Skip to content

Commit 947a55e

Browse files
flavorjonesflavorjones
committed
Apply upstream patches to address multiple vulnerabilities
- CVE-2025-6021 - 17d950ae "tree: Fix integer overflow in xmlBuildQName" - CVE-2025-6170 - 5e9ec5c1 "Fix potential buffer overflows of interactive shell" - CVE-2025-49794 - 81cef8c5 "schematron: Fix xmlSchematronReportOutput" - CVE-2025-49795 - 62048278 "schematron: Fix null pointer dereference leading to DoS" - CVE-2025-49796 - 81cef8c5 "schematron: Fix xmlSchematronReportOutput"
1 parent 9187f4a commit 947a55e

5 files changed

+414
-0
lines changed

‎CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,13 @@ Nokogiri follows [Semantic Versioning](https://semver.org/), please see the [REA
44

55
---
66

7+
## next / unreleased
8+
9+
### Security
10+
11+
* [CRuby] Applied upstream libxml2 patches to address CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795, and CVE-2025-49796. See [GHSA-353f-x4gh-cqq8](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8) for more information.
12+
13+
714
## v1.18.8 / 2025-04-21
815

916
### Security

‎patches/libxml2/0020-CVE-2025-6021-tree-Fix-integer-overflow-in-xmlBuildQ.patch

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
From 17d950ae33c23f87692aa179bacedb6743f3188a Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <[email protected]>
3+
Date: Tue, 27 May 2025 12:53:17 +0200
4+
Subject: [PATCH 5/9] [CVE-2025-6021] tree: Fix integer overflow in
5+
xmlBuildQName
6+
7+
Fixes #926.
8+
---
9+
tree.c | 12 +++++++++---
10+
1 file changed, 9 insertions(+), 3 deletions(-)
11+
12+
diff --git a/tree.c b/tree.c
13+
index f097cf87..5bc95b8a 100644
14+
--- a/tree.c
15+
+++ b/tree.c
16+
@@ -47,6 +47,10 @@
17+
#include "private/error.h"
18+
#include "private/tree.h"
19+
20+
+#ifndef SIZE_MAX
21+
+ #define SIZE_MAX ((size_t)-1)
22+
+#endif
23+
+
24+
int __xmlRegisterCallbacks = 0;
25+
26+
/************************************************************************
27+
@@ -167,10 +171,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
28+
xmlChar *
29+
xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
30+
xmlChar *memory, int len) {
31+
- int lenn, lenp;
32+
+ size_t lenn, lenp;
33+
xmlChar *ret;
34+
35+
- if (ncname == NULL) return(NULL);
36+
+ if ((ncname == NULL) || (len < 0)) return(NULL);
37+
if (prefix == NULL) return((xmlChar *) ncname);
38+
39+
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
40+
@@ -181,8 +185,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
41+
42+
lenn = strlen((char *) ncname);
43+
lenp = strlen((char *) prefix);
44+
+ if (lenn >= SIZE_MAX - lenp - 1)
45+
+ return(NULL);
46+
47+
- if ((memory == NULL) || (len < lenn + lenp + 2)) {
48+
+ if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
49+
ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
50+
if (ret == NULL)
51+
return(NULL);
52+
--
53+
2.50.1
54+

‎patches/libxml2/0021-CVE-2025-6170-Fix-potential-buffer-overflows-of-inte.patch

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
From 5e9ec5c107d3f5b5179c3dbc19df43df041cd55b Mon Sep 17 00:00:00 2001
2+
From: Michael Mann <[email protected]>
3+
Date: Fri, 20 Jun 2025 23:05:00 -0400
4+
Subject: [PATCH 6/9] [CVE-2025-6170] Fix potential buffer overflows of
5+
interactive shell
6+
7+
Fixes #941
8+
---
9+
debugXML.c | 15 ++++++++++-----
10+
result/scripts/long_command | 8 ++++++++
11+
test/scripts/long_command.script | 6 ++++++
12+
test/scripts/long_command.xml | 1 +
13+
4 files changed, 25 insertions(+), 5 deletions(-)
14+
create mode 100644 result/scripts/long_command
15+
create mode 100644 test/scripts/long_command.script
16+
create mode 100644 test/scripts/long_command.xml
17+
18+
diff --git a/debugXML.c b/debugXML.c
19+
index ed56b0f8..452b9573 100644
20+
--- a/debugXML.c
21+
+++ b/debugXML.c
22+
@@ -1033,6 +1033,10 @@ xmlCtxtDumpOneNode(xmlDebugCtxtPtr ctxt, xmlNodePtr node)
23+
xmlCtxtGenericNodeCheck(ctxt, node);
24+
}
25+
26+
+#define MAX_PROMPT_SIZE 500
27+
+#define MAX_ARG_SIZE 400
28+
+#define MAX_COMMAND_SIZE 100
29+
+
30+
/**
31+
* xmlCtxtDumpNode:
32+
* @output: the FILE * for the output
33+
@@ -2795,10 +2799,10 @@ void
34+
xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
35+
FILE * output)
36+
{
37+
- char prompt[500] = "/ > ";
38+
+ char prompt[MAX_PROMPT_SIZE] = "/ > ";
39+
char *cmdline = NULL, *cur;
40+
- char command[100];
41+
- char arg[400];
42+
+ char command[MAX_COMMAND_SIZE];
43+
+ char arg[MAX_ARG_SIZE];
44+
int i;
45+
xmlShellCtxtPtr ctxt;
46+
xmlXPathObjectPtr list;
47+
@@ -2856,7 +2860,8 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
48+
cur++;
49+
i = 0;
50+
while ((*cur != ' ') && (*cur != '\t') &&
51+
- (*cur != '\n') && (*cur != '\r')) {
52+
+ (*cur != '\n') && (*cur != '\r') &&
53+
+ (i < (MAX_COMMAND_SIZE - 1))) {
54+
if (*cur == 0)
55+
break;
56+
command[i++] = *cur++;
57+
@@ -2871,7 +2876,7 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
58+
while ((*cur == ' ') || (*cur == '\t'))
59+
cur++;
60+
i = 0;
61+
- while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
62+
+ while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) {
63+
if (*cur == 0)
64+
break;
65+
arg[i++] = *cur++;
66+
diff --git a/result/scripts/long_command b/result/scripts/long_command
67+
new file mode 100644
68+
index 00000000..e6f00708
69+
--- /dev/null
70+
+++ b/result/scripts/long_command
71+
@@ -0,0 +1,8 @@
72+
+/ > b > b > Object is a Node Set :
73+
+Set contains 1 nodes:
74+
+1 ELEMENT a:c
75+
+b > Unknown command This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_comm
76+
+b > b > Unknown command ess_currents_of_time_and_existence
77+
+b > <?xml version="1.0"?>
78+
+<a xmlns:a="bar"><b xmlns:a="foo">Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_prof</b></a>
79+
+b >
80+
\ No newline at end of file
81+
diff --git a/test/scripts/long_command.script b/test/scripts/long_command.script
82+
new file mode 100644
83+
index 00000000..00f6df09
84+
--- /dev/null
85+
+++ b/test/scripts/long_command.script
86+
@@ -0,0 +1,6 @@
87+
+cd a/b
88+
+set <a:c/>
89+
+xpath //*[namespace-uri()="foo"]
90+
+This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_command_please_dont_crash foo
91+
+set Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_profound_emotion_and_every_grand_aspiration_that_propels_our_species_ever_onward_through_the_relentless_currents_of_time_and_existence
92+
+save -
93+
diff --git a/test/scripts/long_command.xml b/test/scripts/long_command.xml
94+
new file mode 100644
95+
index 00000000..1ba44016
96+
--- /dev/null
97+
+++ b/test/scripts/long_command.xml
98+
@@ -0,0 +1 @@
99+
+<a xmlns:a="bar"><b xmlns:a="foo"/></a>
100+
--
101+
2.50.1
102+

‎patches/libxml2/0022-CVE-2025-49795-schematron-Fix-null-pointer-dereferen.patch

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
From 62048278a4c5fdf14d287dfb400005c0a0caa69f Mon Sep 17 00:00:00 2001
2+
From: Michael Mann <[email protected]>
3+
Date: Sat, 21 Jun 2025 12:11:30 -0400
4+
Subject: [PATCH 7/9] [CVE-2025-49795] schematron: Fix null pointer dereference
5+
leading to DoS
6+
7+
Fixes #932
8+
---
9+
result/schematron/zvon16_0.err | 3 +++
10+
schematron.c | 5 +++++
11+
test/schematron/zvon16.sct | 7 +++++++
12+
test/schematron/zvon16_0.xml | 5 +++++
13+
4 files changed, 20 insertions(+)
14+
create mode 100644 result/schematron/zvon16_0.err
15+
create mode 100644 test/schematron/zvon16.sct
16+
create mode 100644 test/schematron/zvon16_0.xml
17+
18+
diff --git a/result/schematron/zvon16_0.err b/result/schematron/zvon16_0.err
19+
new file mode 100644
20+
index 00000000..3d052409
21+
--- /dev/null
22+
+++ b/result/schematron/zvon16_0.err
23+
@@ -0,0 +1,3 @@
24+
+XPath error : Unregistered function
25+
+./test/schematron/zvon16_0.xml:2: element book: schematron error : /library/book line 2: Book
26+
+./test/schematron/zvon16_0.xml fails to validate
27+
diff --git a/schematron.c b/schematron.c
28+
index 1de25deb..da603402 100644
29+
--- a/schematron.c
30+
+++ b/schematron.c
31+
@@ -1506,6 +1506,11 @@ xmlSchematronFormatReport(xmlSchematronValidCtxtPtr ctxt,
32+
select = xmlGetNoNsProp(child, BAD_CAST "select");
33+
comp = xmlXPathCtxtCompile(ctxt->xctxt, select);
34+
eval = xmlXPathCompiledEval(comp, ctxt->xctxt);
35+
+ if (eval == NULL) {
36+
+ xmlXPathFreeCompExpr(comp);
37+
+ xmlFree(select);
38+
+ return ret;
39+
+ }
40+
41+
switch (eval->type) {
42+
case XPATH_NODESET: {
43+
diff --git a/test/schematron/zvon16.sct b/test/schematron/zvon16.sct
44+
new file mode 100644
45+
index 00000000..f03848aa
46+
--- /dev/null
47+
+++ b/test/schematron/zvon16.sct
48+
@@ -0,0 +1,7 @@
49+
+<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
50+
+ <sch:pattern id="TestPattern">
51+
+ <sch:rule context="book">
52+
+ <sch:report test="not(@available)">Book <sch:value-of select="falae()"/> test</sch:report>
53+
+ </sch:rule>
54+
+ </sch:pattern>
55+
+</sch:schema>
56+
diff --git a/test/schematron/zvon16_0.xml b/test/schematron/zvon16_0.xml
57+
new file mode 100644
58+
index 00000000..551e2d65
59+
--- /dev/null
60+
+++ b/test/schematron/zvon16_0.xml
61+
@@ -0,0 +1,5 @@
62+
+<library>
63+
+ <book title="Test Book" id="bk101">
64+
+ <author>Test Author</author>
65+
+ </book>
66+
+</library>
67+
--
68+
2.50.1
69+

0 commit comments

Comments
 (0)