Package init
This commit is contained in:
overweight
commit
2363062f00
24
CVE-2018-20843.patch
Normal file
24
CVE-2018-20843.patch
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
From 11f8838bf99ea0a6f0b76f9760c43704d00c4ff6 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Sebastian Pipping <sebastian@pipping.org>
|
||||||
|
Date: Wed, 12 Jun 2019 15:42:22 +0200
|
||||||
|
Subject: [PATCH] xmlparse.c: Fix extraction of namespace prefix from XML name
|
||||||
|
(#186)
|
||||||
|
|
||||||
|
---
|
||||||
|
expat/lib/xmlparse.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
|
||||||
|
index c4f3ffc..f4506b0 100644
|
||||||
|
--- a/lib/xmlparse.c
|
||||||
|
+++ b/lib/xmlparse.c
|
||||||
|
@@ -6080,7 +6080,7 @@ setElementTypePrefix(XML_Parser parser, ELEMENT_TYPE *elementType)
|
||||||
|
else
|
||||||
|
poolDiscard(&dtd->pool);
|
||||||
|
elementType->prefix = prefix;
|
||||||
|
-
|
||||||
|
+ break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return 1;
|
||||||
|
|
||||||
112
CVE-2019-15903.patch
Normal file
112
CVE-2019-15903.patch
Normal file
@ -0,0 +1,112 @@
|
|||||||
|
From c20b758c332d9a13afbbb276d30db1d183a85d43 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Sebastian Pipping <sebastian@pipping.org>
|
||||||
|
Date: Wed, 28 Aug 2019 00:24:59 +0200
|
||||||
|
Subject: [PATCH 189/286] xmlparse.c: Deny internal entities closing the
|
||||||
|
doctype
|
||||||
|
|
||||||
|
---
|
||||||
|
expat/lib/xmlparse.c | 20 +++++++++++++-------
|
||||||
|
1 file changed, 13 insertions(+), 7 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
|
||||||
|
index f4506b0..3df4347 100644
|
||||||
|
--- a/lib/xmlparse.c
|
||||||
|
+++ b/lib/xmlparse.c
|
||||||
|
@@ -412,9 +412,10 @@ processXmlDecl(XML_Parser parser, int isGeneralTextEntity,
|
||||||
|
static enum XML_Error
|
||||||
|
initializeEncoding(XML_Parser parser);
|
||||||
|
static enum XML_Error
|
||||||
|
-doProlog(XML_Parser parser, const ENCODING *enc, const char *s,
|
||||||
|
- const char *end, int tok, const char *next, const char **nextPtr,
|
||||||
|
- XML_Bool haveMore);
|
||||||
|
+doProlog(XML_Parser parser, const ENCODING *enc,
|
||||||
|
+ const char *s, const char *end, int tok,
|
||||||
|
+ const char *next, const char **nextPtr,
|
||||||
|
+ XML_Bool haveMore, XML_Bool allowClosingDoctype);
|
||||||
|
static enum XML_Error
|
||||||
|
processInternalEntity(XML_Parser parser, ENTITY *entity,
|
||||||
|
XML_Bool betweenDecl);
|
||||||
|
@@ -4240,8 +4241,8 @@ externalParEntProcessor(XML_Parser parser,
|
||||||
|
}
|
||||||
|
|
||||||
|
parser->m_processor = prologProcessor;
|
||||||
|
- return doProlog(parser, parser->m_encoding, s, end, tok, next,
|
||||||
|
- nextPtr, (XML_Bool)!parser->m_parsingStatus.finalBuffer);
|
||||||
|
+ return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
|
||||||
|
+ (XML_Bool)!parser->m_parsingStatus.finalBuffer, XML_TRUE);
|
||||||
|
}
|
||||||
|
|
||||||
|
static enum XML_Error PTRCALL
|
||||||
|
@@ -4290,20 +4291,14 @@ prologProcessor(XML_Parser parser,
|
||||||
|
{
|
||||||
|
const char *next = s;
|
||||||
|
int tok = XmlPrologTok(parser->m_encoding, s, end, &next);
|
||||||
|
- return doProlog(parser, parser->m_encoding, s, end, tok, next,
|
||||||
|
- nextPtr, (XML_Bool)!parser->m_parsingStatus.finalBuffer);
|
||||||
|
+ return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
|
||||||
|
+ (XML_Bool)!parser->m_parsingStatus.finalBuffer, XML_TRUE);
|
||||||
|
}
|
||||||
|
|
||||||
|
static enum XML_Error
|
||||||
|
-doProlog(XML_Parser parser,
|
||||||
|
- const ENCODING *enc,
|
||||||
|
- const char *s,
|
||||||
|
- const char *end,
|
||||||
|
- int tok,
|
||||||
|
- const char *next,
|
||||||
|
- const char **nextPtr,
|
||||||
|
- XML_Bool haveMore)
|
||||||
|
-{
|
||||||
|
+doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
|
||||||
|
+ int tok, const char *next, const char **nextPtr, XML_Bool haveMore,
|
||||||
|
+ XML_Bool allowClosingDoctype) {
|
||||||
|
#ifdef XML_DTD
|
||||||
|
static const XML_Char externalSubsetName[] = { ASCII_HASH , '\0' };
|
||||||
|
#endif /* XML_DTD */
|
||||||
|
@@ -4481,6 +4476,11 @@ doProlog(XML_Parser parser,
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case XML_ROLE_DOCTYPE_CLOSE:
|
||||||
|
+ if (allowClosingDoctype != XML_TRUE) {
|
||||||
|
+ /* Must not close doctype from within expanded parameter entities */
|
||||||
|
+ return XML_ERROR_INVALID_TOKEN;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (parser->m_doctypeName) {
|
||||||
|
parser->m_startDoctypeDeclHandler(parser->m_handlerArg, parser->m_doctypeName,
|
||||||
|
parser->m_doctypeSysid, parser->m_doctypePubid, 0);
|
||||||
|
@@ -5417,8 +5417,8 @@ processInternalEntity(XML_Parser parser, ENTITY *entity,
|
||||||
|
#ifdef XML_DTD
|
||||||
|
if (entity->is_param) {
|
||||||
|
int tok = XmlPrologTok(parser->m_internalEncoding, textStart, textEnd, &next);
|
||||||
|
- result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd, tok,
|
||||||
|
- next, &next, XML_FALSE);
|
||||||
|
+ result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd,
|
||||||
|
+ tok, next, &next, XML_FALSE, XML_FALSE);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
#endif /* XML_DTD */
|
||||||
|
@@ -5464,8 +5464,8 @@ internalEntityProcessor(XML_Parser parser,
|
||||||
|
#ifdef XML_DTD
|
||||||
|
if (entity->is_param) {
|
||||||
|
int tok = XmlPrologTok(parser->m_internalEncoding, textStart, textEnd, &next);
|
||||||
|
- result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd, tok,
|
||||||
|
- next, &next, XML_FALSE);
|
||||||
|
+ result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd,
|
||||||
|
+ tok, next, &next, XML_FALSE, XML_TRUE);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
#endif /* XML_DTD */
|
||||||
|
@@ -5492,7 +5492,7 @@ internalEntityProcessor(XML_Parser parser,
|
||||||
|
parser->m_processor = prologProcessor;
|
||||||
|
tok = XmlPrologTok(parser->m_encoding, s, end, &next);
|
||||||
|
return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
|
||||||
|
- (XML_Bool)!parser->m_parsingStatus.finalBuffer);
|
||||||
|
+ (XML_Bool)!parser->m_parsingStatus.finalBuffer, XML_TRUE);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
#endif /* XML_DTD */
|
||||||
|
---
|
||||||
|
2.19.1
|
||||||
|
|
||||||
|
|
||||||
BIN
expat-2.2.6.tar.gz
Normal file
BIN
expat-2.2.6.tar.gz
Normal file
Binary file not shown.
77
expat.spec
Normal file
77
expat.spec
Normal file
@ -0,0 +1,77 @@
|
|||||||
|
%define Rversion %(echo %{version} | sed -e 's/\\./_/g' -e 's/^/R_/')
|
||||||
|
Name: expat
|
||||||
|
Version: 2.2.6
|
||||||
|
Release: 3
|
||||||
|
Summary: An XML parser library
|
||||||
|
License: MIT
|
||||||
|
URL: https://libexpat.github.io/
|
||||||
|
Source0: https://github.com/libexpat/libexpat/releases/download/%{Rversion}/expat-%{version}.tar.gz
|
||||||
|
Patch6000: CVE-2018-20843.patch
|
||||||
|
Patch6001: CVE-2019-15903.patch
|
||||||
|
|
||||||
|
BuildRequires: sed,autoconf,automake,gcc-c++,libtool,xmlto
|
||||||
|
|
||||||
|
%description
|
||||||
|
expat is a stream-oriented XML parser library written in C.
|
||||||
|
expat excels with files too large to fit RAM, and where
|
||||||
|
performance and flexibility are crucial.
|
||||||
|
|
||||||
|
%package devel
|
||||||
|
Summary: Development files
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
%description devel
|
||||||
|
This package provides with static libraries and header files for developing with expat.
|
||||||
|
|
||||||
|
%package_help
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%autosetup -p1 -n libexpat-%{Rversion}/expat
|
||||||
|
|
||||||
|
autoreconf -fiv
|
||||||
|
%build
|
||||||
|
%configure CFLAGS="$RPM_OPT_FLAGS -fPIC" DOCBOOK_TO_MAN="xmlto man --skip-validation"
|
||||||
|
%make_build
|
||||||
|
|
||||||
|
%install
|
||||||
|
%makeinstall
|
||||||
|
find %{buildroot} -type f -name changelog -delete
|
||||||
|
|
||||||
|
%check
|
||||||
|
make check
|
||||||
|
|
||||||
|
%ldconfig_scriptlets
|
||||||
|
|
||||||
|
%files
|
||||||
|
%defattr(-,root,root)
|
||||||
|
%doc AUTHORS
|
||||||
|
%license COPYING
|
||||||
|
%{_bindir}/*
|
||||||
|
%{_libdir}/libexpat.so.1*
|
||||||
|
|
||||||
|
%files devel
|
||||||
|
%defattr(-,root,root)
|
||||||
|
%{_includedir}/*
|
||||||
|
%{_libdir}/{libexpat.*a,libexpat.so}
|
||||||
|
%{_libdir}/pkgconfig/expat.pc
|
||||||
|
|
||||||
|
|
||||||
|
%files help
|
||||||
|
%defattr(-,root,root)
|
||||||
|
%doc README.md
|
||||||
|
%{_mandir}/man1/*
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Sat Sep 28 2019 shenyangyang<shenyangyang4@huawei.com> - 2.2.6-3
|
||||||
|
- Type:cves
|
||||||
|
- ID:CVE-2019-15903
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fix CVE-2019-15903
|
||||||
|
|
||||||
|
* Fri Aug 30 2019 gulining<gulining1@huawei.com> - 2.2.6-2
|
||||||
|
- Type:cves
|
||||||
|
- ID:CVE-2018-20843
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fix CVE-2018-20843
|
||||||
|
|
||||||
|
* Thu Aug 29 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.6-1
|
||||||
|
- Package Init
|
||||||
Loading…
x
Reference in New Issue
Block a user