libxml2: Fix CVE-2026-0992

Backport a patch [1] to fix CVE-2026-0992.

[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/f75abfcaa419a740a3191e56c60400f3ff18988d

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch
new file mode 100644 (file)
index 0000000..5f0602f
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch
@@ -0,0 +1,54 @@
+From f75abfcaa419a740a3191e56c60400f3ff18988d Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Fri, 19 Dec 2025 11:02:18 +0100
+Subject: [PATCH] catalog: Ignore repeated nextCatalog entries
+
+This patch makes the catalog parsing to ignore repeated entries of
+nextCatalog with the same value.
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019
+
+CVE: CVE-2026-0992
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/f75abfcaa419a740a3191e56c60400f3ff18988d]
+
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ catalog.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/catalog.c b/catalog.c
+index 46b877e6..fa6d77ca 100644
+--- a/catalog.c
++++ b/catalog.c
+@@ -1223,9 +1223,27 @@ xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer,
+               BAD_CAST "delegateURI", BAD_CAST "uriStartString",
+               BAD_CAST "catalog", prefer, cgroup);
+     } else if (xmlStrEqual(cur->name, BAD_CAST "nextCatalog")) {
++      xmlCatalogEntryPtr prev = parent->children;
++
+       entry = xmlParseXMLCatalogOneNode(cur, XML_CATA_NEXT_CATALOG,
+               BAD_CAST "nextCatalog", NULL,
+               BAD_CAST "catalog", prefer, cgroup);
++      /* Avoid duplication of nextCatalog */
++      while (prev != NULL) {
++          if ((prev->type == XML_CATA_NEXT_CATALOG) &&
++              (xmlStrEqual (prev->URL, entry->URL)) &&
++              (xmlStrEqual (prev->value, entry->value)) &&
++              (prev->prefer == entry->prefer) &&
++              (prev->group == entry->group)) {
++                  if (xmlDebugCatalogs)
++                      xmlCatalogPrintDebug(
++                          "Ignoring repeated nextCatalog %s\n", entry->URL);
++                  xmlFreeCatalogEntry(entry, NULL);
++                  entry = NULL;
++                  break;
++          }
++          prev = prev->next;
++      }
+     }
+     if (entry != NULL) {
+         if (parent != NULL) {
+-- 
+2.34.1
+

diff --git a/meta/recipes-core/libxml/libxml2_2.15.1.bb b/meta/recipes-core/libxml/libxml2_2.15.1.bb
index c603fb7980e7d950a36d4f2699513e2cc956b649..a64ed8098eab99af48c3b408a80d0adfac2027fe 100644 (file)
--- a/meta/recipes-core/libxml/libxml2_2.15.1.bb
+++ b/meta/recipes-core/libxml/libxml2_2.15.1.bb
@@ -16,6 +16,7 @@ inherit gnomebase
 
 SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testtar \
            file://CVE-2026-0990.patch \
+           file://CVE-2026-0992.patch \
            file://run-ptest \
            file://install-tests.patch \
            file://0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch \