libxml2: Fix CVE-2026-0990

Backport a patch [1] to fix CVE-2026-0990.

[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
new file mode 100644 (file)
index 0000000..6b2b879
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
@@ -0,0 +1,81 @@
+From 1961208e958ca22f80a0b4e4c9d71cfa050aa982 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Wed, 17 Dec 2025 15:24:08 +0100
+Subject: [PATCH] catalog: prevent inf recursion in xmlCatalogXMLResolveURI
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
+
+CVE: CVE-2026-0990
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982]
+
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ catalog.c | 31 +++++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+diff --git a/catalog.c b/catalog.c
+index 76c063a8..46b877e6 100644
+--- a/catalog.c
++++ b/catalog.c
+@@ -2025,12 +2025,21 @@ static xmlChar *
+ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
+     xmlChar *ret = NULL;
+     xmlChar *urnID = NULL;
++    xmlCatalogEntryPtr cur = NULL;
+ 
+     if (catal == NULL)
+         return(NULL);
+     if (URI == NULL)
+       return(NULL);
+ 
++    if (catal->depth > MAX_CATAL_DEPTH) {
++      xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION,
++                    "Detected recursion in catalog %s\n",
++                    catal->name, NULL, NULL);
++      return(NULL);
++    }
++    catal->depth++;
++
+     if (!xmlStrncmp(URI, BAD_CAST XML_URN_PUBID, sizeof(XML_URN_PUBID) - 1)) {
+       urnID = xmlCatalogUnWrapURN(URI);
+       if (xmlDebugCatalogs) {
+@@ -2044,21 +2053,27 @@ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
+       ret = xmlCatalogListXMLResolve(catal, urnID, NULL);
+       if (urnID != NULL)
+           xmlFree(urnID);
++      catal->depth--;
+       return(ret);
+     }
+-    while (catal != NULL) {
+-      if (catal->type == XML_CATA_CATALOG) {
+-          if (catal->children == NULL) {
+-              xmlFetchXMLCatalogFile(catal);
++    cur = catal;
++    while (cur != NULL) {
++      if (cur->type == XML_CATA_CATALOG) {
++          if (cur->children == NULL) {
++              xmlFetchXMLCatalogFile(cur);
+           }
+-          if (catal->children != NULL) {
+-              ret = xmlCatalogXMLResolveURI(catal->children, URI);
+-              if (ret != NULL)
++          if (cur->children != NULL) {
++              ret = xmlCatalogXMLResolveURI(cur->children, URI);
++              if (ret != NULL) {
++                  catal->depth--;
+                   return(ret);
++              }
+           }
+       }
+-      catal = catal->next;
++      cur = cur->next;
+     }
++
++    catal->depth--;
+     return(ret);
+ }
+ 
+-- 
+2.34.1
+

diff --git a/meta/recipes-core/libxml/libxml2_2.15.1.bb b/meta/recipes-core/libxml/libxml2_2.15.1.bb
index 736aaea00e33d1012fe30c73b2d8ceb1591c1267..c603fb7980e7d950a36d4f2699513e2cc956b649 100644 (file)
--- a/meta/recipes-core/libxml/libxml2_2.15.1.bb
+++ b/meta/recipes-core/libxml/libxml2_2.15.1.bb
@@ -15,6 +15,7 @@ GNOMEBASEBUILDCLASS = "autotools"
 inherit gnomebase
 
 SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testtar \
+           file://CVE-2026-0990.patch \
            file://run-ptest \
            file://install-tests.patch \
            file://0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch \