diff --git a/libxslt-1.1.39-CVE-2024-55549.patch b/libxslt-1.1.39-CVE-2024-55549.patch new file mode 100644 index 0000000000000000000000000000000000000000..a374105d3d9049ae43adaf2bf3f2404fb0fdb4ee --- /dev/null +++ b/libxslt-1.1.39-CVE-2024-55549.patch @@ -0,0 +1,45 @@ +From 7f24858ae0f26e610a5a9a6f2a216fa6469c52d1 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Thu, 5 Dec 2024 12:43:19 +0100 +Subject: [PATCH] [CVE-2024-55549] Fix UAF related to excluded namespaces + +Definitions of excluded namespaces could be deleted in +xsltParseTemplateContent. Store excluded namespace URIs in the +stylesheet's dictionary instead of referencing the namespace definition. + +Thanks to Ivan Fratric for the report! + +Fixes #127. +--- + libxslt/xslt.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/libxslt/xslt.c b/libxslt/xslt.c +index 39a700b0..9a081cd1 100644 +--- a/libxslt/xslt.c ++++ b/libxslt/xslt.c +@@ -147,10 +147,20 @@ xsltParseContentError(xsltStylesheetPtr style, + * in case of error + */ + static int +-exclPrefixPush(xsltStylesheetPtr style, xmlChar * value) ++exclPrefixPush(xsltStylesheetPtr style, xmlChar * orig) + { ++ xmlChar *value; + int i; + ++ /* ++ * orig can come from a namespace definition on a node which ++ * could be deleted later, for example in xsltParseTemplateContent. ++ * Store the string in stylesheet's dict to avoid use after free. ++ */ ++ value = (xmlChar *) xmlDictLookup(style->dict, orig, -1); ++ if (value == NULL) ++ return(-1); ++ + /* do not push duplicates */ + for (i = 0;i < style->exclPrefixNr;i++) { + if (xmlStrEqual(style->exclPrefixTab[i], value)) +-- +2.49.0 + diff --git a/libxslt-1.1.39-CVE-2025-24855.patch b/libxslt-1.1.39-CVE-2025-24855.patch new file mode 100644 index 0000000000000000000000000000000000000000..e85142265ab6ad5eb9c7010227ee0fe1225a0f78 --- /dev/null +++ b/libxslt-1.1.39-CVE-2025-24855.patch @@ -0,0 +1,130 @@ +From 1dbe5519852f9c24706ca55ab01367acc1a7ee0a Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Tue, 17 Dec 2024 15:56:21 +0100 +Subject: [PATCH] [CVE-2025-24855] Fix use-after-free of XPath context node + +There are several places where the XPath context node isn't restored +after modifying it, leading to use-after-free errors with nested XPath +evaluations and dynamically allocated context nodes. + +Restore XPath context node in + +- xsltNumberFormatGetValue +- xsltEvalXPathPredicate +- xsltEvalXPathStringNs +- xsltComputeSortResultInternal + +In some places, the transformation context node was saved and restored +which shouldn't be necessary. + +Thanks to Ivan Fratric for the report! + +Fixes #128. +--- + libxslt/numbers.c | 5 +++++ + libxslt/templates.c | 9 ++++++--- + libxslt/xsltutils.c | 4 ++-- + 3 files changed, 13 insertions(+), 5 deletions(-) + +diff --git a/libxslt/numbers.c b/libxslt/numbers.c +index 3cd881e3..566df030 100644 +--- a/libxslt/numbers.c ++++ b/libxslt/numbers.c +@@ -713,9 +713,12 @@ xsltNumberFormatGetValue(xmlXPathContextPtr context, + int amount = 0; + xmlBufferPtr pattern; + xmlXPathObjectPtr obj; ++ xmlNodePtr oldNode; + + pattern = xmlBufferCreate(); + if (pattern != NULL) { ++ oldNode = context->node; ++ + xmlBufferCCat(pattern, "number("); + xmlBufferCat(pattern, value); + xmlBufferCCat(pattern, ")"); +@@ -728,6 +731,8 @@ xsltNumberFormatGetValue(xmlXPathContextPtr context, + xmlXPathFreeObject(obj); + } + xmlBufferFree(pattern); ++ ++ context->node = oldNode; + } + return amount; + } +diff --git a/libxslt/templates.c b/libxslt/templates.c +index f08b9bda..1c8d96e2 100644 +--- a/libxslt/templates.c ++++ b/libxslt/templates.c +@@ -61,6 +61,7 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, + int oldNsNr; + xmlNsPtr *oldNamespaces; + xmlNodePtr oldInst; ++ xmlNodePtr oldNode; + int oldProximityPosition, oldContextSize; + + if ((ctxt == NULL) || (ctxt->inst == NULL)) { +@@ -69,6 +70,7 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, + return(0); + } + ++ oldNode = ctxt->xpathCtxt->node; + oldContextSize = ctxt->xpathCtxt->contextSize; + oldProximityPosition = ctxt->xpathCtxt->proximityPosition; + oldNsNr = ctxt->xpathCtxt->nsNr; +@@ -96,8 +98,9 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, + ctxt->state = XSLT_STATE_STOPPED; + ret = 0; + } +- ctxt->xpathCtxt->nsNr = oldNsNr; + ++ ctxt->xpathCtxt->node = oldNode; ++ ctxt->xpathCtxt->nsNr = oldNsNr; + ctxt->xpathCtxt->namespaces = oldNamespaces; + ctxt->inst = oldInst; + ctxt->xpathCtxt->contextSize = oldContextSize; +@@ -137,7 +140,7 @@ xsltEvalXPathStringNs(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, + } + + oldInst = ctxt->inst; +- oldNode = ctxt->node; ++ oldNode = ctxt->xpathCtxt->node; + oldPos = ctxt->xpathCtxt->proximityPosition; + oldSize = ctxt->xpathCtxt->contextSize; + oldNsNr = ctxt->xpathCtxt->nsNr; +@@ -167,7 +170,7 @@ xsltEvalXPathStringNs(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, + "xsltEvalXPathString: returns %s\n", ret)); + #endif + ctxt->inst = oldInst; +- ctxt->node = oldNode; ++ ctxt->xpathCtxt->node = oldNode; + ctxt->xpathCtxt->contextSize = oldSize; + ctxt->xpathCtxt->proximityPosition = oldPos; + ctxt->xpathCtxt->nsNr = oldNsNr; +diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c +index 3705d28f..9afb4520 100644 +--- a/libxslt/xsltutils.c ++++ b/libxslt/xsltutils.c +@@ -1065,8 +1065,8 @@ xsltComputeSortResultInternal(xsltTransformContextPtr ctxt, xmlNodePtr sort, + return(NULL); + } + +- oldNode = ctxt->node; + oldInst = ctxt->inst; ++ oldNode = ctxt->xpathCtxt->node; + oldPos = ctxt->xpathCtxt->proximityPosition; + oldSize = ctxt->xpathCtxt->contextSize; + oldNsNr = ctxt->xpathCtxt->nsNr; +@@ -1137,8 +1137,8 @@ xsltComputeSortResultInternal(xsltTransformContextPtr ctxt, xmlNodePtr sort, + results[i] = NULL; + } + } +- ctxt->node = oldNode; + ctxt->inst = oldInst; ++ ctxt->xpathCtxt->node = oldNode; + ctxt->xpathCtxt->contextSize = oldSize; + ctxt->xpathCtxt->proximityPosition = oldPos; + ctxt->xpathCtxt->nsNr = oldNsNr; +-- +2.49.0 + diff --git a/libxslt-1.1.39-CVE-2025-7424.patch b/libxslt-1.1.39-CVE-2025-7424.patch new file mode 100644 index 0000000000000000000000000000000000000000..cc7404e17a9cf019fc3e6800e46456eb81a63d61 --- /dev/null +++ b/libxslt-1.1.39-CVE-2025-7424.patch @@ -0,0 +1,99 @@ +From 379d02fc64d44e8d3570f1a294b1f3a9e8fe1beb Mon Sep 17 00:00:00 2001 +From: David Kilzer +Date: Sat, 24 May 2025 15:06:42 -0700 +Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet + and source nodes + +* libxslt/functions.c: +(xsltDocumentFunctionLoadDocument): +- Implement fix suggested by Ivan Fratric. This copies the xmlDoc, + calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the + xmlDoc to tctxt->docList. +- Add error handling for functions that may return NULL. +* libxslt/transform.c: +- Remove static keyword so this can be called from + xsltDocumentFunctionLoadDocument(). +* libxslt/transformInternals.h: Add. +(xsltCleanupSourceDoc): Add declaration. + +Fixes #139. +--- + libxslt/functions.c | 16 +++++++++++++++- + libxslt/transform.c | 3 ++- + libxslt/transformInternals.h | 9 +++++++++ + 3 files changed, 26 insertions(+), 2 deletions(-) + create mode 100644 libxslt/transformInternals.h + +diff --git a/libxslt/functions.c b/libxslt/functions.c +index 283ff24b..527fe89b 100644 +--- a/libxslt/functions.c ++++ b/libxslt/functions.c +@@ -34,6 +34,7 @@ + #include "numbersInternals.h" + #include "keys.h" + #include "documents.h" ++#include "transformInternals.h" + + #ifdef WITH_XSLT_DEBUG + #define WITH_XSLT_DEBUG_FUNCTION +@@ -145,7 +146,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI) + /* + * This selects the stylesheet's doc itself. + */ +- doc = tctxt->style->doc; ++ doc = xmlCopyDoc(tctxt->style->doc, 1); ++ if (doc == NULL) { ++ xsltTransformError(tctxt, NULL, NULL, ++ "document() : failed to copy style doc\n"); ++ goto out_fragment; ++ } ++ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */ ++ idoc = xsltNewDocument(tctxt, doc); ++ if (idoc == NULL) { ++ xsltTransformError(tctxt, NULL, NULL, ++ "document() : failed to create xsltDocument\n"); ++ xmlFreeDoc(doc); ++ goto out_fragment; ++ } + } else { + valuePush(ctxt, xmlXPathNewNodeSet(NULL)); + +diff --git a/libxslt/transform.c b/libxslt/transform.c +index 54ef821b..38c2dce6 100644 +--- a/libxslt/transform.c ++++ b/libxslt/transform.c +@@ -43,6 +43,7 @@ + #include "xsltlocale.h" + #include "pattern.h" + #include "transform.h" ++#include "transformInternals.h" + #include "variables.h" + #include "numbersInternals.h" + #include "namespaces.h" +@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt) + * + * Resets source node flags and ids stored in 'psvi' member. + */ +-static void ++void + xsltCleanupSourceDoc(xmlDocPtr doc) { + xmlNodePtr cur = (xmlNodePtr) doc; + void **psviPtr; +diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h +new file mode 100644 +index 00000000..d0f42823 +--- /dev/null ++++ b/libxslt/transformInternals.h +@@ -0,0 +1,9 @@ ++/* ++ * Summary: set of internal interfaces for the XSLT engine transformation part. ++ * ++ * Copy: See Copyright for the status of this software. ++ * ++ * Author: David Kilzer ++ */ ++ ++void xsltCleanupSourceDoc(xmlDocPtr doc); +-- +2.49.0 + diff --git a/libxslt-1.1.39.tar.xz b/libxslt-1.1.39.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..66a4bdde7d05642a1c8a93b6cd08f8c27c3d731b Binary files /dev/null and b/libxslt-1.1.39.tar.xz differ diff --git a/libxslt.spec b/libxslt.spec index 2c84f13284402d2a72e59c030b6d325aaf7b2537..8cdac27b0d99cfcef08e13195412cd8e0ad1fefb 100644 --- a/libxslt.spec +++ b/libxslt.spec @@ -1,12 +1,15 @@ -%define anolis_release 1 +%define anolis_release 2 Name: libxslt Summary: Library providing the Gnome XSLT engine -Version: 1.1.43 +Version: 1.1.43 Release: %{anolis_release}%{?dist} License: MIT URL: https://gitlab.gnome.org/GNOME/libxslt -Source0: https://download.gnome.org/sources/%{name}/1.1/%{name}-%{version}.tar.xz +Source0: https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.39.tar.xz +Patch1: libxslt-1.1.39-CVE-2024-55549.patch +Patch2: libxslt-1.1.39-CVE-2025-24855.patch +Patch3: libxslt-1.1.39-CVE-2025-7424.patch Provides: xsltproc = %{version}-%{release} @@ -41,6 +44,9 @@ developing applications that use %{name}. Summary: Python 3 bindings for %{name} BuildRequires: python3-devel BuildRequires: python3-libxml2 +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: libtool Requires: %{name} = %{version}-%{release} Requires: python3-libxml2 %{?python_provide:%python_provide python3-%{name}} @@ -115,6 +121,9 @@ rm -vrf %{buildroot}%{_docdir} %{abidir}/libxsltmod.dump %changelog +* Tue Oct 21 2025 zhoujiajia111 - 1.1.43-2 +- Apply patch to prevent use-after-free vulnerabilities and ensure memory safety during XSLT processing +- Apply patch to prevent use-after-free vulnerabilities and ensure memory safety during nested XPath evaluations * Thu May 15 2025 wenxin - 1.1.43-1 - update to 1.1.43 @@ -133,4 +142,3 @@ rm -vrf %{buildroot}%{_docdir} * Thu Apr 07 2022 mgb01105731 - 1.1.35-1 - Init from upstream version 1.1.35 -