Moritz Buhl writes: > Hi ports@, > > A new libxml release is out (two actally) > http://www.xmlsoft.org/news.html > https://gitlab.gnome.org/GNOME/libxml2/-/commit/b48e77cf4f6fa0792c5f4b639707a2b0675e461b > > This fixes CVE-2021-3541. > > I updated the version and removed previous patches for CVE-2021-3537 > and CVE-2020-7595. > > make test passes with no errors. > > mbuhl
Thanks for this. It is similar to something I have in mystuff. This does not incorporate daniel@'s diff for unbreaking python 3.9 yet. Here is a fresh diff with some additions: - major bump - move to gnome's gitlab to avoid using ftp (as suggested by tj@) - CONFIGURE_STYLE autoreconf - translate patches from Makefile.in --> Makefile.am - remove parser.c CVE fixes already applied upstream Questions ========= Can I manually edit plist to remove the following? +lib/python${MODPY_VERSION}/ +lib/python${MODPY_VERSION}/site-packages/ explanation for major bump ========================== check_sym output: https://namtsui.com/public/libxml_check_sym.txt check_sym revealed that xmlPopOutputCallbacks is a new function (defined in ${WRKSRC}/include/libxml/xmlIO.h) justifying a minor bump. However, I diffed all headers and found two reasons for a major bump. Reason 1: https://gitlab.gnome.org/GNOME/libxml2/-/commit/ce00c36e654f0a5291d48bc437e807daecbd8449 void * *pushTab --> xmlStartTag *pushTab "'pushTab' was only used by the push parser... so the change to the public headers should be safe." Even though upstream states this, because it is in a public header, I think this can cause a major bump due to types changing in an incompatible way. (50% confidence) Reason 2: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1fe385304f11332ddb232571d54d36a5aeca0398 upstream claims never part of a public release, but the previous distfile has maxDepth and maxParserDepth. Removing this from the struct is reason for a major bump. (100% confidence) Testing ======= I tested SUBPACKAGE=-python using texproc/itstool. `make test' passes. If there is positive feedback can this be put through a bulk? Feedback and tests are welcome. OK? Index: Makefile =================================================================== RCS file: /cvs/ports/textproc/libxml/Makefile,v retrieving revision 1.188 diff -u -p -r1.188 Makefile --- Makefile 12 May 2021 11:22:35 -0000 1.188 +++ Makefile 15 May 2021 11:33:08 -0000 @@ -3,15 +3,13 @@ COMMENT-main= XML parsing library COMMENT-python= Python bindings for libxml -VERSION= 2.9.10 -REVISION-main= 4 -REVISION-python= 5 -DISTNAME= libxml2-${VERSION} +VERSION= 2.9.12 +DISTNAME= libxml2-v${VERSION} PKGNAME-main= libxml-${VERSION} PKGNAME-python= py3-libxml-${VERSION} -SHARED_LIBS += xml2 16.1 # 11.9 +SHARED_LIBS += xml2 17.0 # 11.9 CATEGORIES= textproc -MASTER_SITES= ftp://xmlsoft.org/libxml/ +MASTER_SITES= https://gitlab.gnome.org/GNOME/libxml2/-/archive/v${VERSION}/ HOMEPAGE= http://xmlsoft.org/ @@ -23,8 +21,9 @@ WANTLIB= iconv lzma m z LIB_DEPENDS= archivers/xz \ converters/libiconv -CONFIGURE_STYLE= autoconf +CONFIGURE_STYLE= autoreconf AUTOCONF_VERSION= 2.69 +AUTOMAKE_VERSION= 1.16 CONFIGURE_ARGS+= --enable-static \ --with-html-dir="${PREFIX}/share/doc" \ --with-html-subdir="libxml2/html" \ Index: distinfo =================================================================== RCS file: /cvs/ports/textproc/libxml/distinfo,v retrieving revision 1.57 diff -u -p -r1.57 distinfo --- distinfo 1 Nov 2019 15:37:45 -0000 1.57 +++ distinfo 15 May 2021 11:33:08 -0000 @@ -1,2 +1,2 @@ -SHA256 (libxml2-2.9.10.tar.gz) = qv7hk/+4/gyC1K/vbvkZcsuvX+6hAO3C8mJ1BhG0vh8= -SIZE (libxml2-2.9.10.tar.gz) = 5624761 +SHA256 (libxml2-v2.9.12.tar.gz) = mL+nqaXip1Y4QiBQdARI7p8Cv03CB1yYItd0fV/55hc= +SIZE (libxml2-v2.9.12.tar.gz) = 5233674 Index: patches/patch-Makefile_am =================================================================== RCS file: patches/patch-Makefile_am diff -N patches/patch-Makefile_am --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-Makefile_am 15 May 2021 11:33:08 -0000 @@ -0,0 +1,43 @@ +$OpenBSD$ + +DEPS: Fix parallel build. gmake recognizes libxml2.la and ./libxml2.la +as equivalent, ours does not. + +Index: Makefile.am +--- Makefile.am.orig ++++ Makefile.am +@@ -57,7 +57,7 @@ libxml2_la_SOURCES = SAX.c entities.c encoding.c error + xmlwriter.c legacy.c chvalid.c pattern.c xmlsave.c \ + xmlmodule.c schematron.c xzlib.c + +-DEPS = $(top_builddir)/libxml2.la ++DEPS = libxml2.la + LDADDS = $(STATIC_BINARIES) $(top_builddir)/libxml2.la $(THREAD_LIBS) $(Z_LIBS) $(LZMA_LIBS) $(ICONV_LIBS) $(M_LIBS) $(WIN32_EXTRA_LIBADD) + + +@@ -202,7 +202,7 @@ runtests: runtest$(EXEEXT) testrecurse$(EXEEXT) testap + testchar$(EXEEXT) testdict$(EXEEXT) runxmlconf$(EXEEXT) + [ -d test ] || $(LN_S) $(srcdir)/test . + [ -d result ] || $(LN_S) $(srcdir)/result . +- $(CHECKER) ./runtest$(EXEEXT) && \ ++ $(CHECKER) ./runtest$(EXEEXT) ; \ + $(CHECKER) ./testrecurse$(EXEEXT) && \ + ASAN_OPTIONS="$$ASAN_OPTIONS:detect_leaks=0" $(CHECKER) ./testapi$(EXEEXT) && \ + $(CHECKER) ./testchar$(EXEEXT) && \ +@@ -730,6 +730,7 @@ SVGtests : xmllint$(EXEEXT) + grep "MORY ALLO" .memdump | grep -v "MEMORY ALLOCATED : 0";\ + else \ + echo Testing $$name ; \ ++ echo " $(CHECKER) $(top_builddir)/xmllint$(EXEEXT) --noout --relaxng $$i $$j" ; \ + $(CHECKER) $(top_builddir)/xmllint $$i > result.$$name ; \ + grep "MORY ALLO" .memdump | grep -v "MEMORY ALLOCATED : 0";\ + diff $(srcdir)/result/SVG/$$name result.$$name ; \ +@@ -1274,7 +1275,7 @@ cmake_DATA = libxml2-config.cmake + # Install the tests program sources as examples + # + BASE_DIR=$(datadir)/doc +-DOC_MODULE=libxml2-$(VERSION) ++DOC_MODULE=libxml2 + EXAMPLES_DIR=$(BASE_DIR)/$(DOC_MODULE)/examples + + install-data-local: Index: patches/patch-Makefile_in =================================================================== RCS file: patches/patch-Makefile_in diff -N patches/patch-Makefile_in --- patches/patch-Makefile_in 1 Nov 2019 15:37:45 -0000 1.11 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,43 +0,0 @@ -$OpenBSD: patch-Makefile_in,v 1.11 2019/11/01 15:37:45 jasper Exp $ - -DEPS: Fix parallel build. gmake recognizes libxml2.la and ./libxml2.la -as equivalent, ours does not. - -Index: Makefile.in ---- Makefile.in.orig -+++ Makefile.in -@@ -754,7 +754,7 @@ libxml2_la_SOURCES = SAX.c entities.c encoding.c error - xmlwriter.c legacy.c chvalid.c pattern.c xmlsave.c \ - xmlmodule.c schematron.c xzlib.c - --DEPS = $(top_builddir)/libxml2.la -+DEPS = libxml2.la - LDADDS = $(STATIC_BINARIES) $(top_builddir)/libxml2.la $(THREAD_LIBS) $(Z_LIBS) $(LZMA_LIBS) $(ICONV_LIBS) $(M_LIBS) $(WIN32_EXTRA_LIBADD) - man_MANS = xml2-config.1 libxml.3 - m4datadir = $(datadir)/aclocal -@@ -880,7 +880,7 @@ cmake_DATA = libxml2-config.cmake - # Install the tests program sources as examples - # - BASE_DIR = $(datadir)/doc --DOC_MODULE = libxml2-$(VERSION) -+DOC_MODULE = libxml2 - EXAMPLES_DIR = $(BASE_DIR)/$(DOC_MODULE)/examples - - # -@@ -2089,7 +2089,7 @@ runtests: runtest$(EXEEXT) testrecurse$(EXEEXT) testap - testchar$(EXEEXT) testdict$(EXEEXT) runxmlconf$(EXEEXT) - [ -d test ] || $(LN_S) $(srcdir)/test . - [ -d result ] || $(LN_S) $(srcdir)/result . -- $(CHECKER) ./runtest$(EXEEXT) && \ -+ $(CHECKER) ./runtest$(EXEEXT) ; \ - $(CHECKER) ./testrecurse$(EXEEXT) && \ - ASAN_OPTIONS="$$ASAN_OPTIONS:detect_leaks=0" $(CHECKER) ./testapi$(EXEEXT) && \ - $(CHECKER) ./testchar$(EXEEXT) && \ -@@ -2616,6 +2616,7 @@ SVGtests : xmllint$(EXEEXT) - grep "MORY ALLO" .memdump | grep -v "MEMORY ALLOCATED : 0";\ - else \ - echo Testing $$name ; \ -+ echo " $(CHECKER) $(top_builddir)/xmllint$(EXEEXT) --noout --relaxng $$i $$j" ; \ - $(CHECKER) $(top_builddir)/xmllint $$i > result.$$name ; \ - grep "MORY ALLO" .memdump | grep -v "MEMORY ALLOCATED : 0";\ - diff $(srcdir)/result/SVG/$$name result.$$name ; \ Index: patches/patch-configure_ac =================================================================== RCS file: /cvs/ports/textproc/libxml/patches/patch-configure_ac,v retrieving revision 1.4 diff -u -p -r1.4 patch-configure_ac --- patches/patch-configure_ac 14 Mar 2018 08:20:49 -0000 1.4 +++ patches/patch-configure_ac 15 May 2021 11:33:08 -0000 @@ -2,7 +2,7 @@ $OpenBSD: patch-configure_ac,v 1.4 2018/ Index: configure.ac --- configure.ac.orig +++ configure.ac -@@ -539,7 +539,7 @@ dnl Checks for library functions. +@@ -544,7 +544,7 @@ dnl Checks for library functions. AC_FUNC_STRFTIME AC_CHECK_FUNCS(strftime localtime gettimeofday ftime) AC_CHECK_FUNCS(stat signal) Index: patches/patch-parser_c =================================================================== RCS file: patches/patch-parser_c diff -N patches/patch-parser_c --- patches/patch-parser_c 11 May 2021 07:39:24 -0000 1.21 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,43 +0,0 @@ -$OpenBSD: patch-parser_c,v 1.21 2021/05/11 07:39:24 bluhm Exp $ - -https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076 -CVE-2020-7595 - -https://bugzilla.redhat.com/show_bug.cgi?id=1956522 -https://gitlab.gnome.org/GNOME/libxml2/commit/babe75030c7f64a37826bb3342317134568bef61 -CVE-2021-3537 - -Index: parser.c ---- parser.c.orig -+++ parser.c -@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, cons - else - c = 0; - while ((c != 0) && (c != end) && /* non input consuming loop */ -- (c != end2) && (c != end3)) { -+ (c != end2) && (c != end3) && -+ (ctxt->instate != XML_PARSER_EOF)) { - - if (c == 0) break; - if ((c == '&') && (str[1] == '#')) { -@@ -6194,6 +6195,8 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPt - SKIP_BLANKS; - cur = ret = xmlParseElementChildrenContentDeclPriv(ctxt, inputid, - depth + 1); -+ if (cur == NULL) -+ return(NULL); - SKIP_BLANKS; - GROW; - } else { -@@ -6327,6 +6330,11 @@ xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPt - SKIP_BLANKS; - last = xmlParseElementChildrenContentDeclPriv(ctxt, inputid, - depth + 1); -+ if (last == NULL) { -+ if (ret != NULL) -+ xmlFreeDocElementContent(ctxt->myDoc, ret); -+ return(NULL); -+ } - SKIP_BLANKS; - } else { - elem = xmlParseName(ctxt); Index: patches/patch-python_Makefile_am =================================================================== RCS file: patches/patch-python_Makefile_am diff -N patches/patch-python_Makefile_am --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-python_Makefile_am 15 May 2021 11:33:08 -0000 @@ -0,0 +1,13 @@ +$OpenBSD$ + +Index: python/Makefile.am +--- python/Makefile.am.orig ++++ python/Makefile.am +@@ -4,7 +4,6 @@ AUTOMAKE_OPTIONS = 1.4 foreign + SUBDIRS = . tests + + docsdir = $(datadir)/doc/libxml2-python-$(LIBXML_VERSION) +-dist_docs_DATA = TODO + + EXTRA_DIST = \ + setup.py \ Index: patches/patch-python_Makefile_in =================================================================== RCS file: patches/patch-python_Makefile_in diff -N patches/patch-python_Makefile_in --- patches/patch-python_Makefile_in 1 Nov 2019 15:37:45 -0000 1.19 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,13 +0,0 @@ -$OpenBSD: patch-python_Makefile_in,v 1.19 2019/11/01 15:37:45 jasper Exp $ -Index: python/Makefile.in ---- python/Makefile.in.orig -+++ python/Makefile.in -@@ -909,7 +909,7 @@ info: info-recursive - - info-am: - --install-data-am: install-dist_docsDATA install-dist_pythonDATA \ -+install-data-am: install-dist_pythonDATA \ - install-pythonLTLIBRARIES - - install-dvi: install-dvi-recursive Index: patches/patch-python_libxml_c =================================================================== RCS file: /cvs/ports/textproc/libxml/patches/patch-python_libxml_c,v retrieving revision 1.1 diff -u -p -r1.1 patch-python_libxml_c --- patches/patch-python_libxml_c 10 Jun 2020 22:54:58 -0000 1.1 +++ patches/patch-python_libxml_c 15 May 2021 11:33:08 -0000 @@ -5,7 +5,7 @@ https://gitlab.gnome.org/GNOME/libxml2/- Index: python/libxml.c --- python/libxml.c.orig +++ python/libxml.c -@@ -1620,6 +1620,7 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNUSED void *ctx, +@@ -1621,6 +1621,7 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNUSED void *ctx, PyObject *message; PyObject *result; char str[1000]; @@ -13,7 +13,7 @@ Index: python/libxml.c #ifdef DEBUG_ERROR printf("libxml_xmlErrorFuncHandler(%p, %s, ...) called\n", ctx, msg); -@@ -1636,12 +1637,20 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNUSED void *ctx, +@@ -1637,12 +1638,20 @@ libxml_xmlErrorFuncHandler(ATTRIBUTE_UNUSED void *ctx, str[999] = 0; va_end(ap); Index: patches/patch-python_tests_Makefile_am =================================================================== RCS file: patches/patch-python_tests_Makefile_am diff -N patches/patch-python_tests_Makefile_am --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-python_tests_Makefile_am 15 May 2021 11:33:08 -0000 @@ -0,0 +1,13 @@ +$OpenBSD$ + +Index: python/tests/Makefile.am +--- python/tests/Makefile.am.orig ++++ python/tests/Makefile.am +@@ -37,7 +37,6 @@ PYTESTS= \ + readererr.py\ + relaxng.py \ + schema.py \ +- thread2.py \ + sync.py \ + tstLastError.py \ + indexes.py \ Index: patches/patch-python_tests_Makefile_in =================================================================== RCS file: patches/patch-python_tests_Makefile_in diff -N patches/patch-python_tests_Makefile_in --- patches/patch-python_tests_Makefile_in 1 Nov 2019 15:37:45 -0000 1.19 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,12 +0,0 @@ -$OpenBSD: patch-python_tests_Makefile_in,v 1.19 2019/11/01 15:37:45 jasper Exp $ -Index: python/tests/Makefile.in ---- python/tests/Makefile.in.orig -+++ python/tests/Makefile.in -@@ -425,7 +425,6 @@ PYTESTS = \ - readererr.py\ - relaxng.py \ - schema.py \ -- thread2.py \ - sync.py \ - tstLastError.py \ - indexes.py \ Index: patches/patch-xstc_Makefile_am =================================================================== RCS file: patches/patch-xstc_Makefile_am diff -N patches/patch-xstc_Makefile_am --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-xstc_Makefile_am 15 May 2021 11:33:08 -0000 @@ -0,0 +1,23 @@ +$OpenBSD$ + +Index: xstc/Makefile.am +--- xstc/Makefile.am.orig ++++ xstc/Makefile.am +@@ -41,7 +41,7 @@ $(TESTDIRS) Tests/Metadata/$(NISTTESTDEF_2) Tests/Meta + else echo "Dont' know how to fetch $(TARBALLURL_2)" ; fi ; fi ; fi) + -@(if [ -f $(TARBALL_2) ] ; then \ + echo -n "extracting test data (NIST)..." ; \ +- $(TAR) -xzf $(TARBALL_2) --wildcards '*/Datatypes' '*/Metadata/$(NISTTESTDEF_2)' ; \ ++ $(TAR) -xzf $(TARBALL_2) '*/Datatypes' '*/Metadata/$(NISTTESTDEF_2)' ; \ + echo "done" ; \ + fi) + -@(if [ ! -f $(TARBALL) ] ; then \ +@@ -53,7 +53,7 @@ $(TESTDIRS) Tests/Metadata/$(NISTTESTDEF_2) Tests/Meta + else echo "Dont' know how to fetch $(TARBALLURL)" ; fi ; fi ; fi) + -@(if [ -f $(TARBALL) ] ; then \ + echo -n "extracting test data (Sun, Microsoft)..." ; \ +- $(TAR) -C Tests -xzf $(TARBALL) --wildcards '*/suntest' '*/msxsdtest' '*/$(MSTESTDEF)' '*/$(SUNTESTDEF)' ; \ ++ $(TAR) -C Tests -xzf $(TARBALL) '*/suntest' '*/msxsdtest' '*/$(MSTESTDEF)' '*/$(SUNTESTDEF)' ; \ + if [ -d Tests/suntest ] ; then rm -r Tests/suntest ; fi ; \ + if [ -d Tests/msxsdtest ] ; then rm -r Tests/msxsdtest ; fi ; \ + mv Tests/xmlschema2002-01-16/* Tests ; \ Index: patches/patch-xstc_Makefile_in =================================================================== RCS file: patches/patch-xstc_Makefile_in diff -N patches/patch-xstc_Makefile_in --- patches/patch-xstc_Makefile_in 1 Nov 2019 15:37:45 -0000 1.12 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,22 +0,0 @@ -$OpenBSD: patch-xstc_Makefile_in,v 1.12 2019/11/01 15:37:45 jasper Exp $ -Index: xstc/Makefile.in ---- xstc/Makefile.in.orig -+++ xstc/Makefile.in -@@ -596,7 +596,7 @@ $(TESTDIRS) Tests/Metadata/$(NISTTESTDEF_2) Tests/Meta - else echo "Dont' know how to fetch $(TARBALLURL_2)" ; fi ; fi ; fi) - -@(if [ -f $(TARBALL_2) ] ; then \ - echo -n "extracting test data (NIST)..." ; \ -- $(TAR) -xzf $(TARBALL_2) --wildcards '*/Datatypes' '*/Metadata/$(NISTTESTDEF_2)' ; \ -+ $(TAR) -xzf $(TARBALL_2) '*/Datatypes' '*/Metadata/$(NISTTESTDEF_2)' ; \ - echo "done" ; \ - fi) - -@(if [ ! -f $(TARBALL) ] ; then \ -@@ -608,7 +608,7 @@ $(TESTDIRS) Tests/Metadata/$(NISTTESTDEF_2) Tests/Meta - else echo "Dont' know how to fetch $(TARBALLURL)" ; fi ; fi ; fi) - -@(if [ -f $(TARBALL) ] ; then \ - echo -n "extracting test data (Sun, Microsoft)..." ; \ -- $(TAR) -C Tests -xzf $(TARBALL) --wildcards '*/suntest' '*/msxsdtest' '*/$(MSTESTDEF)' '*/$(SUNTESTDEF)' ; \ -+ $(TAR) -C Tests -xzf $(TARBALL) '*/suntest' '*/msxsdtest' '*/$(MSTESTDEF)' '*/$(SUNTESTDEF)' ; \ - if [ -d Tests/suntest ] ; then rm -r Tests/suntest ; fi ; \ - if [ -d Tests/msxsdtest ] ; then rm -r Tests/msxsdtest ; fi ; \ - mv Tests/xmlschema2002-01-16/* Tests ; \ Index: pkg/PLIST-main =================================================================== RCS file: /cvs/ports/textproc/libxml/pkg/PLIST-main,v retrieving revision 1.12 diff -u -p -r1.12 PLIST-main --- pkg/PLIST-main 1 Feb 2020 20:35:32 -0000 1.12 +++ pkg/PLIST-main 15 May 2021 11:33:08 -0000 @@ -61,6 +61,8 @@ lib/cmake/libxml2/libxml2-config.cmake lib/libxml2.la @lib lib/libxml2.so.${LIBxml2_VERSION} lib/pkgconfig/libxml-2.0.pc +lib/python${MODPY_VERSION}/ +lib/python${MODPY_VERSION}/site-packages/ lib/xml2Conf.sh @man man/man1/xml2-config.1 @man man/man1/xmlcatalog.1 @@ -185,6 +187,8 @@ share/doc/libxml2/html/tutorial/ar01s06. share/doc/libxml2/html/tutorial/ar01s07.html share/doc/libxml2/html/tutorial/ar01s08.html share/doc/libxml2/html/tutorial/ar01s09.html +share/doc/libxml2/html/tutorial/customfo.xsl +share/doc/libxml2/html/tutorial/customhtml.xsl share/doc/libxml2/html/tutorial/images/ share/doc/libxml2/html/tutorial/images/blank.png share/doc/libxml2/html/tutorial/images/callouts/ @@ -216,10 +220,12 @@ share/doc/libxml2/html/tutorial/includea share/doc/libxml2/html/tutorial/includeconvert.c share/doc/libxml2/html/tutorial/includegetattribute.c share/doc/libxml2/html/tutorial/includekeyword.c +share/doc/libxml2/html/tutorial/includestory.xml share/doc/libxml2/html/tutorial/includexpath.c share/doc/libxml2/html/tutorial/index.html share/doc/libxml2/html/tutorial/ix01.html share/doc/libxml2/html/tutorial/xmltutorial.pdf +share/doc/libxml2/html/tutorial/xmltutorial.xml share/doc/libxml2/html/w3c.png share/doc/libxml2/html/writer.xml share/doc/libxml2/html/xml.html