Backport the security fix from bug #245960 because libxml2-2.7.x causes massive PHP breakage per bug #249703.

(Portage version: 2.2_rc18/cvs/Linux 2.6.28-rc5-00117-g7f0f598 x86_64)

3 files changed, 233 insertions, 1 deletions

diff --git a/dev-libs/libxml2/ChangeLog b/dev-libs/libxml2/ChangeLog
index 81e889771a67..2b3f34ac7bee 100644
--- a/dev-libs/libxml2/ChangeLog
+++ b/dev-libs/libxml2/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for dev-libs/libxml2
 # Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.243 2008/12/07 05:52:13 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.244 2008/12/23 04:56:02 robbat2 Exp $
+
+  23 Dec 2008; Robin H. Johnson <robbat2@gentoo.org>
+  +files/libxml2-2.6.32-CVE-2008-422x.patch, +libxml2-2.6.32-r1.ebuild:
+  Backport the security fix from bug #245960 because libxml2-2.7.x causes
+  massive PHP breakage per bug #249703.
 
   07 Dec 2008; Mike Frysinger <vapier@gentoo.org> libxml2-2.6.30-r1.ebuild,
   libxml2-2.6.31.ebuild, libxml2-2.6.32.ebuild, libxml2-2.7.1.ebuild,
diff --git a/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-422x.patch b/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-422x.patch
new file mode 100644
index 000000000000..87d0b5977a21
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-422x.patch
@@ -0,0 +1,102 @@
+This patch backported from libxml2-2.7.2-CVE-2008-422x.patch.
+
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+Original changelog message:
+Mon Nov 17 16:56:18 CET 2008 Daniel Veillard <daniel@...> (upstream revision 3803)
+
+	* SAX2.c parser.c: fix for CVE-2008-4226, a memory overflow
+	  when building gigantic text nodes, and a bit of cleanup
+	  to better handled out of memory problem in that code.
+	* tree.c: fix for CVE-2008-4225, lack of testing leads to
+	  a busy loop test assuming one have enough core memory.
+
+diff -Nuar --exclude '*~' --exclude '*.rej' --exclude '*.rej2' --exclude '*.orig' libxml2-2.6.32.orig/SAX2.c libxml2-2.6.32/SAX2.c
+--- libxml2-2.6.32.orig/SAX2.c	2008-01-25 05:10:04.000000000 -0800
++++ libxml2-2.6.32/SAX2.c	2008-12-22 20:42:14.039171616 -0800
+@@ -11,6 +11,7 @@
+ #include "libxml.h"
+ #include <stdlib.h>
+ #include <string.h>
++#include <limits.h>
+ #include <libxml/xmlmemory.h>
+ #include <libxml/tree.h>
+ #include <libxml/parser.h>
+@@ -26,6 +27,11 @@
+ #include <libxml/HTMLtree.h>
+ #include <libxml/globals.h>
+ 
++/* Define SIZE_T_MAX unless defined through <limits.h>. */
++#ifndef SIZE_T_MAX
++# define SIZE_T_MAX     ((size_t)-1)
++#endif /* !SIZE_T_MAX */
++
+ /* #define DEBUG_SAX2 */
+ /* #define DEBUG_SAX2_TREE */
+ 
+@@ -2445,9 +2451,14 @@
+ 	               (xmlDictOwns(ctxt->dict, lastChild->content))) {
+ 		lastChild->content = xmlStrdup(lastChild->content);
+ 	    }
++	    if ((size_t)ctxt->nodelen > SIZE_T_MAX - (size_t)len || 
++	        (size_t)ctxt->nodemem + (size_t)len > SIZE_T_MAX / 2) {
++	            xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
++	            return;
++	    }
+ 	    if (ctxt->nodelen + len >= ctxt->nodemem) {
+ 		xmlChar *newbuf;
+-		int size;
++		size_t size;
+ 
+ 		size = ctxt->nodemem + len;
+ 		size *= 2;
+diff -Nuar --exclude '*~' --exclude '*.rej' --exclude '*.rej2' --exclude '*.orig' libxml2-2.6.32.orig/tree.c libxml2-2.6.32/tree.c
+--- libxml2-2.6.32.orig/tree.c	2008-04-08 06:54:48.000000000 -0700
++++ libxml2-2.6.32/tree.c	2008-12-22 20:47:22.365674451 -0800
+@@ -14,7 +14,7 @@
+ #include "libxml.h"
+ 
+ #include <string.h> /* for memset() only ! */
+-
++#include <limits.h>
+ #ifdef HAVE_CTYPE_H
+ #include <ctype.h>
+ #endif
+@@ -6916,7 +6916,13 @@
+     case XML_BUFFER_ALLOC_DOUBLEIT:
+ 	/*take care of empty case*/
+         newSize = (buf->size ? buf->size*2 : size + 10);
+-        while (size > newSize) newSize *= 2;
++	    while (size > newSize) {
++	        if (newSize > UINT_MAX / 2) {
++	            xmlTreeErrMemory("growing buffer");
++	            return 0;
++	        }
++	        newSize *= 2;
++	    }
+         break;
+     case XML_BUFFER_ALLOC_EXACT:
+         newSize = size+10;
+diff -Nuar --exclude '*~' --exclude '*.rej' --exclude '*.rej2' --exclude '*.orig' libxml2-2.6.32.orig/parser.c libxml2-2.6.32/parser.c
+--- libxml2-2.6.32.orig/parser.c	2008-04-08 07:47:58.000000000 -0700
++++ libxml2-2.6.32/parser.c	2008-12-22 20:42:14.053327110 -0800
+@@ -3758,6 +3758,9 @@
+                     line = ctxt->input->line;
+                     col = ctxt->input->col;
+ 		}
++                /* something really bad happened in the SAX callback */
++                if (ctxt->instate != XML_PARSER_CONTENT)
++                    return;
+ 	    }
+ 	    ctxt->input->cur = in;
+ 	    if (*in == 0xD) {
+@@ -3838,6 +3841,9 @@
+ 		}
+ 	    }
+ 	    nbchar = 0;
++            /* something really bad happened in the SAX callback */
++            if (ctxt->instate != XML_PARSER_CONTENT)
++                return;
+ 	}
+ 	count++;
+ 	if (count > 50) {
diff --git a/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild b/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild
new file mode 100644
index 000000000000..7ef2bc1a2393
--- /dev/null
+++ b/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild
@@ -0,0 +1,125 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild,v 1.3 2008/12/23 04:56:02 robbat2 Exp $
+
+inherit libtool flag-o-matic eutils
+
+DESCRIPTION="Version 2 of the library to manipulate XML files"
+HOMEPAGE="http://www.xmlsoft.org/"
+
+LICENSE="MIT"
+SLOT="2"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+IUSE="debug doc examples ipv6 python readline test"
+
+XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
+XSTS_NAME_1="xmlschema2002-01-16"
+XSTS_NAME_2="xmlschema2004-01-14"
+XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
+XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
+
+SRC_URI="ftp://xmlsoft.org/${PN}/${P}.tar.gz
+	test? (
+		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
+		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2} )"
+
+RDEPEND="sys-libs/zlib
+	python?   ( dev-lang/python )
+	readline? ( sys-libs/readline )"
+
+DEPEND="${RDEPEND}
+	hppa? ( >=sys-devel/binutils-2.15.92.0.2 )"
+
+src_unpack() {
+	unpack ${P}.tar.gz
+	cd "${S}"
+
+	# Fix for CVE-2008-4225 and CVE-2008-4226, bug 245960
+	# Backported from 2.7.2 version
+	epatch "${FILESDIR}/${P}-CVE-2008-422x.patch"
+
+	if use test; then
+		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
+			"${DISTDIR}/${XSTS_TARBALL_2}" \
+			"${S}"/xstc/ \
+			|| die "Failed to install test tarballs"
+	fi
+
+	epunt_cxx
+}
+
+src_compile() {
+	# USE zlib support breaks gnome2
+	# (libgnomeprint for instance fails to compile with
+	# fresh install, and existing) - <azarah@gentoo.org> (22 Dec 2002).
+
+	# The meaning of the 'debug' USE flag does not apply to the --with-debug
+	# switch (enabling the libxml2 debug module). See bug #100898.
+
+	# --with-mem-debug causes unusual segmentation faults (bug #105120).
+
+	local myconf="--with-zlib \
+		$(use_with debug run-debug)  \
+		$(use_with python)           \
+		$(use_with readline)         \
+		$(use_with readline history) \
+		$(use_enable ipv6)"
+
+	# Please do not remove, as else we get references to PORTAGE_TMPDIR
+	# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
+	elibtoolize
+
+	# filter seemingly problematic CFLAGS (#26320)
+	filter-flags -fprefetch-loop-arrays -funroll-loops
+
+	econf $myconf || die "Configuration failed"
+
+	# Patching the Makefiles to respect get_libdir
+	# Fixes BUG #86766, please keep this.
+	# Danny van Dyk <kugelfang@gentoo.org> 2005/03/26
+	for x in $(find "${S}" -name "Makefile") ; do
+		sed \
+			-e "s|^\(PYTHON_SITE_PACKAGES\ =\ \/usr\/\).*\(\/python.*\)|\1$(get_libdir)\2|g" \
+			-i ${x} \
+			|| die "sed failed"
+	done
+
+	emake || die "Compilation failed"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "Installation failed"
+
+	dodoc AUTHORS ChangeLog Copyright NEWS README* TODO*
+
+	if ! use doc; then
+		rm -rf "${D}"/usr/share/gtk-doc
+		rm -rf "${D}"/usr/share/doc/${P}/html
+	fi
+
+	if ! use examples; then
+		rm -rf "${D}/usr/share/doc/${P}/examples"
+		rm -rf "${D}/usr/share/doc/${PN}-python-${PV}/examples"
+	fi
+}
+
+pkg_postinst() {
+	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
+	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
+	if [[ "${ROOT}" != "/" ]]
+	then
+		elog "Skipping XML catalog creation for stage building (bug #208887)."
+	else
+		# need an XML catalog, so no-one writes to a non-existent one
+		CATALOG="${ROOT}etc/xml/catalog"
+
+		# we dont want to clobber an existing catalog though,
+		# only ensure that one is there
+		# <obz@gentoo.org>
+		if [ ! -e ${CATALOG} ]; then
+			[ -d "${ROOT}etc/xml" ] || mkdir -p "${ROOT}etc/xml"
+			/usr/bin/xmlcatalog --create > ${CATALOG}
+			einfo "Created XML catalog in ${CATALOG}"
+		fi
+	fi
+}