mirror of
https://github.com/openharmony/third_party_libxml2.git
synced 2026-08-24 23:31:27 -04:00
openharmony_ci
01cdf31afe
修复漏洞CVE-2026-11979 xmlcatalog栈缓冲区溢出 Created-by: Liwuli1234 Commit-by: liwuli Merged-by: openharmony_ci Description: ## 修复漏洞 CVE-2026-11979 Closes #330 ### 漏洞描述 libxml2 的 xmlcatalog 工具在 `--shell` 模式下存在多处栈缓冲区溢出漏洞（CWE-121）。`usershell()` 函数使用固定大小栈缓冲区处理用户输入，缺乏边界检查，可能导致崩溃或潜在代码执行。 上游修复 commit：c2e233fc1b341685fc99621b2768b503f777a72e ### 修改内容 适配上游 commit 为 OpenHarmony third_party/libxml2 v2.14.0 patch： - **新增 patch**：`Fix-CVE-2026-11979-xmlcatalog-overflow-check-for-large-shell-commands.patch` - `xmlcatalog.c` 中 `usershell()` 添加 3 处边界检查： - command 数组溢出检查（`sizeof(command) - 2`） - arg 数组溢出检查（`sizeof(arg) - 2`） - argv 数组溢出检查（`sizeof(argv)/sizeof(char*)`） - **BUILD.gn / install.py / README.md / README_ZH.md**：更新引用 ### 编译验证 cmake 构建 + ctest 7项测试全部通过（0 errors） See merge request: openharmony/third_party_libxml2!159
libxml2
Introduction & Software Architecture
Usage Guidelines
Patch Package Description
The following patches is carried by the libnl3 open source library:
Fix-memleaks-in-xmlXIncludeProcessFlags.patch backport-parser-Fix-potential-memory-leak-in-xmlParseAttValue.patch Fix-memory-leaks-for-xmlACatalogAdd.patch Fix-memory-leaks-in-xmlACatalogAdd-when-xmlHashAddEntry-failed.patch backport-CVE-2022-40303-Fix-integer-overflows-with-XML_PARSE_.patch backport-CVE-2022-40304-Fix-dict-corruption-caused-by-entity-.patch backport-schemas-Fix-null-pointer-deref-in-xmlSchemaCheckCOSS.patch libxml2-multilib.patch