CVE-2024-25062漏洞修补

Signed-off-by: @ran-zhao-yu <ranzhaoyu1@huawei.com>

Fix-CVE-2023-25062.patch

@@ -0,0 +1,29 @@
+From 92721970884fcc13305cb8e23cdc5f0dd7667c2c Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sat, 14 Oct 2023 22:45:54 +0200
+Subject: [PATCH] [CVE-2024-25062] xmlreader: Don't expand XIncludes when
+ backtracking
+
+Fixes a use-after-free if XML Reader if used with DTD validation and
+XInclude expansion.
+
+Fixes #604.
+---
+ xmlreader.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xmlreader.c b/xmlreader.c
+index 5c37738e..1f903306 100644
+--- a/xmlreader.c
++++ b/xmlreader.c
+@@ -1378,6 +1378,7 @@ node_found:
+      * Handle XInclude if asked for
+      */
+     if ((reader->xinclude) && (reader->in_xinclude == 0) &&
++        (reader->state != XML_TEXTREADER_BACKTRACK) &&
+         (reader->node != NULL) &&
+ 	(reader->node->type == XML_ELEMENT_NODE) &&
+ 	(reader->node->ns != NULL) &&
+-- 
+GitLab
+

install.py

@@ -57,7 +57,8 @@ def do_patch(args, target_dir):
         "backport-schemas-Fix-null-pointer-deref-in-xmlSchemaCheckCOSS.patch",
         "libxml2-multilib.patch",
         "Fix-CVE-2023-45322-pre-patch.patch",
-        "Fix-CVE-2023-45322.patch"
+        "Fix-CVE-2023-45322.patch",
+        "Fix-CVE-2023-25062.patch"
     ]
 
     for patch in patch_file: