Accepting request 1294383 from devel:libraries:c_c++

- security update
- added patches
  CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between stylesheet and source nodes
  + libxslt-CVE-2025-7424.patch

OBS-URL: https://build.opensuse.org/request/show/1294383
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libxslt?expand=0&rev=73

libxslt-1.1.42.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:85ca62cac0d41fc77d3f6033da9df6fd73d20ea2fc18b0a3609ffb4110e1baeb
-size 1573668

libxslt-CVE-2025-7424.patch

@@ -0,0 +1,99 @@
+From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
+From: David Kilzer <ddkilzer@apple.com>
+Date: Sat, 24 May 2025 15:06:42 -0700
+Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
+ and source nodes
+
+* libxslt/functions.c:
+(xsltDocumentFunctionLoadDocument):
+- Implement fix suggested by Ivan Fratric.  This copies the xmlDoc,
+  calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
+  xmlDoc to tctxt->docList.
+- Add error handling for functions that may return NULL.
+* libxslt/transform.c:
+- Remove static keyword so this can be called from
+  xsltDocumentFunctionLoadDocument().
+* libxslt/transformInternals.h: Add.
+(xsltCleanupSourceDoc): Add declaration.
+
+Fixes #139.
+---
+ libxslt/functions.c          | 16 +++++++++++++++-
+ libxslt/transform.c          |  3 ++-
+ libxslt/transformInternals.h |  9 +++++++++
+ 3 files changed, 26 insertions(+), 2 deletions(-)
+ create mode 100644 libxslt/transformInternals.h
+
+diff --git a/libxslt/functions.c b/libxslt/functions.c
+index 72a58dc4..11ec039f 100644
+--- a/libxslt/functions.c
++++ b/libxslt/functions.c
+@@ -34,6 +34,7 @@
+ #include "numbersInternals.h"
+ #include "keys.h"
+ #include "documents.h"
++#include "transformInternals.h"
+ 
+ #ifdef WITH_XSLT_DEBUG
+ #define WITH_XSLT_DEBUG_FUNCTION
+@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt,
+ 	    /*
+ 	    * This selects the stylesheet's doc itself.
+ 	    */
+-	    doc = tctxt->style->doc;
++	    doc = xmlCopyDoc(tctxt->style->doc, 1);
++	    if (doc == NULL) {
++		xsltTransformError(tctxt, NULL, NULL,
++		    "document() : failed to copy style doc\n");
++		goto out_fragment;
++	    }
++	    xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
++	    idoc = xsltNewDocument(tctxt, doc);
++	    if (idoc == NULL) {
++		xsltTransformError(tctxt, NULL, NULL,
++		    "document() : failed to create xsltDocument\n");
++		xmlFreeDoc(doc);
++		goto out_fragment;
++	    }
+ 	} else {
+             goto out_fragment;
+ 	}
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 54ef821b..38c2dce6 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -43,6 +43,7 @@
+ #include "xsltlocale.h"
+ #include "pattern.h"
+ #include "transform.h"
++#include "transformInternals.h"
+ #include "variables.h"
+ #include "numbersInternals.h"
+ #include "namespaces.h"
+@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
+  *
+  * Resets source node flags and ids stored in 'psvi' member.
+  */
+-static void
++void
+ xsltCleanupSourceDoc(xmlDocPtr doc) {
+     xmlNodePtr cur = (xmlNodePtr) doc;
+     void **psviPtr;
+diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
+new file mode 100644
+index 00000000..d0f42823
+--- /dev/null
++++ b/libxslt/transformInternals.h
+@@ -0,0 +1,9 @@
++/*
++ * Summary: set of internal interfaces for the XSLT engine transformation part.
++ *
++ * Copy: See Copyright for the status of this software.
++ *
++ * Author: David Kilzer <ddkilzer@apple.com>
++ */
++
++void xsltCleanupSourceDoc(xmlDocPtr doc);
+-- 
+2.39.5 (Apple Git-154)
+

libxslt-reproducible.patch

@@ -1,75 +0,0 @@
-https://gitlab.gnome.org/GNOME/libxslt/-/issues/123
-
-From c45ed81aeb50a7fb6799a166270d6ccc9ffa63b2 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Thu, 19 Sep 2024 21:49:46 +0200
-Subject: [PATCH] variables: Fix non-deterministic generated IDs
-
-Evaluate global variables in deterministic order. Otherwise, generated
-IDs could be non-deterministic if generate-id() is called.
-
-Fixes #123.
----
- libxslt/variables.c | 24 +++++++++++++++---------
- 1 file changed, 15 insertions(+), 9 deletions(-)
-
-diff --git a/libxslt/variables.c b/libxslt/variables.c
-index 93cb0747..09069aa3 100644
---- a/libxslt/variables.c
-+++ b/libxslt/variables.c
-@@ -1259,13 +1259,6 @@ error:
-     return(result);
- }
- 
--static void
--xsltEvalGlobalVariableWrapper(void *payload, void *data,
--                              const xmlChar *name ATTRIBUTE_UNUSED) {
--    xsltEvalGlobalVariable((xsltStackElemPtr) payload,
--                           (xsltTransformContextPtr) data);
--}
--
- /**
-  * xsltEvalGlobalVariables:
-  * @ctxt:  the XSLT transformation context
-@@ -1278,6 +1271,7 @@ xsltEvalGlobalVariableWrapper(void *payload, void *data,
- int
- xsltEvalGlobalVariables(xsltTransformContextPtr ctxt) {
-     xsltStackElemPtr elem;
-+    xsltStackElemPtr head = NULL;
-     xsltStylesheetPtr style;
- 
-     if ((ctxt == NULL) || (ctxt->document == NULL))
-@@ -1321,6 +1315,8 @@ xsltEvalGlobalVariables(xsltTransformContextPtr ctxt) {
-                     xsltFreeStackElem(def);
-                     return(-1);
-                 }
-+                def->next = head;
-+                head = def;
- 	    } else if ((elem->comp != NULL) &&
- 		       (elem->comp->type == XSLT_FUNC_VARIABLE)) {
- 		/*
-@@ -1343,9 +1339,19 @@ xsltEvalGlobalVariables(xsltTransformContextPtr ctxt) {
-     }
- 
-     /*
--     * This part does the actual evaluation
-+     * This part does the actual evaluation. Note that scanning the hash
-+     * table would result in a non-deterministic order, leading to
-+     * non-deterministic generated IDs.
-      */
--    xmlHashScan(ctxt->globalVars, xsltEvalGlobalVariableWrapper, ctxt);
-+    elem = head;
-+    while (elem != NULL) {
-+        xsltStackElemPtr next;
-+
-+        xsltEvalGlobalVariable(elem, ctxt);
-+        next = elem->next;
-+        elem->next = NULL;
-+        elem = next;
-+    }
- 
-     return(0);
- }
--- 
-GitLab
-

libxslt-test-compile-with-older-libxml2-versions.patch

@@ -1,275 +0,0 @@
-From bf59c338121b8b45d66ba6ecea69ad498015c396 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Tue, 12 Nov 2024 13:28:55 +0100
-Subject: [PATCH] tests: Make runtest compile with older libxml2 versions
-
-This partly reverts commit ce3ad4f93c7637a454ad7db501158110a0813f05.
-
-Fixes #125.
----
- tests/runtest.c | 244 ++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 244 insertions(+)
-
-diff --git a/tests/runtest.c b/tests/runtest.c
-index be6ccb0e..7360615d 100644
---- a/tests/runtest.c
-+++ b/tests/runtest.c
-@@ -190,11 +190,255 @@ testErrorHandler(void *ctx  ATTRIBUTE_UNUSED, const char *msg, ...) {
-     testErrors[testErrorsSize] = 0;
- }
- 
-+#if LIBXML_VERSION < 21300
-+
-+/**
-+ * xmlParserPrintFileContext:
-+ * @input:  an xmlParserInputPtr input
-+ *
-+ * Displays current context within the input content for error tracking
-+ */
-+
-+static void
-+xmlParserPrintFileContextInternal(xmlParserInputPtr input ,
-+		xmlGenericErrorFunc chanl, void *data ) {
-+    const xmlChar *cur, *base;
-+    unsigned int n, col;	/* GCC warns if signed, because compared with sizeof() */
-+    xmlChar  content[81]; /* space for 80 chars + line terminator */
-+    xmlChar *ctnt;
-+
-+    if (input == NULL) return;
-+    cur = input->cur;
-+    base = input->base;
-+    /* skip backwards over any end-of-lines */
-+    while ((cur > base) && ((*(cur) == '\n') || (*(cur) == '\r'))) {
-+	cur--;
-+    }
-+    n = 0;
-+    /* search backwards for beginning-of-line (to max buff size) */
-+    while ((n++ < (sizeof(content)-1)) && (cur > base) &&
-+   (*(cur) != '\n') && (*(cur) != '\r'))
-+        cur--;
-+    if ((*(cur) == '\n') || (*(cur) == '\r')) cur++;
-+    /* calculate the error position in terms of the current position */
-+    col = input->cur - cur;
-+    /* search forward for end-of-line (to max buff size) */
-+    n = 0;
-+    ctnt = content;
-+    /* copy selected text to our buffer */
-+    while ((*cur != 0) && (*(cur) != '\n') &&
-+   (*(cur) != '\r') && (n < sizeof(content)-1)) {
-+		*ctnt++ = *cur++;
-+	n++;
-+    }
-+    *ctnt = 0;
-+    /* print out the selected text */
-+    chanl(data ,"%s\n", content);
-+    /* create blank line with problem pointer */
-+    n = 0;
-+    ctnt = content;
-+    /* (leave buffer space for pointer + line terminator) */
-+    while ((n<col) && (n++ < sizeof(content)-2) && (*ctnt != 0)) {
-+	if (*(ctnt) != '\t')
-+	    *(ctnt) = ' ';
-+	ctnt++;
-+    }
-+    *ctnt++ = '^';
-+    *ctnt = 0;
-+    chanl(data ,"%s\n", content);
-+}
-+
-+static void
-+testStructuredErrorHandler(void *ctx ATTRIBUTE_UNUSED, const xmlError *err) {
-+    char *file = NULL;
-+    int line = 0;
-+    int code = -1;
-+    int domain;
-+    void *data = NULL;
-+    const char *str;
-+    const xmlChar *name = NULL;
-+    xmlNodePtr node;
-+    xmlErrorLevel level;
-+    xmlParserInputPtr input = NULL;
-+    xmlParserInputPtr cur = NULL;
-+    xmlParserCtxtPtr ctxt = NULL;
-+
-+    if (err == NULL)
-+        return;
-+
-+    file = err->file;
-+    line = err->line;
-+    code = err->code;
-+    domain = err->domain;
-+    level = err->level;
-+    node = err->node;
-+    if ((domain == XML_FROM_PARSER) || (domain == XML_FROM_HTML) ||
-+        (domain == XML_FROM_DTD) || (domain == XML_FROM_NAMESPACE) ||
-+	(domain == XML_FROM_IO) || (domain == XML_FROM_VALID)) {
-+	ctxt = err->ctxt;
-+    }
-+    str = err->message;
-+
-+    if (code == XML_ERR_OK)
-+        return;
-+
-+    if ((node != NULL) && (node->type == XML_ELEMENT_NODE))
-+        name = node->name;
-+
-+    /*
-+     * Maintain the compatibility with the legacy error handling
-+     */
-+    if (ctxt != NULL) {
-+        input = ctxt->input;
-+        if ((input != NULL) && (input->filename == NULL) &&
-+            (ctxt->inputNr > 1)) {
-+            cur = input;
-+            input = ctxt->inputTab[ctxt->inputNr - 2];
-+        }
-+        if (input != NULL) {
-+            if (input->filename)
-+                testErrorHandler(data, "%s:%d: ", input->filename, input->line);
-+            else if ((line != 0) && (domain == XML_FROM_PARSER))
-+                testErrorHandler(data, "Entity: line %d: ", input->line);
-+        }
-+    } else {
-+        if (file != NULL)
-+            testErrorHandler(data, "%s:%d: ", file, line);
-+        else if ((line != 0) && (domain == XML_FROM_PARSER))
-+            testErrorHandler(data, "Entity: line %d: ", line);
-+    }
-+    if (name != NULL) {
-+        testErrorHandler(data, "element %s: ", name);
-+    }
-+    if (code == XML_ERR_OK)
-+        return;
-+    switch (domain) {
-+        case XML_FROM_PARSER:
-+            testErrorHandler(data, "parser ");
-+            break;
-+        case XML_FROM_NAMESPACE:
-+            testErrorHandler(data, "namespace ");
-+            break;
-+        case XML_FROM_DTD:
-+        case XML_FROM_VALID:
-+            testErrorHandler(data, "validity ");
-+            break;
-+        case XML_FROM_HTML:
-+            testErrorHandler(data, "HTML parser ");
-+            break;
-+        case XML_FROM_MEMORY:
-+            testErrorHandler(data, "memory ");
-+            break;
-+        case XML_FROM_OUTPUT:
-+            testErrorHandler(data, "output ");
-+            break;
-+        case XML_FROM_IO:
-+            testErrorHandler(data, "I/O ");
-+            break;
-+        case XML_FROM_XINCLUDE:
-+            testErrorHandler(data, "XInclude ");
-+            break;
-+        case XML_FROM_XPATH:
-+            testErrorHandler(data, "XPath ");
-+            break;
-+        case XML_FROM_XPOINTER:
-+            testErrorHandler(data, "parser ");
-+            break;
-+        case XML_FROM_REGEXP:
-+            testErrorHandler(data, "regexp ");
-+            break;
-+        case XML_FROM_MODULE:
-+            testErrorHandler(data, "module ");
-+            break;
-+        case XML_FROM_SCHEMASV:
-+            testErrorHandler(data, "Schemas validity ");
-+            break;
-+        case XML_FROM_SCHEMASP:
-+            testErrorHandler(data, "Schemas parser ");
-+            break;
-+        case XML_FROM_RELAXNGP:
-+            testErrorHandler(data, "Relax-NG parser ");
-+            break;
-+        case XML_FROM_RELAXNGV:
-+            testErrorHandler(data, "Relax-NG validity ");
-+            break;
-+        case XML_FROM_CATALOG:
-+            testErrorHandler(data, "Catalog ");
-+            break;
-+        case XML_FROM_C14N:
-+            testErrorHandler(data, "C14N ");
-+            break;
-+        case XML_FROM_XSLT:
-+            testErrorHandler(data, "XSLT ");
-+            break;
-+        default:
-+            break;
-+    }
-+    if (code == XML_ERR_OK)
-+        return;
-+    switch (level) {
-+        case XML_ERR_NONE:
-+            testErrorHandler(data, ": ");
-+            break;
-+        case XML_ERR_WARNING:
-+            testErrorHandler(data, "warning : ");
-+            break;
-+        case XML_ERR_ERROR:
-+            testErrorHandler(data, "error : ");
-+            break;
-+        case XML_ERR_FATAL:
-+            testErrorHandler(data, "error : ");
-+            break;
-+    }
-+    if (code == XML_ERR_OK)
-+        return;
-+    if (str != NULL) {
-+        int len;
-+	len = xmlStrlen((const xmlChar *)str);
-+	if ((len > 0) && (str[len - 1] != '\n'))
-+	    testErrorHandler(data, "%s\n", str);
-+	else
-+	    testErrorHandler(data, "%s", str);
-+    } else {
-+        testErrorHandler(data, "%s\n", "out of memory error");
-+    }
-+    if (code == XML_ERR_OK)
-+        return;
-+
-+    if (ctxt != NULL) {
-+        xmlParserPrintFileContextInternal(input, testErrorHandler, data);
-+        if (cur != NULL) {
-+            if (cur->filename)
-+                testErrorHandler(data, "%s:%d: \n", cur->filename, cur->line);
-+            else if ((line != 0) && (domain == XML_FROM_PARSER))
-+                testErrorHandler(data, "Entity: line %d: \n", cur->line);
-+            xmlParserPrintFileContextInternal(cur, testErrorHandler, data);
-+        }
-+    }
-+    if ((domain == XML_FROM_XPATH) && (err->str1 != NULL) &&
-+        (err->int1 < 100) &&
-+	(err->int1 < xmlStrlen((const xmlChar *)err->str1))) {
-+	xmlChar buf[150];
-+	int i;
-+
-+	testErrorHandler(data, "%s\n", err->str1);
-+	for (i=0;i < err->int1;i++)
-+	     buf[i] = ' ';
-+	buf[i++] = '^';
-+	buf[i] = 0;
-+	testErrorHandler(data, "%s\n", buf);
-+    }
-+}
-+
-+#else /* LIBXML_VERSION */
-+
- static void
- testStructuredErrorHandler(void *ctx ATTRIBUTE_UNUSED, const xmlError *err) {
-     xmlFormatError(err, testErrorHandler, NULL);
- }
- 
-+#endif /* LIBXML_VERSION */
-+
- static void
- initializeLibxml2(void) {
-     xmlInitParser();
--- 
-GitLab
-

libxslt.changes

@@ -1,3 +1,54 @@
+-------------------------------------------------------------------
+Thu Jul 17 09:44:34 UTC 2025 - pgajdos@suse.com
+
+- security update
+- added patches
+  CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between stylesheet and source nodes
+  + libxslt-CVE-2025-7424.patch
+
+-------------------------------------------------------------------
+Fri Mar 14 15:00:15 UTC 2025 - Pedro Monreal <pmonreal@suse.com>
+
+- Update to 1.1.43:
+  * Major changes:
+    - The non-standard EXSLT crypto extensions and support for dynamically
+      loaded plugins are now disabled by default. These features can be
+      enabled by passing --with-crypto or --with-plugins to configure.
+      In a future release, these features will be removed.
+    - Debug output and the debugger are disabled by default and can be
+      enabled by passing --with-debug or --with-debugger.
+  * Security:
+    - [bsc#1239625, CVE-2025-24855] Fix use-after-free of XPath context node
+    - [bsc#1239637, CVE-2024-55549] Fix UAF related to excluded namespaces
+  * Bug fixes:
+    - variables: Fix non-deterministic generated IDs
+  * libxml2 related cleanup:
+    - python: Don't use removed libxml2 macro
+    - tests: Skip test_bad.xsl with libxml2 before 2.13
+    - python: Don't include nanoftp.h and nanohttp.h
+    - tests: Avoid namespace warning on Windows
+    - numbers: Stop using libxml2 XPath axis API
+    - numbers: Use private copy of xmlCopyCharMultiByte
+    - documents: Use xmlCtxtParseDocument if available
+    - tests: Make runtest compile with older libxml2 versions
+    - utils: Account for libxml2 change
+    - tests: Make bug-219.xsl compatible with older libxml2
+    - extensions: always include stdlib.h (Hugo Beauzée-Luyssen)
+    - extensions: Don't use libxml2's "modules" feature
+  * Code cleanup:
+    - numbers: Make static variables const
+    - variables: Remove debug code
+  * Portability:
+    - python: Declare init func with PyMODINIT_FUNC
+    - exslt: Use C99 NAN macro
+  * Build:
+    - cmake: Always build Python module as shared library
+    - cmake: Fix compatibility in package version file
+    - configure.ac: Find libgcrypt via pkg-config (Alessandro Astone)
+  * Remove patches fixed in the update:
+    - libxslt-reproducible.patch
+    - libxslt-test-compile-with-older-libxml2-versions.patch
+
 -------------------------------------------------------------------
 Sat Jan 18 10:20:18 UTC 2025 - Pedro Monreal <pmonreal@suse.com>
 

libxslt.spec

@@ -20,7 +20,7 @@
 %define libexver    0
 
 Name:           libxslt
-Version:        1.1.42
+Version:        1.1.43
 Release:        0
 Summary:        XSL Transformation Library
 License:        GPL-2.0-or-later AND MIT
@@ -40,15 +40,8 @@ Patch0:         libxslt-1.1.24-no-net-autobuild.patch
 #   Initialize the random seed to ensure libxslt's math.random() function
 #   produces unpredictable outputs.
 Patch1:         libxslt-random-seed.patch
-Patch2:         libxslt-reproducible.patch
-# PATCH-FIX-UPSTREAM -- libxslt-test-compile-with-older-libxml2-versions.patch
-#   https://gitlab.gnome.org/GNOME/libxslt/-/issues/125
-Patch3:         libxslt-test-compile-with-older-libxml2-versions.patch
-#
-### SUSE patches starts on 1000
-# PATCH-FIX-SUSE
-#Patch1000:
-#
+# CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between stylesheet and source nodes
+Patch2:         libxslt-CVE-2025-7424.patch
 BuildRequires:  fdupes
 BuildRequires:  gcc
 BuildRequires:  libgcrypt-devel
@@ -152,21 +145,21 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %ldconfig_scriptlets -n libexslt%{libexver}
 
 %files -n libxslt%{libver}
-%license COPYING* Copyright
+%license Copyright
 %{_libdir}/libxslt.so.%{libver}*
 
 %files -n libexslt%{libexver}
-%license COPYING* Copyright
+%license Copyright
 %{_libdir}/libexslt.so.%{libexver}*
 
 %files tools
-%license COPYING* Copyright
+%license Copyright
 %doc AUTHORS NEWS TODO FEATURES
 %{_bindir}/xsltproc
 %{_mandir}/man1/xsltproc.1%{?ext_man}
 
 %files devel
-%license COPYING* Copyright
+%license Copyright
 %{_libdir}/libxslt.so
 %{_libdir}/libexslt.so
 %{_libdir}/*.sh