commit | 1b41ec4e9433b05bb0376be4725804c54ef1d80b | [log] [tgz] |
---|---|---|
author | Nick Wellnhofer <wellnhofer@aevum.de> | Wed Aug 31 22:11:25 2022 +0200 |
committer | Nick Wellnhofer <wellnhofer@aevum.de> | Fri Oct 14 14:26:57 2022 +0200 |
tree | a0403fa4a485c35513feb0bd9e7a46e5a3e87353 | |
parent | c846986356fc149915a74972bf198abc266bc2c0 [diff] |
[CVE-2022-40304] Fix dict corruption caused by entity reference cycles When an entity reference cycle is detected, the entity content is cleared by setting its first byte to zero. But the entity content might be allocated from a dict. In this case, the dict entry becomes corrupted leading to all kinds of logic errors, including memory errors like double-frees. Stop storing entity content, orig, ExternalID and SystemID in a dict. These values are unlikely to occur multiple times in a document, so they shouldn't have been stored in a dict in the first place. Thanks to Ned Williamson and Nathan Wachholz working with Google Project Zero for the report!
libxml2 is an XML toolkit implemented in C, originally developed for the GNOME Project.
Full documentation is available at https://gitlab.gnome.org/GNOME/libxml2/-/wikis.
Bugs should be reported at https://gitlab.gnome.org/GNOME/libxml2/-/issues.
A mailing list xml@gnome.org is available. You can subscribe at https://mail.gnome.org/mailman/listinfo/xml. The list archive is at https://mail.gnome.org/archives/xml/.
This code is released under the MIT License, see the Copyright file.
libxml2 can be built with GNU Autotools, CMake, or several other build systems in platform-specific subdirectories.
If you build from a Git tree, you have to install Autotools and start by generating the configuration files with:
./autogen.sh
If you build from a source tarball, extract the archive with:
tar xf libxml2-xxx.tar.gz cd libxml2-xxx
To see a list of build options:
./configure --help
Also see the INSTALL file for additional instructions. Then you can configure and build the library:
./configure [possible options] make
Note that by default, no optimization options are used. You have to enable them manually, for example with:
CFLAGS='-O2 -fno-semantic-interposition' ./configure
Now you can run the test suite with:
make check
Please report test failures to the mailing list or bug tracker.
Then you can install the library:
make install
At that point you may have to rerun ldconfig or a similar utility to update your list of installed shared libs.
Another option for compiling libxml is using CMake:
cmake -E tar xf libxml2-xxx.tar.gz cmake -S libxml2-xxx -B libxml2-xxx-build [possible options] cmake --build libxml2-xxx-build cmake --install libxml2-xxx-build
Common CMake options include:
-D BUILD_SHARED_LIBS=OFF # build static libraries -D CMAKE_BUILD_TYPE=Release # specify build type -D CMAKE_INSTALL_PREFIX=/usr/local # specify the install path -D LIBXML2_WITH_ICONV=OFF # disable iconv -D LIBXML2_WITH_LZMA=OFF # disable liblzma -D LIBXML2_WITH_PYTHON=OFF # disable Python -D LIBXML2_WITH_ZLIB=OFF # disable libz
You can also open the libxml source directory with its CMakeLists.txt directly in various IDEs such as CLion, QtCreator, or Visual Studio.
Libxml does not require any other libraries. A platform with somewhat recent POSIX support should be sufficient (please report any violation to this rule you may find).
However, if found at configuration time, libxml will detect and use the following libraries:
The current version of the code can be found in GNOME's GitLab at at https://gitlab.gnome.org/GNOME/libxml2. The best way to get involved is by creating issues and merge requests on GitLab. Alternatively, you can start discussions and send patches to the mailing list. If you want to work with patches, please format them with git-format-patch and use plain text attachments.
All code must conform to C89 and pass the GitLab CI tests. Add regression tests if possible.