sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity
generic-poky/meta/recipes-core
History
Hongxu Jia d2b60efe20 libxml2: Fix CVE-2017-8872 
fix global-buffer-overflow in htmlParseTryOrFinish (HTMLparser.c:5403)

https://bugzilla.gnome.org/show_bug.cgi?id=775200

Here is the reproduce steps on ubuntu 16.04, use clang with "-fsanitize=address"
...
export CC="clang"
export CFLAGS="-fsanitize=address"

./configure --disable-shared

make clean all -j

wget https://bugzilla.gnome.org/attachment.cgi?id=340871 -O poc

./xmllint --html --push poc
==2785==ERROR: AddressSanitizer: global-buffer-overflow on address
0x000000a0de21 at pc 0x0000006a7f6e bp 0x7ffdfe940c10 sp 0x7ffdfe940c08
READ of size 1 at 0x000000a0de21 thread T0    #0 0x6a7f6d
(/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x6a7f6d)    #1 0x6a7356
(/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x6a7356)    #2 0x4f4504
(/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x4f4504)    #3 0x4f045e
(/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x4f045e)    #4 0x7f81977d682f
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)    #5 0x419ad8
(/home/jiahongxu/Downloads/libxml2-2.9.4/xmllint+0x419ad8)
...

(From OE-Core rev: a615b0825927a09a0aa8312d131c9acbaef8956d)

(From OE-Core rev: 1c9d891886f35e6cc4485f244180d7d0ffa82cd3)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 		2017-09-11 22:15:58 +01:00
..
base-files base-files: profile: Do not assume that the tty command exists 2017-04-10 23:00:42 +01:00
base-passwd base-passwd/useradd: Various improvements to useradd with RSS 2017-04-14 09:47:08 +01:00
bsd-headers bsd-headers: set SUMMARY instead of DESCRIPTION 2016-05-30 15:58:10 +01:00
busybox busybox: make bash a valid login shell if enabled 2017-04-29 11:17:23 +01:00
console-tools console-tools: fix string formatting issue 2017-02-15 20:06:42 -08:00
coreutils recipes: Move out stale GPLv2 versions to a seperate layer 2017-03-07 20:05:31 +00:00
dbus meta: start to ignore the largefile distro feature 2017-03-08 11:52:56 +00:00
dbus-wait recipes: Add missing pkgconfig class inherits 2014-06-03 16:49:19 +01:00
dropbear dropbear: drop support for DSA host keys in dropbear init script 2017-03-10 14:50:10 +00:00
expat expat: Don't use getrandom() in the -native case 2017-09-11 22:15:58 +01:00
fts fts: Reduce duplication in MIPS variants. 2016-11-15 15:19:52 +00:00
gettext gettext: split recipe's description 2017-03-17 16:53:06 +00:00
glib-2.0 glib.inc: set CVE_PRODUCT to glib 2017-08-29 11:57:27 +01:00
glib-networking glib-networking: remove intltool dependency 2016-11-23 11:10:11 +00:00
glibc glibc-common.inc: set CVE_PRODUCT to glibc 2017-08-29 11:57:27 +01:00
ifupdown ifupdown: Fix initscript 2017-03-27 20:22:51 +01:00
images build-appliance-image: Update to pyro head revision 2017-07-12 07:06:10 +01:00
init-ifupdown meta: set proper S value 2015-01-23 11:36:27 +00:00
initrdscripts gummiboot: Remove/change gummiboot references with systemd-boot 2017-01-09 13:39:11 +00:00
initscripts initscripts/sysfs.sh: mount configfs if present 2017-03-01 23:27:08 +00:00
kbd kbd: update to 2.0.4 2017-03-01 23:27:09 +00:00
libcgroup libcgroup: Add dependency on fts when building on musl 2016-01-24 09:40:26 +00:00
libxml libxml2: Fix CVE-2017-8872 2017-09-11 22:15:58 +01:00
meta meta-ide-support: exclude this recipe from rm_work 2017-04-05 23:22:12 +01:00
musl musl: Upgrade to latest tip 2017-04-11 18:10:17 +01:00
ncurses ncurses: add SYSROOT_DESTDIR for siteconfig_gencache 2017-08-29 11:57:29 +01:00
netbase netbase: upgrade to version 5.4 2017-01-19 22:47:21 +00:00
os-release meta: remove True option to getVar calls 2016-12-16 10:23:23 +00:00
ovmf ovmf: avoid linking with gold 2017-03-31 10:10:29 +01:00
packagegroups nativesdk-packagegroup-sdk-host.bb: add cmake 2017-03-17 16:53:06 +00:00
psplash psplash: Add PACKAGE_WRITE_DEPS for postinst 2017-01-20 11:53:50 +00:00
readline readline: Remove unused patch 2017-03-16 22:11:32 +00:00
sysfsutils package_regex.inc: split sourceforge related entries to their own recipes 2015-12-08 10:20:52 +00:00
systemd systemd: workaround login failure on qemumips64 when 'pam' is enabled 2017-07-27 22:36:45 +01:00
sysvinit sysvinit-inittab: fix getty device removal 2016-12-16 10:23:23 +00:00
udev eudev: set LGPL-2.1+ for libudev package 2017-04-10 23:00:43 +01:00
update-rc.d update-rc.d: Correct trivial typo in DESCRIPTION line. 2016-08-01 11:47:11 +01:00
util-linux util-linux,shadow: Make 'nologin' alternative command 2017-03-22 11:35:20 +00:00
volatile-binds volatile-binds: correct some errors reported by systemd 2017-04-01 08:14:57 +01:00
zlib zlib: Pass pre-calculate uname enable re-entrant flags 2017-07-27 22:36:44 +01:00