|
| 1 | +From a0c908f1f8970d9f10bbd39888d175a61871690e Mon Sep 17 00:00:00 2001 |
| 2 | +From: =?UTF-8?q?Iv=C3=A1n=20Chavero?= < [email protected]> |
| 3 | +Date: Mon, 24 Nov 2025 01:05:00 -0600 |
| 4 | +Subject: [PATCH] Fix Type confusion in xmlNode.psvi between stylesheet and |
| 5 | + source nodes |
| 6 | + |
| 7 | +* libxslt/functions.c: |
| 8 | +(xsltDocumentFunctionLoadDocument): |
| 9 | +- Implement fix suggested by Ivan Fratric. This copies the xmlDoc, |
| 10 | + calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the |
| 11 | + xmlDoc to tctxt->docList. |
| 12 | +- Add error handling for functions that may return NULL. |
| 13 | +* libxslt/transform.c: |
| 14 | +- Remove static keyword so this can be called from |
| 15 | + xsltDocumentFunctionLoadDocument(). |
| 16 | +* libxslt/transformInternals.h: Add. |
| 17 | +(xsltCleanupSourceDoc): Add declaration. |
| 18 | + |
| 19 | +Original author: David Kilzer < [email protected]> |
| 20 | + |
| 21 | +Fixes: #139 CVE-2025-7424 |
| 22 | +Signed-off-by: Azure Linux Security Servicing Account < [email protected]> |
| 23 | +Upstream-reference: https://github.com/GNOME/libxslt/commit/f6f7f59998c0642b395ba07e5a30e68866df277d.patch |
| 24 | +--- |
| 25 | + libxslt/functions.c | 16 +++++++++++++++- |
| 26 | + libxslt/transform.c | 3 ++- |
| 27 | + libxslt/transformInternals.h | 9 +++++++++ |
| 28 | + 3 files changed, 26 insertions(+), 2 deletions(-) |
| 29 | + create mode 100644 libxslt/transformInternals.h |
| 30 | + |
| 31 | +diff --git a/libxslt/functions.c b/libxslt/functions.c |
| 32 | +index 72a58dc..11ec039 100644 |
| 33 | +--- a/libxslt/functions.c |
| 34 | ++++ b/libxslt/functions.c |
| 35 | +@@ -34,6 +34,7 @@ |
| 36 | + #include "numbersInternals.h" |
| 37 | + #include "keys.h" |
| 38 | + #include "documents.h" |
| 39 | ++#include "transformInternals.h" |
| 40 | + |
| 41 | + #ifdef WITH_XSLT_DEBUG |
| 42 | + #define WITH_XSLT_DEBUG_FUNCTION |
| 43 | +@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, |
| 44 | + /* |
| 45 | + * This selects the stylesheet's doc itself. |
| 46 | + */ |
| 47 | +- doc = tctxt->style->doc; |
| 48 | ++ doc = xmlCopyDoc(tctxt->style->doc, 1); |
| 49 | ++ if (doc == NULL) { |
| 50 | ++ xsltTransformError(tctxt, NULL, NULL, |
| 51 | ++ "document() : failed to copy style doc\n"); |
| 52 | ++ goto out_fragment; |
| 53 | ++ } |
| 54 | ++ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */ |
| 55 | ++ idoc = xsltNewDocument(tctxt, doc); |
| 56 | ++ if (idoc == NULL) { |
| 57 | ++ xsltTransformError(tctxt, NULL, NULL, |
| 58 | ++ "document() : failed to create xsltDocument\n"); |
| 59 | ++ xmlFreeDoc(doc); |
| 60 | ++ goto out_fragment; |
| 61 | ++ } |
| 62 | + } else { |
| 63 | + goto out_fragment; |
| 64 | + } |
| 65 | +diff --git a/libxslt/transform.c b/libxslt/transform.c |
| 66 | +index 54ef821..38c2dce 100644 |
| 67 | +--- a/libxslt/transform.c |
| 68 | ++++ b/libxslt/transform.c |
| 69 | +@@ -43,6 +43,7 @@ |
| 70 | + #include "xsltlocale.h" |
| 71 | + #include "pattern.h" |
| 72 | + #include "transform.h" |
| 73 | ++#include "transformInternals.h" |
| 74 | + #include "variables.h" |
| 75 | + #include "numbersInternals.h" |
| 76 | + #include "namespaces.h" |
| 77 | +@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt) |
| 78 | + * |
| 79 | + * Resets source node flags and ids stored in 'psvi' member. |
| 80 | + */ |
| 81 | +-static void |
| 82 | ++void |
| 83 | + xsltCleanupSourceDoc(xmlDocPtr doc) { |
| 84 | + xmlNodePtr cur = (xmlNodePtr) doc; |
| 85 | + void **psviPtr; |
| 86 | +diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h |
| 87 | +new file mode 100644 |
| 88 | +index 0000000..d0f4282 |
| 89 | +--- /dev/null |
| 90 | ++++ b/libxslt/transformInternals.h |
| 91 | +@@ -0,0 +1,9 @@ |
| 92 | ++/* |
| 93 | ++ * Summary: set of internal interfaces for the XSLT engine transformation part. |
| 94 | ++ * |
| 95 | ++ * Copy: See Copyright for the status of this software. |
| 96 | ++ * |
| 97 | ++ * Author: David Kilzer <[email protected]> |
| 98 | ++ */ |
| 99 | ++ |
| 100 | ++void xsltCleanupSourceDoc(xmlDocPtr doc); |
| 101 | +-- |
| 102 | +2.45.4 |
| 103 | + |
0 commit comments