dev-libs/libxml2: apply several security patches

Security bugs: #560524, #564240 and #564776.
Also fix incorrect lzma support, bug #530386 and fix handling of
documentation and examples with USE=python, bug #533324.

https://bugs.gentoo.org/show_bug.cgi?id=530386
https://bugs.gentoo.org/show_bug.cgi?id=533324
https://bugs.gentoo.org/show_bug.cgi?id=560524
https://bugs.gentoo.org/show_bug.cgi?id=564240
https://bugs.gentoo.org/show_bug.cgi?id=564776

Package-Manager: portage-2.2.23

8 files changed, 360 insertions, 0 deletions

diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-7941-1.patch b/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-7941-1.patch
new file mode 100644
index 000000000000..8a6c98cc42a7
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-7941-1.patch
@@ -0,0 +1,32 @@
+From a7dfab7411cbf545f359dd3157e5df1eb0e7ce31 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Mon, 23 Feb 2015 11:17:35 +0800
+Subject: [PATCH] Stop parsing on entities boundaries errors
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=744980
+
+There are times, like on unterminated entities that it's preferable to
+stop parsing, even if that means less error reporting. Entities are
+feeding the parser on further processing, and if they are ill defined
+then it's possible to get the parser to bug. Also do the same on
+Conditional Sections if the input is broken, as the structure of
+the document can't be guessed.
+---
+ parser.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/parser.c b/parser.c
+index a8d1b67..bbe97eb 100644
+--- a/parser.c
++++ b/parser.c
+@@ -5658,6 +5658,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
+ 	if (RAW != '>') {
+ 	    xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
+ 	            "xmlParseEntityDecl: entity %s not terminated\n", name);
++	    xmlStopParser(ctxt);
+ 	} else {
+ 	    if (input != ctxt->input) {
+ 		xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
+-- 
+2.4.10
+
diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-7941-2.patch b/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-7941-2.patch
new file mode 100644
index 000000000000..df30c8926935
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-7941-2.patch
@@ -0,0 +1,49 @@
+From 9b8512337d14c8ddf662fcb98b0135f225a1c489 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Mon, 23 Feb 2015 11:29:20 +0800
+Subject: [PATCH] Cleanup conditional section error handling
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=744980
+
+The error handling of Conditional Section also need to be
+straightened as the structure of the document can't be
+guessed on a failure there and it's better to stop parsing
+as further errors are likely to be irrelevant.
+---
+ parser.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/parser.c b/parser.c
+index bbe97eb..fe603ac 100644
+--- a/parser.c
++++ b/parser.c
+@@ -6770,6 +6770,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
+ 	SKIP_BLANKS;
+ 	if (RAW != '[') {
+ 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
++	    xmlStopParser(ctxt);
++	    return;
+ 	} else {
+ 	    if (ctxt->input->id != id) {
+ 		xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
+@@ -6830,6 +6832,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
+ 	SKIP_BLANKS;
+ 	if (RAW != '[') {
+ 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
++	    xmlStopParser(ctxt);
++	    return;
+ 	} else {
+ 	    if (ctxt->input->id != id) {
+ 		xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
+@@ -6885,6 +6889,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
+ 
+     } else {
+ 	xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
++	xmlStopParser(ctxt);
++	return;
+     }
+ 
+     if (RAW == 0)
+-- 
+2.4.10
+
diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-8035.patch b/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-8035.patch
new file mode 100644
index 000000000000..f51863e816b1
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-cve-2015-8035.patch
@@ -0,0 +1,31 @@
+From f0709e3ca8f8947f2d91ed34e92e38a4c23eae63 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Tue, 3 Nov 2015 15:31:25 +0800
+Subject: [PATCH] CVE-2015-8035 Fix XZ compression support loop
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=757466
+DoS when parsing specially crafted XML document if XZ support
+is compiled in (which wasn't the case for 2.9.2 and master since
+Nov 2013, fixed in next commit !)
+---
+ xzlib.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/xzlib.c b/xzlib.c
+index 0dcb9f4..1fab546 100644
+--- a/xzlib.c
++++ b/xzlib.c
+@@ -581,6 +581,10 @@ xz_decomp(xz_statep state)
+             xz_error(state, LZMA_DATA_ERROR, "compressed data error");
+             return -1;
+         }
++        if (ret == LZMA_PROG_ERROR) {
++            xz_error(state, LZMA_PROG_ERROR, "compression error");
++            return -1;
++        }
+     } while (strm->avail_out && ret != LZMA_STREAM_END);
+ 
+     /* update available output and crc check value */
+-- 
+2.4.10
+
diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-disable-tests.patch b/dev-libs/libxml2/files/libxml2-2.9.2-disable-tests.patch
index 86d5995138a1..a996bf64a18d 100644
--- a/dev-libs/libxml2/files/libxml2-2.9.2-disable-tests.patch
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-disable-tests.patch
@@ -20,6 +20,15 @@ do not build test programs as we don't install them
  testdso_la_SOURCES = testdso.c
  testdso_la_LDFLAGS = -module -no-undefined -avoid-version -rpath $(libdir)
  
+@@ -202,7 +202,7 @@ runxmlconf_LDADD= $(LDADDS)
+ #testOOM_DEPENDENCIES = $(DEPS)
+ #testOOM_LDADD= $(LDADDS)
+ 
+-runtests:
++runtests: check_PROGRAMS
+ 	[ -d test   ] || $(LN_S) $(srcdir)/test   .
+ 	[ -d result ] || $(LN_S) $(srcdir)/result .
+ 	$(CHECKER) ./runtest$(EXEEXT) && $(CHECKER) ./testrecurse$(EXEEXT) &&$(CHECKER) ./testapi$(EXEEXT) && $(CHECKER) ./testchar$(EXEEXT)&& $(CHECKER) ./testdict$(EXEEXT) && $(CHECKER) ./runxmlconf$(EXEEXT)
 --- a/doc/examples/Makefile.am
 +++ b/doc/examples/Makefile.am
 @@ -13,7 +13,7 @@
diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-fix-lzma.patch b/dev-libs/libxml2/files/libxml2-2.9.2-fix-lzma.patch
new file mode 100644
index 000000000000..e9b6da6fe774
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-fix-lzma.patch
@@ -0,0 +1,114 @@
+From 18b8988511b0954272cac4d6c3e6724f9dbf6e0a Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Tue, 3 Nov 2015 15:46:29 +0800
+Subject: [PATCH] Reenable xz support by default
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=757466
+
+problem was introduced by commit f3f86ff465c92c79f834d7b981f3c7274a8bb5c8
+for https://bugzilla.gnome.org/show_bug.cgi?id=711026
+---
+ configure.ac |  3 +++
+ xmlIO.c      | 12 ++++++------
+ xzlib.c      |  6 ++++--
+ 3 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 14ac0a8..48e0577 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -445,6 +445,9 @@ else
+                 fi],
+                 [have_liblzma=no])
+ 	     LDFLAGS="${SAVE_LDFLAGS}"])
++    else
++	# we still need to check for lzma,h header
++	AC_CHECK_HEADERS([lzma.h])
+     fi
+ 
+     # Found the library via either method?
+diff --git a/xmlIO.c b/xmlIO.c
+index e628ab0..8b13184 100644
+--- a/xmlIO.c
++++ b/xmlIO.c
+@@ -1334,7 +1334,7 @@ xmlGzfileClose (void * context) {
+ }
+ #endif /* HAVE_ZLIB_H */
+ 
+-#ifdef HAVE_LZMA_H
++#ifdef LIBXML_LZMA_ENABLED
+ /************************************************************************
+  *									*
+  *		I/O for compressed file accesses			*
+@@ -1451,7 +1451,7 @@ xmlXzfileClose (void * context) {
+     if (ret < 0) xmlIOErr(0, "xzclose()");
+     return(ret);
+ }
+-#endif /* HAVE_LZMA_H */
++#endif /* LIBXML_LZMA_ENABLED */
+ 
+ #ifdef LIBXML_HTTP_ENABLED
+ /************************************************************************
+@@ -2328,10 +2328,10 @@ xmlRegisterDefaultInputCallbacks(void) {
+     xmlRegisterInputCallbacks(xmlGzfileMatch, xmlGzfileOpen,
+ 	                      xmlGzfileRead, xmlGzfileClose);
+ #endif /* HAVE_ZLIB_H */
+-#ifdef HAVE_LZMA_H
++#ifdef LIBXML_LZMA_ENABLED
+     xmlRegisterInputCallbacks(xmlXzfileMatch, xmlXzfileOpen,
+ 	                      xmlXzfileRead, xmlXzfileClose);
+-#endif /* HAVE_ZLIB_H */
++#endif /* LIBXML_LZMA_ENABLED */
+ 
+ #ifdef LIBXML_HTTP_ENABLED
+     xmlRegisterInputCallbacks(xmlIOHTTPMatch, xmlIOHTTPOpen,
+@@ -2683,7 +2683,7 @@ __xmlParserInputBufferCreateFilename(const char *URI, xmlCharEncoding enc) {
+ #endif
+ 	}
+ #endif
+-#ifdef HAVE_LZMA_H
++#ifdef LIBXML_LZMA_ENABLED
+ 	if ((xmlInputCallbackTable[i].opencallback == xmlXzfileOpen) &&
+ 		(strcmp(URI, "-") != 0)) {
+             ret->compressed = __libxml2_xzcompressed(context);
+@@ -3350,7 +3350,7 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) {
+      * try to establish compressed status of input if not done already
+      */
+     if (in->compressed == -1) {
+-#ifdef HAVE_LZMA_H
++#ifdef LIBXML_LZMA_ENABLED
+ 	if (in->readcallback == xmlXzfileRead)
+             in->compressed = __libxml2_xzcompressed(in->context);
+ #endif
+diff --git a/xzlib.c b/xzlib.c
+index 1fab546..782957f 100644
+--- a/xzlib.c
++++ b/xzlib.c
+@@ -8,7 +8,7 @@
+  */
+ #define IN_LIBXML
+ #include "libxml.h"
+-#ifdef HAVE_LZMA_H
++#ifdef LIBXML_LZMA_ENABLED
+ 
+ #include <string.h>
+ #ifdef HAVE_ERRNO_H
+@@ -34,7 +34,9 @@
+ #ifdef HAVE_ZLIB_H
+ #include <zlib.h>
+ #endif
++#ifdef HAVE_LZMA_H
+ #include <lzma.h>
++#endif
+ 
+ #include "xzlib.h"
+ #include <libxml/xmlmemory.h>
+@@ -799,4 +801,4 @@ __libxml2_xzclose(xzFile file)
+     xmlFree(state);
+     return ret ? ret : LZMA_OK;
+ }
+-#endif /* HAVE_LZMA_H */
++#endif /* LIBXML_LZMA_ENABLED */
+-- 
+2.4.10
+
diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-overflow-conditional-sections-1.patch b/dev-libs/libxml2/files/libxml2-2.9.2-overflow-conditional-sections-1.patch
new file mode 100644
index 000000000000..bb0766a559dc
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-overflow-conditional-sections-1.patch
@@ -0,0 +1,32 @@
+From bd0526e66a56e75a18da8c15c4750db8f801c52d Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Fri, 23 Oct 2015 19:02:28 +0800
+Subject: Another variation of overflow in Conditional sections
+
+Which happen after the previous fix to
+https://bugzilla.gnome.org/show_bug.cgi?id=756456
+
+But stopping the parser and exiting we didn't pop the intermediary entities
+and doing the SKIP there applies on an input which may be too small
+---
+ parser.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index a65e4cc..b9217ff 100644
+--- a/parser.c
++++ b/parser.c
+@@ -6915,7 +6915,9 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
+ 	"All markup of the conditional section is not in the same entity\n",
+ 				 NULL, NULL);
+ 	}
+-        SKIP(3);
++	if ((ctxt-> instate != XML_PARSER_EOF) &&
++	    ((ctxt->input->cur + 3) < ctxt->input->end))
++	    SKIP(3);
+     }
+ }
+ 
+-- 
+cgit v0.11.2
+
diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-overflow-conditional-sections-2.patch b/dev-libs/libxml2/files/libxml2-2.9.2-overflow-conditional-sections-2.patch
new file mode 100644
index 000000000000..1a059fe40b0d
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-overflow-conditional-sections-2.patch
@@ -0,0 +1,28 @@
+From 41ac9049a27f52e7a1f3b341f8714149fc88d450 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Tue, 27 Oct 2015 10:53:44 +0800
+Subject: Fix an error in previous Conditional section patch
+
+an off by one mistake in the change, led to error on correct
+document where the end of the included entity was exactly
+the end of the conditional section, leading to regtest failure
+---
+ parser.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index b9217ff..d67b300 100644
+--- a/parser.c
++++ b/parser.c
+@@ -6916,7 +6916,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
+ 				 NULL, NULL);
+ 	}
+ 	if ((ctxt-> instate != XML_PARSER_EOF) &&
+-	    ((ctxt->input->cur + 3) < ctxt->input->end))
++	    ((ctxt->input->cur + 3) <= ctxt->input->end))
+ 	    SKIP(3);
+     }
+ }
+-- 
+cgit v0.11.2
+
diff --git a/dev-libs/libxml2/files/libxml2-2.9.2-unclosed-comments.patch b/dev-libs/libxml2/files/libxml2-2.9.2-unclosed-comments.patch
new file mode 100644
index 000000000000..bd4e482c3479
--- /dev/null
+++ b/dev-libs/libxml2/files/libxml2-2.9.2-unclosed-comments.patch
@@ -0,0 +1,65 @@
+From e724879d964d774df9b7969fc846605aa1bac54c Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Fri, 30 Oct 2015 21:14:55 +0800
+Subject: Fix parsing short unclosed comment uninitialized access
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=746048
+The HTML parser was too optimistic when processing comments and
+didn't check for the end of the stream on the first 2 characters
+---
+ HTMLparser.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/HTMLparser.c b/HTMLparser.c
+index 19c10c3..bdf7807 100644
+--- a/HTMLparser.c
++++ b/HTMLparser.c
+@@ -3264,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
+ 	ctxt->instate = state;
+ 	return;
+     }
++    len = 0;
++    buf[len] = 0;
+     q = CUR_CHAR(ql);
++    if (!IS_CHAR(q))
++        goto unfinished;
+     NEXTL(ql);
+     r = CUR_CHAR(rl);
++    if (!IS_CHAR(r))
++        goto unfinished;
+     NEXTL(rl);
+     cur = CUR_CHAR(l);
+-    len = 0;
+     while (IS_CHAR(cur) &&
+            ((cur != '>') ||
+ 	    (r != '-') || (q != '-'))) {
+@@ -3300,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
+ 	}
+     }
+     buf[len] = 0;
+-    if (!IS_CHAR(cur)) {
+-	htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
+-	             "Comment not terminated \n<!--%.50s\n", buf, NULL);
+-	xmlFree(buf);
+-    } else {
++    if (IS_CHAR(cur)) {
+         NEXT;
+ 	if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
+ 	    (!ctxt->disableSAX))
+ 	    ctxt->sax->comment(ctxt->userData, buf);
+ 	xmlFree(buf);
++	ctxt->instate = state;
++	return;
+     }
+-    ctxt->instate = state;
++
++unfinished:
++    htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
++		 "Comment not terminated \n<!--%.50s\n", buf, NULL);
++    xmlFree(buf);
+ }
+ 
+ /**
+-- 
+cgit v0.11.2
+