Version bump. Includes ABI compatible fix for CVE-2008-3281, security fix for CVE-2008-3529 - xmlParseAttValueComplex() heap-based buffer overflow, and various bug fixes and new API. Addresses bugs 234099, 235529, 237413 and 237806

Package-Manager: portage-2.2_rc9/cvs/Linux 2.6.26-gentoo-r1 x86_64

4 files changed, 16 insertions, 257 deletions

diff --git a/dev-libs/libxml2/ChangeLog b/dev-libs/libxml2/ChangeLog
index 337b7672d217..dbd8df176eda 100644
--- a/dev-libs/libxml2/ChangeLog
+++ b/dev-libs/libxml2/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for dev-libs/libxml2
 # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.218 2008/08/22 16:07:50 leio Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/ChangeLog,v 1.219 2008/09/25 01:21:46 leio Exp $
+
+*libxml2-2.7.1 (25 Sep 2008)
+
+  25 Sep 2008; Mart Raudsepp <leio@gentoo.org>
+  -files/libxml2-2.6.32-CVE-2008-3281.patch, -libxml2-2.6.32-r1.ebuild,
+  +libxml2-2.7.1.ebuild:
+  Version bump. Includes ABI compatible fix for CVE-2008-3281, security fix
+  for CVE-2008-3529 - xmlParseAttValueComplex() heap-based buffer overflow,
+  and various bug fixes and new API. Addresses bugs 234099, 235529, 237413
+  and 237806
 
 *libxml2-2.6.32-r1 (22 Aug 2008)
 
diff --git a/dev-libs/libxml2/Manifest b/dev-libs/libxml2/Manifest
index d785f9adfc89..83d116490149 100644
--- a/dev-libs/libxml2/Manifest
+++ b/dev-libs/libxml2/Manifest
@@ -1,14 +1,14 @@
 AUX libxml2-2.6.30-CVE-2007-6284.patch 1666 RMD160 5622efd6e110cd9775061c6cb9a581a695221620 SHA1 d7621f294418b2e0a0de4511ac44104a5c0d1004 SHA256 355a7f82b1233fcf08c0071ecb82c314117768863b47f308a95ba7ed5f0760ad
-AUX libxml2-2.6.32-CVE-2008-3281.patch 8421 RMD160 509892d073b24176efee24ff63cbd18a58ddc576 SHA1 987f8a1d7a43b3299a9220a4a9f3fbb28c1800f7 SHA256 bdbed471f2c9811516c96b93d4161b1a997901813d6e950808e380d98a95e175
 DIST libxml2-2.6.30.tar.gz 4726657 RMD160 8adcca2a60b4e90de898d9710a3a45069b73bbfe SHA1 519701df3a10770980e993336fe19ef7d95b5bba SHA256 877762a0f44785487d747ed7bd3db364ade75943e6d8e9c49fa6340c3833735e
 DIST libxml2-2.6.31.tar.gz 4734599 RMD160 de231ec47f14ace35c29cf59d650a5611fd6128a SHA1 97233a210425bad96b35e52aa3e0010ac11bbcc9 SHA256 3e7982341bbb1f11d5df344177955769e16b4d271f1f5c271740b3d1fad9bac6
 DIST libxml2-2.6.32.tar.gz 4722227 RMD160 edb9c9a813ecb12eb214d1f75d927acb3814831c SHA1 1c465c0ef9d21bb4a7df02d4edfad7dfe1e263df SHA256 1b4428b879afcaae3c2013b21283baad040661fbd502e893e83adc3d15c85d53
+DIST libxml2-2.7.1.tar.gz 4769568 RMD160 4de3732c39efa95b63abbd60dbb74357075faf63 SHA1 54b2d24ce0b716054628303bff47cf0db2966d84 SHA256 636d3f2c08ff69dd96182d49a3c75027d1bfe8e645e5a1d075a51fc9a9065bd9
 DIST xsts-2002-01-16.tar.gz 6894439 RMD160 e8905fe1451a1c367b0104af24edca73bad1db08 SHA1 ca6344e6c47f8c28231f5b213d0c8deb0311a409 SHA256 55e5c08db29946a91ea8e70e8f2418d3fd30d8b6777941dfba7f54726ffd9914
 DIST xsts-2004-01-14.tar.gz 2761085 RMD160 faff2d7826e47ae9968564bc83dab1b54c5e4bf6 SHA1 5896c2aa2cda464246306c5cf0577ed506eefaab SHA256 09bdf9f81f381ebf9bc158a9472e498e896f7a02eb7461146e9abe1b9493ca17
 DIST xsts-2006-11-06.tar.gz 4349266 RMD160 a64caae64dd82c703a94fa63ce1291dc289df376 SHA1 fff51a184bdd310f5b177a87503df2288db83e40 SHA256 542db1d583061f3f713481aab6aa6cb382efec87716d74b94c4a0155981e2d09
 EBUILD libxml2-2.6.30-r1.ebuild 3461 RMD160 fc6436cd78c1b7bc61257e3229558fec4ae73dd6 SHA1 e3ac2c25c402ce0be461984a74ed05f8d48ced92 SHA256 25b12e5b7b2af8f0d31b594400e9b6724fb3c9b8ef4561ef49170a61ef0dc55a
 EBUILD libxml2-2.6.31.ebuild 3562 RMD160 1cb59740978b853d99271ae84bc06a0bd00df765 SHA1 943b3c93b51a22d221432aeb2ffd34852956de96 SHA256 123910a495ec2e34ba4956c01c28f9a69e3aeaea6722b58615eec6b693122157
-EBUILD libxml2-2.6.32-r1.ebuild 3648 RMD160 49e30ea84043d8e0c1f01490d2aa64ef3ad90294 SHA1 565a2c4ac0ab0271dd8d54027ec07e5074125c27 SHA256 01480a9c171102b87c2738ce6b32eef1abbebfed5594b11267ee43a9e18627c8
 EBUILD libxml2-2.6.32.ebuild 3563 RMD160 8e3199780fa6001662cc2b78e2b29c56448cb763 SHA1 7527a33cd80123829d1b9bb5fb7d7835a20227e8 SHA256 735b6279bb125d622b3e826f81d7da13b6fc23b85c3284e3ce30bd5922d081f1
-MISC ChangeLog 27944 RMD160 0075caad0c124ca8fe8fe6943194d777bd225ad4 SHA1 2d354675768f48e1d9a781c38b4ce053d82921e3 SHA256 1726c489dcad7418639ea3b4b312ef04e7cf77e0a2ee53f017b295b9ad51e40c
+EBUILD libxml2-2.7.1.ebuild 3565 RMD160 9ad0f33e4829a456f697dc0c85b0a6bb4563cf4e SHA1 bbfa6d0a63d0d420cf8790fb7455ecaedcb0d40d SHA256 607f4a909ae9d41e1b77c8f9e203b2a9d3220da35edcc48af8b3a1908f379c3e
+MISC ChangeLog 28359 RMD160 727af7cb28f8fe7f926c45f3efd5b54ce60f4172 SHA1 683b1f17d41fcfdfea30e496f9e03d0a238dbc2c SHA256 ba0736dc7f6b329668a70759de483f3a3a2c017edc1a19082d3fe42aa222bcba
 MISC metadata.xml 158 RMD160 c0e2bae8e91bb6be8922bac5e4f597302e06587e SHA1 38f78e9790bcd4382b4a49aa226aa6dda1d3a3d7 SHA256 3a7dbca0fdc557de69783e0663e2d76ddab129ea8a19b2d0ef6d3e5d1b947ce1
diff --git a/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch b/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch
deleted file mode 100644
index 2375359edfc3..000000000000
--- a/dev-libs/libxml2/files/libxml2-2.6.32-CVE-2008-3281.patch
+++ /dev/null
@@ -1,248 +0,0 @@
-Index: libxml2-2.6.32/include/libxml/parser.h
-===================================================================
---- libxml2-2.6.32.orig/include/libxml/parser.h
-+++ libxml2-2.6.32/include/libxml/parser.h
-@@ -297,6 +297,7 @@ struct _xmlParserCtxt {
-      */
-     xmlError          lastError;
-     xmlParserMode     parseMode;    /* the parser mode */
-+    unsigned long    nbentities;    /* number of entities references */
- };
- 
- /**
-Index: libxml2-2.6.32/include/libxml/entities.h
-===================================================================
---- libxml2-2.6.32.orig/include/libxml/entities.h
-+++ libxml2-2.6.32/include/libxml/entities.h
-@@ -57,6 +57,7 @@ struct _xmlEntity {
-     const xmlChar           *URI;	/* the full URI as computed */
-     int                    owner;	/* does the entity own the childrens */
-     int			 checked;	/* was the entity content checked */
-+    unsigned long     nbentities;	/* the number of entities references */
- };
- 
- /*
-Index: libxml2-2.6.32/entities.c
-===================================================================
---- libxml2-2.6.32.orig/entities.c
-+++ libxml2-2.6.32/entities.c
-@@ -31,35 +31,35 @@ static xmlEntity xmlEntityLt = {
-     NULL, NULL, NULL, NULL, NULL, NULL, 
-     BAD_CAST "<", BAD_CAST "<", 1,
-     XML_INTERNAL_PREDEFINED_ENTITY,
--    NULL, NULL, NULL, NULL, 0, 1
-+    NULL, NULL, NULL, NULL, 0, 1, 0
- };
- static xmlEntity xmlEntityGt = {
-     NULL, XML_ENTITY_DECL, BAD_CAST "gt",
-     NULL, NULL, NULL, NULL, NULL, NULL, 
-     BAD_CAST ">", BAD_CAST ">", 1,
-     XML_INTERNAL_PREDEFINED_ENTITY,
--    NULL, NULL, NULL, NULL, 0, 1
-+    NULL, NULL, NULL, NULL, 0, 1, 0
- };
- static xmlEntity xmlEntityAmp = {
-     NULL, XML_ENTITY_DECL, BAD_CAST "amp",
-     NULL, NULL, NULL, NULL, NULL, NULL, 
-     BAD_CAST "&", BAD_CAST "&", 1,
-     XML_INTERNAL_PREDEFINED_ENTITY,
--    NULL, NULL, NULL, NULL, 0, 1
-+    NULL, NULL, NULL, NULL, 0, 1, 0
- };
- static xmlEntity xmlEntityQuot = {
-     NULL, XML_ENTITY_DECL, BAD_CAST "quot",
-     NULL, NULL, NULL, NULL, NULL, NULL, 
-     BAD_CAST "\"", BAD_CAST "\"", 1,
-     XML_INTERNAL_PREDEFINED_ENTITY,
--    NULL, NULL, NULL, NULL, 0, 1
-+    NULL, NULL, NULL, NULL, 0, 1, 0
- };
- static xmlEntity xmlEntityApos = {
-     NULL, XML_ENTITY_DECL, BAD_CAST "apos",
-     NULL, NULL, NULL, NULL, NULL, NULL, 
-     BAD_CAST "'", BAD_CAST "'", 1,
-     XML_INTERNAL_PREDEFINED_ENTITY,
--    NULL, NULL, NULL, NULL, 0, 1
-+    NULL, NULL, NULL, NULL, 0, 1, 0
- };
- 
- /**
-Index: libxml2-2.6.32/parserInternals.c
-===================================================================
---- libxml2-2.6.32.orig/parserInternals.c
-+++ libxml2-2.6.32/parserInternals.c
-@@ -1669,6 +1669,7 @@ xmlInitParserCtxt(xmlParserCtxtPtr ctxt)
-     ctxt->depth = 0;
-     ctxt->charset = XML_CHAR_ENCODING_UTF8;
-     ctxt->catalogs = NULL;
-+    ctxt->nbentities = 0;
-     xmlInitNodeInfoSeq(&ctxt->node_seq);
-     return(0);
- }
-Index: libxml2-2.6.32/parser.c
-===================================================================
---- libxml2-2.6.32.orig/parser.c
-+++ libxml2-2.6.32/parser.c
-@@ -2344,7 +2344,7 @@ xmlStringLenDecodeEntities(xmlParserCtxt
- 	return(NULL);
-     last = str + len;
- 
--    if (ctxt->depth > 40) {
-+    if ((ctxt->depth > 40) || (ctxt->nbentities >= 500000)) {
- 	xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
- 	return(NULL);
-     }
-@@ -2382,6 +2382,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt
- 			"String decoding Entity Reference: %.30s\n",
- 			str);
- 	    ent = xmlParseStringEntityRef(ctxt, &str);
-+	    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
-+	        goto int_error;
-+	    ctxt->nbentities++;
-+	    if (ent != NULL)
-+	        ctxt->nbentities += ent->nbentities;
- 	    if ((ent != NULL) &&
- 		(ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
- 		if (ent->content != NULL) {
-@@ -2427,6 +2432,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt
- 		xmlGenericError(xmlGenericErrorContext,
- 			"String decoding PE Reference: %.30s\n", str);
- 	    ent = xmlParseStringPEReference(ctxt, &str);
-+	    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
-+	        goto int_error;
-+	    ctxt->nbentities++;
-+	    if (ent != NULL)
-+	        ctxt->nbentities += ent->nbentities;
- 	    if (ent != NULL) {
-                 if (ent->content == NULL) {
- 		    if (xmlLoadEntityContent(ctxt, ent) < 0) {
-@@ -2466,6 +2476,7 @@ xmlStringLenDecodeEntities(xmlParserCtxt
- 
- mem_error:
-     xmlErrMemory(ctxt, NULL);
-+int_error:
-     if (rep != NULL)
-         xmlFree(rep);
-     if (buffer != NULL)
-@@ -3280,6 +3291,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr
- 		}
- 	    } else {
- 		ent = xmlParseEntityRef(ctxt);
-+		ctxt->nbentities++;
-+		if (ent != NULL)
-+		    ctxt->nbentities += ent->nbentities;
- 		if ((ent != NULL) &&
- 		    (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
- 		    if (len > buf_size - 10) {
-@@ -4566,6 +4580,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
-     int isParameter = 0;
-     xmlChar *orig = NULL;
-     int skipped;
-+    unsigned long oldnbent = ctxt->nbentities;
-     
-     /* GROW; done in the caller */
-     if (CMP8(CUR_PTR, '<', '!', 'E', 'N', 'T', 'I', 'T', 'Y')) {
-@@ -4783,6 +4798,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
- 		}
- 	    }
-             if (cur != NULL) {
-+	        cur->nbentities = ctxt->nbentities - oldnbent;
- 	        if (cur->orig != NULL)
- 		    xmlFree(orig);
- 		else
-@@ -6189,6 +6205,11 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
- 	if (ent == NULL) return;
- 	if (!ctxt->wellFormed)
- 	    return;
-+	ctxt->nbentities++;
-+	if (ctxt->nbentities >= 500000) {
-+	    xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
-+	    return;
-+	}
- 	was_checked = ent->checked;
- 	if ((ent->name != NULL) && 
- 	    (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY)) {
-@@ -6249,6 +6270,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
- 			xmlFreeNodeList(list);
- 		    }
- 		} else {
-+		    unsigned long oldnbent = ctxt->nbentities;
- 		    /*
- 		     * 4.3.2: An internal general parsed entity is well-formed
- 		     * if its replacement text matches the production labeled
-@@ -6271,6 +6293,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
- 			ret = xmlParseBalancedChunkMemoryInternal(ctxt,
- 					   value, user_data, &list);
- 			ctxt->depth--;
-+
- 		    } else if (ent->etype ==
- 			       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
- 			ctxt->depth++;
-@@ -6283,6 +6306,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
- 			xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
- 				     "invalid entity type found\n", NULL);
- 		    }
-+		    ent->nbentities = ctxt->nbentities - oldnbent;
- 		    if (ret == XML_ERR_ENTITY_LOOP) {
- 			xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
- 			return;
-@@ -6341,6 +6365,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
- 		}
- 		ent->checked = 1;
- 	    }
-+	    ctxt->nbentities += ent->nbentities;
- 
-             if (ent->children == NULL) {
- 		/*
-@@ -11480,7 +11505,7 @@ xmlParseCtxtExternalEntity(xmlParserCtxt
- 
-     if (ctx == NULL) return(-1);
- 
--    if (ctx->depth > 40) {
-+    if ((ctx->depth > 40) || (ctx->nbentities >= 500000)) {
- 	return(XML_ERR_ENTITY_LOOP);
-     }
- 
-@@ -11681,7 +11706,8 @@ xmlParseExternalEntityPrivate(xmlDocPtr 
-     xmlChar start[4];
-     xmlCharEncoding enc;
- 
--    if (depth > 40) {
-+    if ((depth > 40) ||
-+        ((oldctxt != NULL) && (oldctxt->nbentities >= 500000))) {
- 	return(XML_ERR_ENTITY_LOOP);
-     }
- 
-@@ -11824,6 +11850,7 @@ xmlParseExternalEntityPrivate(xmlDocPtr 
-     oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
-     oldctxt->node_seq.length = ctxt->node_seq.length;
-     oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
-+    oldctxt->nbentities += ctxt->nbentities;
-     ctxt->node_seq.maximum = 0;
-     ctxt->node_seq.length = 0;
-     ctxt->node_seq.buffer = NULL;
-@@ -11924,7 +11951,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP
-     int size;
-     xmlParserErrors ret = XML_ERR_OK;
- 
--    if (oldctxt->depth > 40) {
-+    if ((oldctxt->depth > 40) || (oldctxt->nbentities >= 500000)) {
- 	return(XML_ERR_ENTITY_LOOP);
-     }
- 
-@@ -12048,6 +12075,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP
-         ctxt->myDoc->last = last;
-     }
- 	
-+    oldctxt->nbentities += ctxt->nbentities;
-     ctxt->sax = oldsax;
-     ctxt->dict = NULL;
-     ctxt->attsDefault = NULL;
-@@ -13363,6 +13391,7 @@ xmlCtxtReset(xmlParserCtxtPtr ctxt)
-     ctxt->depth = 0;
-     ctxt->charset = XML_CHAR_ENCODING_UTF8;
-     ctxt->catalogs = NULL;
-+    ctxt->nbentities = 0;
-     xmlInitNodeInfoSeq(&ctxt->node_seq);
- 
-     if (ctxt->attsDefault != NULL) {
diff --git a/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild b/dev-libs/libxml2/libxml2-2.7.1.ebuild
index c98d465dbd0c..41d9f4bc856e 100644
--- a/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild
+++ b/dev-libs/libxml2/libxml2-2.7.1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2008 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/libxml2-2.6.32-r1.ebuild,v 1.1 2008/08/22 16:07:50 leio Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxml2/libxml2-2.7.1.ebuild,v 1.1 2008/09/25 01:21:46 leio Exp $
 
 inherit libtool flag-o-matic eutils
 
@@ -9,7 +9,7 @@ HOMEPAGE="http://www.xmlsoft.org/"
 
 LICENSE="MIT"
 SLOT="2"
-KEYWORDS="alpha amd64 ~arm hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc ~sparc-fbsd x86 ~x86-fbsd"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
 IUSE="bootstrap build debug doc examples ipv6 python readline test"
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
@@ -41,9 +41,6 @@ src_unpack() {
 			|| die "Failed to install test tarballs"
 	fi
 
-	# Fix infinite recursion, bug #234099
-	epatch "${FILESDIR}/${P}-CVE-2008-3281.patch"
-
 	epunt_cxx
 }