Fix CVE-2017-0663: https://bugzilla.gnome.org/show_bug.cgi?id=780228 (not yet public) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0663 https://security-tracker.debian.org/tracker/CVE-2017-0663 Patch copied from upstream source repository: https://git.gnome.org/browse/libxml2/commit/?id=92b9e8c8b3787068565a1820ba575d042f9eec66 From 92b9e8c8b3787068565a1820ba575d042f9eec66 Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer Date: Tue, 6 Jun 2017 12:56:28 +0200 Subject: [PATCH] Fix type confusion in xmlValidateOneNamespace Comment out code that casts xmlNsPtr to xmlAttrPtr. ID types on namespace declarations make no practical sense anyway. Fixes bug 780228. Found with libFuzzer and ASan. --- valid.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/valid.c b/valid.c index 8075d3a0..c51ea290 100644 --- a/valid.c +++ b/valid.c @@ -4627,6 +4627,12 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) { } } + /* + * Casting ns to xmlAttrPtr is wrong. We'd need separate functions + * xmlAddID and xmlAddRef for namespace declarations, but it makes + * no practical sense to use ID types anyway. + */ +#if 0 /* Validity Constraint: ID uniqueness */ if (attrDecl->atype == XML_ATTRIBUTE_ID) { if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL) @@ -4638,6 +4644,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) { if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL) ret = 0; } +#endif /* Validity Constraint: Notation Attributes */ if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) { -- 2.14.1 8dba35cc7dfd857fb179659a14b0a1e583'/>
path: root/gnu/build/file-systems.scm
AgeCommit message (Expand)Author
2022-11-20file-systems: Always do recursive bind mounts....Fixes <https://issues.guix.gnu.org/59185>. * guix/build/syscalls.scm (MS_REC): New variable. * gnu/build/file-systems.scm (mount-flags->bit-mask): Set MS_REC bit when bind-mounting. Ricardo Wurmus
2022-11-03file-systems: Gracefully handle EMEDIUMTYPE in 'read-partitions'....* gnu/build/file-systems.scm (ENOENT-safe): Catch EMEDIUMTYPE and warn. Marius Bakke
2022-10-20file-systems: Support the 'no-diratime' mount flag....* gnu/build/file-systems.scm (mount-flags->bit-mask): Handle 'no-diratime'. * doc/guix.texi (File Systems): Document it. Ludovic Courtès
2022-09-08file-systems: Open files with O_CLOEXEC....Since this code is run from PID 1, this ensures file descriptors to sensitive files and devices are not accidentally leaked to sub-processes. * gnu/build/file-systems.scm (call-with-input-file): New procedure. (mount-file-system): Use 'close-fdes' + 'open-fdes'. Ludovic Courtès
2022-08-10gnu: system: file-systems: Add shared flag....* gnu/build/file-systems.scm (mount-flags->bit-mask, mount-file-system): Handle shared flag. * gnu/system/file-systems.scm (invalid-file-system-flags): Add shared to known flags. * guix/build/syscalls.scm (MS_SHARED): New variable. * doc/guix.texi (File Systems): Document shared flag. Oleg Pykhalov
2022-07-01file-systems: Add 'cleanly-unmounted-ext2?'....* gnu/build/file-systems.scm (ext2-superblock-cleanly-unmounted?) (cleanly-unmounted-ext2?): New procedures. Ludovic Courtès
2022-04-08file-systems: Invoke fsck tools with 'system*/tty'....This ensures those programs, if invoked by shepherd (where standard input is /dev/null), can still interact with the user if needed. * gnu/build/file-systems.scm (check-ext2-file-system) (check-bcachefs-file-system, check-btrfs-file-system): (check-fat-file-system, check-jfs-file-system): (check-f2fs-file-system, check-ntfs-file-system): (check-xfs-file-system): Use 'system*/tty' instead of 'system*'. Ludovic Courtès
2022-04-08mapped-devices: Ensure 'cryptsetup open' gets a tty....Fixes <https://issues.guix.gnu.org/54770>. Regression introduced in 400c9ed3d779308e56038305d40cd93acb496180. Previously, for an encrypted /home (say), "cryptsetup open" would be invoked by shepherd, with /dev/null as its standard input. It would thus run in non-interactive mode and, instead of asking for a passphrase, fail with: Nothing to read on input. This change ensures it runs in interactive mode. * gnu/build/file-systems.scm (system*/console, system*/tty): New procedures. * gnu/system/mapped-devices.scm (open-luks-device): Use 'system*/tty' instead of 'system*'. Ludovic Courtès