libxml2: Add patch to fix a double free in XPath.

This fixes CVE-2010-4494.

diff --git a/libxml2/libxml2.nm b/libxml2/libxml2.nm
index 8eb4ebf56a1546f025fb5e747d92a524ee22a944..b907dbf7dbc8821695c7539e1e614d3b4ee9787d 100644 (file)
--- a/libxml2/libxml2.nm
+++ b/libxml2/libxml2.nm
@@ -5,7 +5,7 @@
 
 name       = libxml2
 version    = 2.7.8
-release    = 1
+release    = 2
 
 groups     = System/Libraries
 url        = http://xmlsoft.org/
@@ -13,14 +13,14 @@ license    = MIT
 summary    = Library providing XML and HTML support.
 
 description
-       This library allows to manipulate XML files. It includes support \
-       to read, modify and write XML and HTML files. There is DTDs support \
-       this includes parsing and validation even with complex DtDs, either \
-       at parse time or later once the document has been modified. The output \
-       can be a simple SAX stream or and in-memory DOM like representations. \
-       In this case one can use the built-in XPath and XPointer implementation \
-       to select subnodes or ranges. A flexible Input/Output mechanism is \
-       available, with existing HTTP and FTP modules and combined to an URI \
+       This library allows to manipulate XML files. It includes support
+       to read, modify and write XML and HTML files. There is DTDs support
+       this includes parsing and validation even with complex DtDs, either
+       at parse time or later once the document has been modified. The output
+       can be a simple SAX stream or and in-memory DOM like representations.
+       In this case one can use the built-in XPath and XPointer implementation
+       to select subnodes or ranges. A flexible Input/Output mechanism is
+       available, with existing HTTP and FTP modules and combined to an URI
        library.
 end
 

diff --git a/libxml2/patches/libxml2-2.7.7-xpath-double-free.patch b/libxml2/patches/libxml2-2.7.7-xpath-double-free.patch
new file mode 100644 (file)
index 0000000..c5dbbee
--- /dev/null
+++ b/libxml2/patches/libxml2-2.7.7-xpath-double-free.patch
@@ -0,0 +1,22 @@
+--- a/xpath.c  
++++ a/xpath.c  
+@@ -11763,11 +11763,16 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt,
+ 
+           if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
+               xmlXPathObjectPtr tmp;
+-              /* pop the result */
++              /* pop the result if any */
+               tmp = valuePop(ctxt);
+-              xmlXPathReleaseObject(xpctxt, tmp);
+-              /* then pop off contextObj, which will be freed later */
+-              valuePop(ctxt);
++                if (tmp != contextObj) {
++                    /*
++                     * Free up the result
++                     * then pop off contextObj, which will be freed later
++                     */
++                    xmlXPathReleaseObject(xpctxt, tmp);
++                    valuePop(ctxt);
++                }
+               goto evaluation_error;
+           }