[xml/sgml-pkgs] Bug#774358: libxml2: CVE-2014-3660 patch makes installation-guide FTBFS

[Samuel Thibault]

Source: libxml2
Version: 2.8.0+dfsg1-7+wheezy2
Severity: serious
Justification: makes other package FTBFS

Hello,

The cve-2014-3660.patch patch makes installation-guide FTBFS: 

Entity: line 2: parser error : Detected an entity reference loop
<ulink url="&downloadable-file;images/orion5x/network-console/buffalo/kuroboxpro
                               ^
/tmp/manual/en/install-methods/download/arm.xml:40: parser error : Detected an entity reference loop
                              ^

while there is actually no reference loop there.


It seems cve-2014-3660.patch is assuming that git commit cff2546 is
applied: notably it copies this code as it is:

+                       ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;

but in libxml2 2.8.0, it was still

                       ent->checked = ctxt->nbentities - oldnbent + 1;

and other parts of the code assume that too.  The attached patch fixes
this confusion.

Samuel

-- System Information:
Debian Release: 8.0
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'buildd-unstable'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.18.0 (SMP w/8 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

-- 
Samuel
Accroche-toi au terminal, j'enlève le shell...
 -+- nojhan -+-
-------------- next part --------------
--- /tmp/libxml2-2.8.0+dfsg1/debian/patches/cve-2014-3660.patch.original	2015-01-01 14:48:26.337554556 +0100
+++ /tmp/libxml2-2.8.0+dfsg1/debian/patches/cve-2014-3660.patch	2015-01-01 14:48:53.000874666 +0100
@@ -6,11 +6,11 @@
  parser.c |   42 ++++++++++++++++++++++++++++++++++++++----
  1 file changed, 38 insertions(+), 4 deletions(-)
 
-diff --git a/parser.c b/parser.c
-index 7ef712d..b435913 100644
---- a/parser.c
-+++ b/parser.c
-@@ -127,6 +127,29 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+Index: libxml2-2.8.0+dfsg1/parser.c
+===================================================================
+--- libxml2-2.8.0+dfsg1.orig/parser.c	2015-01-01 13:20:23.913738969 +0000
++++ libxml2-2.8.0+dfsg1/parser.c	2015-01-01 13:47:31.930940787 +0000
+@@ -127,6 +127,27 @@
          return (0);
      if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
          return (1);
@@ -29,10 +29,8 @@
 +	rep = xmlStringDecodeEntities(ctxt, ent->content,
 +				  XML_SUBSTITUTE_REF, 0, 0, 0);
 +
-+	ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
++	ent->checked = ctxt->nbentities - oldnbent + 1;
 +	if (rep != NULL) {
-+	    if (xmlStrchr(rep, '<'))
-+		ent->checked |= 1;
 +	    xmlFree(rep);
 +	    rep = NULL;
 +	}