openembedded-core.git/meta/recipes-core/libxml, branch pyro

libxml2: CVE-2016-9318

2017-04-28T10:26:07+00:00

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier
and other products, does not offer a flag directly indicating that
the current document may be read but other files may not be opened,
which makes it easier for remote attackers to conduct XML External
Entity (XXE) attacks via a crafted document.

Reference:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318

Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0

Signed-off-by: Catalin Enache 
Signed-off-by: Ross Burton

libxml2: make dependencies on python conditional

2017-04-05T11:36:46+00:00

The library libxml2 can provide its own bindings for python2 in addition
to the third party python-lxml and python3-lxml packages if this
functionality is enabled in PACKAGECONFIG.

But in case the functionality is disabled there's no need to depend
on python2.

Make the dependency on python2 enabled only if the python feature
is added to PACKAGECONFIG. Also add missing run-time dependency on make
to libxml2-ptest.

Signed-off-by: Dmitry Rozhkov 
Signed-off-by: Ross Burton

recipes: Make use of the new bb.utils.filter() function

2017-03-01T11:17:22+00:00

Signed-off-by: Peter Kjellerstedt 
Signed-off-by: Richard Purdie

libxml2: Drop docs in native case

2017-01-28T23:31:17+00:00

With rss, moving these around was having an increasing overhead and we don't
need them in the native case so remove them.

Signed-off-by: Richard Purdie

meta: remove True option to getVar calls

2016-12-16T08:30:03+00:00

getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.

Search made with the following regex: getVar ?\(( ?[^,()]*), True\)

Signed-off-by: Joshua Lock 
Signed-off-by: Ross Burton

libxml2: Fix more NULL pointer derefs

2016-12-16T08:30:02+00:00

The NULL pointer dereferencing could produced some
security problems.
This is a preventive security fix.

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton

libxml2: fix CVE-2016-4658 Disallow namespace nodes in XPointer points and ranges

2016-12-16T08:30:01+00:00

Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton

libxml2: Necessary changes before fixing CVE-2016-5131

2016-12-16T08:30:01+00:00

xpath:
 - Check for errors after evaluating first operand.
 - Add sanity check for empty stack.
 - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton

libxml2: Security fix CVE-2016-5131

2016-11-30T15:47:15+00:00

CVE-2016-5131 libxml2: Use-after-free vulnerability in libxml2 through
2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote
attackers to cause a denial of service or possibly have unspecified
other impact via vectors related to the XPointer range-to function.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5131

Patch from:
https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e

Signed-off-by: Yi Zhao 
Signed-off-by: Ross Burton

libxml2: Make tests non-executable

2016-10-15T08:59:54+00:00

The XML W3C conformance test suite contains thousands of xml files all
marked executable. We dutifully try to strip all these files of debug
info in do_package.

"chmod -x" improves build time by ~40 seconds.

Signed-off-by: Jussi Kukkonen 
Signed-off-by: Ross Burton