← Back to branch summary

~ubuntu-branches/ubuntu/utopic/libxml2/utopic

« back to all changes in this revision

Viewing changes to debian/patches/0029-Do-not-fetch-external-parameter-entities.patch

  • Committer: Package Import Robot
  • Author(s): Aron Xu, Christian Svensson, Daniel Schepler, Helmut Grohne, Adam Conrad, Matthias Klose, Aron Xu
  • Date: 2014-07-09 05:40:15 UTC
  • mto: This revision was merged to the branch mainline in revision 75.
  • Revision ID: package-import@ubuntu.com-20140709054015-rdnfjxrf3zvmw6l7
http://bugs.debian.org/742350
http://bugs.debian.org/738080
http://bugs.debian.org/753005
http://bugs.debian.org/747309
[ Christian Svensson ]
* Do not build-depend on readline (Closes: #742350)

[ Daniel Schepler ]
* Patch to bootstrap without python (Closes: #738080)

[ Helmut Grohne ]
* Drop unneeded B-D on perl and binutils (Closes: #753005)

[ Adam Conrad ]
* Actually run dh_autoreconf, which the old/new mixed rules file misses.

[ Matthias Klose ]
* Add patch to fix python multiarch issue
* Allow the package to cross-build by tweaking B-Ds on python
* Set PYTHON_LIBS for cross builds

[ Aron Xu ]
* Use correct $CC
* Configure udeb without python
* New round of cherry-picking upstream fixes
  - Includes fixes for CVE-2014-0191 (Closes: #747309).
* Call prename with -vf
* Require python-all-dev (>= 2.7.5-5~)
* Bump std-ver: 3.9.4 -> 3.9.5, no change

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/0029-Do-not-fetch-external-parameter-entities.patch
 
1
From: Daniel Veillard <veillard@redhat.com>
 
2
Date: Tue, 22 Apr 2014 15:30:56 +0800
 
3
Subject: Do not fetch external parameter entities
 
4
 
 
5
Unless explicitely asked for when validating or replacing entities
 
6
with their value. Problem pointed out by Daniel Berrange <berrange@redhat.com>
 
7
---
 
8
 parser.c |   14 ++++++++++++++
 
9
 1 file changed, 14 insertions(+)
 
10
 
 
11
diff --git a/parser.c b/parser.c
 
12
index 7381a78..8aad7b4 100644
 
13
--- a/parser.c
 
14
+++ b/parser.c
 
15
@@ -2595,6 +2595,20 @@ xmlParserHandlePEReference(xmlParserCtxtPtr ctxt) {
 
16
                    xmlCharEncoding enc;
 
17
 
 
18
                    /*
 
19
+                    * Note: external parsed entities will not be loaded, it is
 
20
+                    * not required for a non-validating parser, unless the
 
21
+                    * option of validating, or substituting entities were
 
22
+                    * given. Doing so is far more secure as the parser will
 
23
+                    * only process data coming from the document entity by
 
24
+                    * default.
 
25
+                    */
 
26
+                    if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
 
27
+                       ((ctxt->options & XML_PARSE_NOENT) == 0) &&
 
28
+                       ((ctxt->options & XML_PARSE_DTDVALID) == 0) &&
 
29
+                       (ctxt->validate == 0))
 
30
+                       return;
 
31
+
 
32
+                   /*
 
33
                     * handle the extra spaces added before and after
 
34
                     * c.f. http://www.w3.org/TR/REC-xml#as-PE
 
35
                     * this is done independently.