Compare commits

...

10 Commits

Author SHA1 Message Date
openeuler-ci-bot
cdaa67dbb2
!37 upgrade version to 1.1.37
From: @tong_1001 
Reviewed-by: @znzjugod, @lvying6 
Signed-off-by: @lvying6
2022-11-07 09:21:02 +00:00
shixuantong
6e10682eaf upgrade version to 1.1.37 2022-11-05 19:55:37 +08:00
openeuler-ci-bot
9a6f454ebf
!33 fix CVE-2021-30560
From: @fly_fzc 
Reviewed-by: @lvying6 
Signed-off-by: @lvying6
2022-07-01 06:51:59 +00:00
fuanan
99f1f03541 fix CVE-2021-30560 2022-07-01 09:53:13 +08:00
openeuler-ci-bot
13cb9c3441
!25 modify the changelog
From: @zhangruifang2020 
Reviewed-by: @overweight 
Signed-off-by: @overweight
2022-04-26 11:09:19 +00:00
zhangruifang2020
e8fec7c304 modify the changelog 2022-04-26 14:47:38 +08:00
openeuler-ci-bot
8b8fc7e575
!22 Fix test command
Merge pull request !22 from 付安安/openEuler-22.03-LTS-Next
2022-01-05 08:14:35 +00:00
fuanan
ff407ee2cc Fix test command 2022-01-05 15:23:20 +08:00
openeuler-ci-bot
19bc50bd28 !21 Fix double-free with stylesheets containing entity nodes
From: @panxh_purple
Reviewed-by: @xiezhipeng1
Signed-off-by: @xiezhipeng1
2021-10-25 01:04:53 +00:00
panxiaohe
e3d5bf5916 Fix double-free with stylesheets containing entity nodes 2021-10-23 16:21:02 +08:00
9 changed files with 65 additions and 199 deletions

View File

@ -1,9 +1,11 @@
--- a/libexslt/math.c 2017-10-30 15:49:55.000000000 +0800
+++ b/libexslt/math.c 2019-04-18 15:00:54.524000000 +0800
@@ -23,6 +23,13 @@
#ifdef HAVE_STDLIB_H
diff --git a/libexslt/math.c b/libexslt/math.c
index 17138b2..c9f9e5a 100644
--- a/libexslt/math.c
+++ b/libexslt/math.c
@@ -11,6 +11,13 @@
#include <math.h>
#include <stdlib.h>
#endif
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
@ -14,7 +16,7 @@
#include "exslt.h"
@@ -474,6 +481,20 @@ static double
@@ -460,6 +467,20 @@ static double
exsltMathRandom (void) {
double ret;
int num;
@ -35,3 +37,6 @@
num = rand();
ret = (double)num / (double)RAND_MAX;
--
2.27.0

View File

@ -1,28 +0,0 @@
From 291d190b3d37bfe58efe7328e37a5334c553126b Mon Sep 17 00:00:00 2001
From: David Kilzer <ddkilzer@apple.com>
Date: Tue, 7 Jan 2020 15:15:53 -0800
Subject: [PATCH 10/24] Fix clang -Wconditional-uninitialized warning in
libxslt/numbers.c
* libxslt/numbers.c:
(xsltFormatNumberConversion): Initialize `len` to fix warning.
---
libxslt/numbers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libxslt/numbers.c b/libxslt/numbers.c
index 92023f8..7969dc9 100644
--- a/libxslt/numbers.c
+++ b/libxslt/numbers.c
@@ -960,7 +960,7 @@ xsltFormatNumberConversion(xsltDecimalFormatPtr self,
xmlChar *nprefix, *nsuffix = NULL;
int prefix_length, suffix_length = 0, nprefix_length, nsuffix_length;
double scale;
- int j, len;
+ int j, len = 0;
int self_grouping_len;
xsltFormatNumberInfo format_info;
/*
--
1.8.3.1

View File

@ -1,28 +0,0 @@
From aac4bccdd893713dd058305e385d7f13f94e6add Mon Sep 17 00:00:00 2001
From: David Kilzer <ddkilzer@apple.com>
Date: Tue, 7 Jan 2020 15:23:17 -0800
Subject: [PATCH 11/24] Fix clang -Wimplicit-int-conversion warning
* libxslt/numbers.c:
(xsltNumberFormatDecimal): Cast `val` to `(xmlChar)` to fix the
warning.
---
libxslt/numbers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libxslt/numbers.c b/libxslt/numbers.c
index 7969dc9..4cb2125 100644
--- a/libxslt/numbers.c
+++ b/libxslt/numbers.c
@@ -177,7 +177,7 @@ xsltNumberFormatDecimal(xmlBufferPtr buffer,
i = -1;
break;
}
- *(--pointer) = val;
+ *(--pointer) = (xmlChar)val;
}
else {
/*
--
1.8.3.1

View File

@ -1,25 +0,0 @@
From f235404b13f17d5343b854fe5d459a0c98bbd2d2 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Fri, 10 Jan 2020 13:11:45 +0100
Subject: [PATCH 12/24] Fix implicit-int-conversion warning in exslt/crypto.c
---
libexslt/crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libexslt/crypto.c b/libexslt/crypto.c
index 621fd90..c6bf34f 100644
--- a/libexslt/crypto.c
+++ b/libexslt/crypto.c
@@ -101,7 +101,7 @@ exsltCryptoHex2Bin (const unsigned char *hex, int hexlen,
else if (tmp >= 'a' && tmp <= 'f')
lo = 10 + (tmp - 'a');
- result = hi << 4;
+ result = (unsigned char) (hi << 4);
result += lo;
bin[j++] = result;
}
--
1.8.3.1

View File

@ -1,49 +0,0 @@
From 4ccc06b56b8b6d39c29932c92cd1ed82f6698d6f Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Sun, 20 Sep 2020 15:14:47 +0200
Subject: [PATCH 33/37] Fix quadratic runtime with text and <xsl:message>
Backup and restore "last text" data in xsltEvalTemplateString.
Otherwise, optimization of string concatenation would be disabled
whenever an xsl:message was processed.
Found by OSS-Fuzz.
---
libxslt/templates.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libxslt/templates.c b/libxslt/templates.c
index 48b73a5..4108ed2 100644
--- a/libxslt/templates.c
+++ b/libxslt/templates.c
@@ -210,6 +210,8 @@ xsltEvalTemplateString(xsltTransformContextPtr ctxt,
{
xmlNodePtr oldInsert, insert = NULL;
xmlChar *ret;
+ const xmlChar *oldLastText;
+ int oldLastTextSize, oldLastTextUse;
if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) ||
(inst->type != XML_ELEMENT_NODE))
@@ -233,12 +235,18 @@ xsltEvalTemplateString(xsltTransformContextPtr ctxt,
}
oldInsert = ctxt->insert;
ctxt->insert = insert;
+ oldLastText = ctxt->lasttext;
+ oldLastTextSize = ctxt->lasttsize;
+ oldLastTextUse = ctxt->lasttuse;
/*
* OPTIMIZE TODO: if inst->children consists only of text-nodes.
*/
xsltApplyOneTemplate(ctxt, contextNode, inst->children, NULL, NULL);
ctxt->insert = oldInsert;
+ ctxt->lasttext = oldLastText;
+ ctxt->lasttsize = oldLastTextSize;
+ ctxt->lasttuse = oldLastTextUse;
ret = xmlNodeGetContent(insert);
if (insert != NULL)
--
1.8.3.1

View File

@ -1,50 +0,0 @@
From b90e1063a83d9c0328d2559cdb6e9455da9747c7 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Fri, 10 Jan 2020 12:58:35 +0100
Subject: [PATCH 08/24] Fix variable syntax in Python configuration
Resolves #30.
---
configure.ac | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/configure.ac b/configure.ac
index 585b9d7..d676b12 100644
--- a/configure.ac
+++ b/configure.ac
@@ -272,17 +272,17 @@ except: print 0"`
-d $with_python/lib/python$PYTHON_VERSION/site-packages
then
PYTHON_INCLUDES=$with_python/include/python$PYTHON_VERSION
- PYTHON_SITE_PACKAGES='$(libdir)/python$(PYTHON_VERSION)/site-packages'
+ PYTHON_SITE_PACKAGES=$libdir/python$PYTHON_VERSION/site-packages
else
if test -r $prefix/include/python$PYTHON_VERSION/Python.h
then
PYTHON_INCLUDES=$prefix/include/python$PYTHON_VERSION
- PYTHON_SITE_PACKAGES='$(libdir)/python$(PYTHON_VERSION)/site-packages'
+ PYTHON_SITE_PACKAGES=$libdir/python$PYTHON_VERSION/site-packages
else
if test -r /usr/include/python$PYTHON_VERSION/Python.h
then
PYTHON_INCLUDES=/usr/include/python$PYTHON_VERSION
- PYTHON_SITE_PACKAGES='$(libdir)/python$(PYTHON_VERSION)/site-packages'
+ PYTHON_SITE_PACKAGES=$libdir/python$PYTHON_VERSION/site-packages
else
echo could not find python$PYTHON_VERSION/Python.h
fi
@@ -296,9 +296,9 @@ except: print 0"`
fi
if test "$with_python" != ""
then
- pythondir='$(PYTHON_SITE_PACKAGES)'
+ pythondir=$PYTHON_SITE_PACKAGES
else
- pythondir='$(libdir)/python$(PYTHON_VERSION)/site-packages'
+ pythondir=$libdir/python$PYTHON_VERSION/site-packages
fi
fi
AM_CONDITIONAL(WITH_PYTHON, test "$PYTHON_INCLUDES" != "")
--
1.8.3.1

Binary file not shown.

BIN
libxslt-1.1.37.tar.gz Normal file

Binary file not shown.

View File

@ -1,17 +1,12 @@
Name: libxslt
Version: 1.1.34
Release: 4
Version: 1.1.37
Release: 1
Summary: XSLT Transformation Library
License: MIT
URL: http://xmlsoft.org/libxslt/
Source0: https://github.com/GNOME/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
# PATCH-FIX-UPSTREAM bug-fix https://github.com/GNOME/libxslt/
Patch0: CVE-2015-9019.patch
Patch1: Fix-variable-syntax-in-Python-configuration.patch
Patch2: Fix-clang-Wconditional-uninitialized-warning-in-libx.patch
Patch3: Fix-clang-Wimplicit-int-conversion-warning.patch
Patch4: Fix-implicit-int-conversion-warning-in-exslt-crypto..patch
Patch5: Fix-quadratic-runtime-with-text-and-xsl-message.patch
BuildRequires: gcc make libtool autoconf automake libgcrypt-devel pkgconfig(libxml-2.0) >= 2.6.27
@ -28,6 +23,24 @@ Requires: libgcrypt-devel libgpg-error-devel
(or HTML, text, and more) using the standard XSLT stylesheet
transformation mechanism.
%package -n python3-libxslt
Summary:Python 3 bindings for %{name}
BuildRequires: python3-devel python3-libxml2
Requires: %{name} = %{version}-%{release}
Requires: python3-libxml2 >= 2.6.27
Requires: libxml2 >= 2.6.27
%{?python_provide:%python_provide python3-%{name}}
%description -n python3-libxslt
The libxslt-python package contains a module that permits applications
written in the Python programming language to use the interface
supplied by the libxslt library to apply XSLT transformations.
This library allows to parse sytlesheets, uses the libxml2-python
to load and save XML and HTML files. Direct access to XPath and
the XSLT transformation context are possible to extend the XSLT language
with XPath functions written in Python.
%package_help
%prep
@ -45,7 +58,7 @@ autoreconf -vfi
pushd $RPM_BUILD_ROOT/%{_includedir}/%{name}; touch -m --reference=xslt.h ../../bin/xslt-config;popd
%check
make check
%make_build tests
%post
/sbin/ldconfig
@ -54,7 +67,7 @@ make check
%files
%defattr(-,root,root)
%doc ChangeLog NEWS README FEATURES AUTHORS
%doc NEWS README FEATURES AUTHORS
%license Copyright
%{_bindir}/xsltproc
%{_libdir}/libxslt.so.*
@ -66,20 +79,48 @@ make check
%{_libdir}/libxslt.so
%{_libdir}/libexslt.so
%{_libdir}/xsltConf.sh
%{_libdir}/cmake/libxslt/
%{_datadir}/aclocal/libxslt.m4
%{_datadir}/gtk-doc/
%{_includedir}/libxslt/
%{_includedir}/libexslt/
%{_libdir}/pkgconfig/libxslt.pc
%{_libdir}/pkgconfig/libexslt.pc
%{_bindir}/xslt-config
%files -n python3-libxslt
%{python3_sitelib}/libxslt.py*
%{python3_sitearch}/libxsltmod.so
%{python3_sitelib}/__pycache__/libxslt*
%files help
%doc %{_docdir}/%{name}-%{version}
%doc %{_docdir}/%{name}
%doc %{_mandir}/man3/*
%exclude %{_docdir}/%{name}/{ChangeLog,NEWS,README,FEATURES,AUTHORS}
%exclude %{_docdir}/../licenses/Copyright
%exclude %{_docdir}/%{name}/{NEWS,README,FEATURES,AUTHORS}
%exclude %{_docdir}/../licenses/libxslt/Copyright
%changelog
* Sat Nov 05 2022 shixuantong <shixuantong1@huawei.com> - 1.1.37-1
- Type:bugfix
- ID:NA
- SUG:NA
- DESC:upgrade version to 1.1.37
* Fri Jul 01 2022 fuanan <fuanan3@h-partners.com> - 1.1.34-8
- Type:CVE
- ID:CVE-2021-30560
- SUG:NA
- DESC:fix CVE-2021-30560
* Tue Apr 26 2022 zhangruifang2020 <zhangruifang1@h-partners.com> - 1.1.34-7
- modify the changelog
* Wed Jan 05 2022 fuanan <fuanan3@huawei.com> - 1.1.34-6
- Fix test command
* Sat Oct 23 2021 panxiaohe<panxiaohe@huawei.com> - 1.1.34-5
- Fix double-free with stylesheets containing entity nodes
* Thu Oct 29 2020 wangchen<wangchen137@huawei.com> - 1.1.34-4
- remove python2
@ -95,7 +136,7 @@ make check
* Sat Jan 11 2020 zhangguangzhi<zhanguangzhi3@huawei.com> - 1.1.32-7
- del patch to be consistent with open source
* Mon Dec 31 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.1.32-6
* Tue Dec 31 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.1.32-6
- fix bug in community files
* Sat Dec 21 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.1.32-5