xmlparse.c: Fix extraction of namespace prefix from XML name
|
||||
(#186)
|
||||
|
||||
---
|
||||
expat/lib/xmlparse.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
|
||||
index c4f3ffc..f4506b0 100644
|
||||
--- a/lib/xmlparse.c
|
||||
+++ b/lib/xmlparse.c
|
||||
@@ -6080,7 +6080,7 @@ setElementTypePrefix(XML_Parser parser, ELEMENT_TYPE *elementType)
|
||||
else
|
||||
poolDiscard(&dtd->pool);
|
||||
elementType->prefix = prefix;
|
||||
-
|
||||
+ break;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
|
||||
112
CVE-2019-15903.patch
Normal file
112
CVE-2019-15903.patch
Normal file
@ -0,0 +1,112 @@
|
||||
From c20b758c332d9a13afbbb276d30db1d183a85d43 Mon Sep 17 00:00:00 2001
|
||||
From: Sebastian Pipping <sebastian@pipping.org>
|
||||
Date: Wed, 28 Aug 2019 00:24:59 +0200
|
||||
Subject: [PATCH 189/286] xmlparse.c: Deny internal entities closing the
|
||||
doctype
|
||||
|
||||
---
|
||||
expat/lib/xmlparse.c | 20 +++++++++++++-------
|
||||
1 file changed, 13 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
|
||||
index f4506b0..3df4347 100644
|
||||
--- a/lib/xmlparse.c
|
||||
+++ b/lib/xmlparse.c
|
||||
@@ -412,9 +412,10 @@ processXmlDecl(XML_Parser parser, int isGeneralTextEntity,
|
||||
static enum XML_Error
|
||||
initializeEncoding(XML_Parser parser);
|
||||
static enum XML_Error
|
||||
-doProlog(XML_Parser parser, const ENCODING *enc, const char *s,
|
||||
- const char *end, int tok, const char *next, const char **nextPtr,
|
||||
- XML_Bool haveMore);
|
||||
+doProlog(XML_Parser parser, const ENCODING *enc,
|
||||
+ const char *s, const char *end, int tok,
|
||||
+ const char *next, const char **nextPtr,
|
||||
+ XML_Bool haveMore, XML_Bool allowClosingDoctype);
|
||||
static enum XML_Error
|
||||
processInternalEntity(XML_Parser parser, ENTITY *entity,
|
||||
XML_Bool betweenDecl);
|
||||
@@ -4240,8 +4241,8 @@ externalParEntProcessor(XML_Parser parser,
|
||||
}
|
||||
|
||||
parser->m_processor = prologProcessor;
|
||||
- return doProlog(parser, parser->m_encoding, s, end, tok, next,
|
||||
- nextPtr, (XML_Bool)!parser->m_parsingStatus.finalBuffer);
|
||||
+ return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
|
||||
+ (XML_Bool)!parser->m_parsingStatus.finalBuffer, XML_TRUE);
|
||||
}
|
||||
|
||||
static enum XML_Error PTRCALL
|
||||
@@ -4290,20 +4291,14 @@ prologProcessor(XML_Parser parser,
|
||||
{
|
||||
const char *next = s;
|
||||
int tok = XmlPrologTok(parser->m_encoding, s, end, &next);
|
||||
- return doProlog(parser, parser->m_encoding, s, end, tok, next,
|
||||
- nextPtr, (XML_Bool)!parser->m_parsingStatus.finalBuffer);
|
||||
+ return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
|
||||
+ (XML_Bool)!parser->m_parsingStatus.finalBuffer, XML_TRUE);
|
||||
}
|
||||
|
||||
static enum XML_Error
|
||||
-doProlog(XML_Parser parser,
|
||||
- const ENCODING *enc,
|
||||
- const char *s,
|
||||
- const char *end,
|
||||
- int tok,
|
||||
- const char *next,
|
||||
- const char **nextPtr,
|
||||
- XML_Bool haveMore)
|
||||
-{
|
||||
+doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
|
||||
+ int tok, const char *next, const char **nextPtr, XML_Bool haveMore,
|
||||
+ XML_Bool allowClosingDoctype) {
|
||||
#ifdef XML_DTD
|
||||
static const XML_Char externalSubsetName[] = { ASCII_HASH , '\0' };
|
||||
#endif /* XML_DTD */
|
||||
@@ -4481,6 +4476,11 @@ doProlog(XML_Parser parser,
|
||||
}
|
||||
break;
|
||||
case XML_ROLE_DOCTYPE_CLOSE:
|
||||
+ if (allowClosingDoctype != XML_TRUE) {
|
||||
+ /* Must not close doctype from within expanded parameter entities */
|
||||
+ return XML_ERROR_INVALID_TOKEN;
|
||||
+ }
|
||||
+
|
||||
if (parser->m_doctypeName) {
|
||||
parser->m_startDoctypeDeclHandler(parser->m_handlerArg, parser->m_doctypeName,
|
||||
parser->m_doctypeSysid, parser->m_doctypePubid, 0);
|
||||
@@ -5417,8 +5417,8 @@ processInternalEntity(XML_Parser parser, ENTITY *entity,
|
||||
#ifdef XML_DTD
|
||||
if (entity->is_param) {
|
||||
int tok = XmlPrologTok(parser->m_internalEncoding, textStart, textEnd, &next);
|
||||
- result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd, tok,
|
||||
- next, &next, XML_FALSE);
|
||||
+ result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd,
|
||||
+ tok, next, &next, XML_FALSE, XML_FALSE);
|
||||
}
|
||||
else
|
||||
#endif /* XML_DTD */
|
||||
@@ -5464,8 +5464,8 @@ internalEntityProcessor(XML_Parser parser,
|
||||
#ifdef XML_DTD
|
||||
if (entity->is_param) {
|
||||
int tok = XmlPrologTok(parser->m_internalEncoding, textStart, textEnd, &next);
|
||||
- result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd, tok,
|
||||
- next, &next, XML_FALSE);
|
||||
+ result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd,
|
||||
+ tok, next, &next, XML_FALSE, XML_TRUE);
|
||||
}
|
||||
else
|
||||
#endif /* XML_DTD */
|
||||
@@ -5492,7 +5492,7 @@ internalEntityProcessor(XML_Parser parser,
|
||||
parser->m_processor = prologProcessor;
|
||||
tok = XmlPrologTok(parser->m_encoding, s, end, &next);
|
||||
return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
|
||||
- (XML_Bool)!parser->m_parsingStatus.finalBuffer);
|
||||
+ (XML_Bool)!parser->m_parsingStatus.finalBuffer, XML_TRUE);
|
||||
}
|
||||
else
|
||||
#endif /* XML_DTD */
|
||||
---
|
||||
2.19.1
|
||||
|
||||
|
||||
BIN
expat-2.2.6.tar.gz
Normal file
BIN
expat-2.2.6.tar.gz
Normal file
Binary file not shown.
77
expat.spec
Normal file
77
expat.spec
Normal file
@ -0,0 +1,77 @@
|
||||
%define Rversion %(echo %{version} | sed -e 's/\\./_/g' -e 's/^/R_/')
|
||||
Name: expat
|
||||
Version: 2.2.6
|
||||
Release: 3
|
||||
Summary: An XML parser library
|
||||
License: MIT
|
||||
URL: https://libexpat.github.io/
|
||||
Source0: https://github.com/libexpat/libexpat/releases/download/%{Rversion}/expat-%{version}.tar.gz
|
||||
Patch6000: CVE-2018-20843.patch
|
||||
Patch6001: CVE-2019-15903.patch
|
||||
|
||||
BuildRequires: sed,autoconf,automake,gcc-c++,libtool,xmlto
|
||||
|
||||
%description
|
||||
expat is a stream-oriented XML parser library written in C.
|
||||
expat excels with files too large to fit RAM, and where
|
||||
performance and flexibility are crucial.
|
||||
|
||||
%package devel
|
||||
Summary: Development files
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
%description devel
|
||||
This package provides with static libraries and header files for developing with expat.
|
||||
|
||||
%package_help
|
||||
|
||||
%prep
|
||||
%autosetup -p1 -n libexpat-%{Rversion}/expat
|
||||
|
||||
autoreconf -fiv
|
||||
%build
|
||||
%configure CFLAGS="$RPM_OPT_FLAGS -fPIC" DOCBOOK_TO_MAN="xmlto man --skip-validation"
|
||||
%make_build
|
||||
|
||||
%install
|
||||
%makeinstall
|
||||
find %{buildroot} -type f -name changelog -delete
|
||||
|
||||
%check
|
||||
make check
|
||||
|
||||
%ldconfig_scriptlets
|
||||
|
||||
%files
|
||||
%defattr(-,root,root)
|
||||
%doc AUTHORS
|
||||
%license COPYING
|
||||
%{_bindir}/*
|
||||
%{_libdir}/libexpat.so.1*
|
||||
|
||||
%files devel
|
||||
%defattr(-,root,root)
|
||||
%{_includedir}/*
|
||||
%{_libdir}/{libexpat.*a,libexpat.so}
|
||||
%{_libdir}/pkgconfig/expat.pc
|
||||
|
||||
|
||||
%files help
|
||||
%defattr(-,root,root)
|
||||
%doc README.md
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%changelog
|
||||
* Sat Sep 28 2019 shenyangyang<shenyangyang4@huawei.com> - 2.2.6-3
|
||||
- Type:cves
|
||||
- ID:CVE-2019-15903
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2019-15903
|
||||
|
||||
* Fri Aug 30 2019 gulining<gulining1@huawei.com> - 2.2.6-2
|
||||
- Type:cves
|
||||
- ID:CVE-2018-20843
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2018-20843
|
||||
|
||||
* Thu Aug 29 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.6-1
|
||||
- Package Init
|
||||
Loading…
x
Reference in New Issue
Block a user