From 30ad3e57bf8ad9c55f49464eda6368ffe851aa23 Mon Sep 17 00:00:00 2001 From: sergio Date: Wed, 24 Jun 2026 08:39:54 -0400 Subject: [PATCH] =?UTF-8?q?Etapa=20G:=20libs=20C=20base=20pcre2=20+=20libx?= =?UTF-8?q?ml2=20al=20corpus=20(223=E2=86=92225)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Track de libs fundacionales (pivote tras gmp). Ambas static-musl, gcc: - pcre2 10.47 → libpcre2-8.a + libpcre2-posix.a (regex; dep de pcre2-sys, grep-variants) - libxml2 2.13.9 → libxml2.a (XML/HTML; dep de mucha cola C + crates -sys) FIX CLAVE de comportamiento del lab (causa de los fallos previos, gmp incluido): el lab tiene fases configure Y compile SEPARADAS; si configure se deja vacío, la heurística inyecta su propio ./configure minimal (defaults → python/probe) que corre ANTES y aborta. Solución: definir [build.phases].configure explícito. libxml2 con --without-python/lzma/zlib; configure-phase split lo desbloqueó. Co-Authored-By: Claude Opus 4.8 --- recipes/CVE-2026-6732-test.patch | 84 ++++++++++++++++++++++++++++++++ recipes/CVE-2026-6732.patch | 32 ++++++++++++ recipes/libxml2.toml | 34 +++++++++++++ recipes/pcre2.toml | 34 +++++++++++++ 4 files changed, 184 insertions(+) create mode 100644 recipes/CVE-2026-6732-test.patch create mode 100644 recipes/CVE-2026-6732.patch create mode 100644 recipes/libxml2.toml create mode 100644 recipes/pcre2.toml diff --git a/recipes/CVE-2026-6732-test.patch b/recipes/CVE-2026-6732-test.patch new file mode 100644 index 00000000..e88d2b8a --- /dev/null +++ b/recipes/CVE-2026-6732-test.patch @@ -0,0 +1,84 @@ +--- a/testparser.c ++++ b/testparser.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include + +@@ -777,6 +778,63 @@ + } + #endif /* WIN32 */ + ++#if defined(LIBXML_READER_ENABLED) && defined(LIBXML_SCHEMAS_ENABLED) ++/* ++ * Regression test for CVE-2026-6732: a type confusion in xmlParseReference ++ * crashed a schema-validating xmlTextReader whenever the document expanded ++ * an internal entity. Without the fix this triggers SIGSEGV on the first ++ * read; with the fix the entity expansion is read and the schema correctly ++ * reports the substituted content as invalid against xs:integer. ++ * ++ * Backport of upstream commit 7cea3fd1 adapted for the libxml2 2.13 ++ * testparser.c layout (which predates the testReaderSchemaResourceLoader ++ * helper that upstream uses as an anchor on master). ++ */ ++static int ++testReaderSchemaEntityExpansion(void) { ++ static const char xsd[] = ++ "\n" ++ "\n" ++ " \n" ++ "\n"; ++ static const char xml[] = ++ "]>\n" ++ "&n;"; ++ xmlSchemaParserCtxtPtr spc; ++ xmlSchemaPtr schema; ++ xmlTextReaderPtr reader; ++ int err = 0; ++ int ret; ++ ++ spc = xmlSchemaNewMemParserCtxt(xsd, (int) sizeof(xsd) - 1); ++ schema = xmlSchemaParse(spc); ++ xmlSchemaFreeParserCtxt(spc); ++ if (schema == NULL) { ++ fprintf(stderr, "xmlSchemaParse failed\n"); ++ return 1; ++ } ++ ++ reader = xmlReaderForMemory(xml, (int) sizeof(xml) - 1, "doc.xml", NULL, ++ XML_PARSE_NOENT | XML_PARSE_DTDLOAD); ++ xmlTextReaderSetSchema(reader, schema); ++ ++ while ((ret = xmlTextReaderRead(reader)) == 1) ++ ; ++ if (ret != 0) { ++ fprintf(stderr, "reader failed on entity-expanded document\n"); ++ err = 1; ++ } ++ if (xmlTextReaderIsValid(reader) != 0) { ++ fprintf(stderr, "schema missed invalid entity-expanded text\n"); ++ err = 1; ++ } ++ ++ xmlFreeTextReader(reader); ++ xmlSchemaFree(schema); ++ return err; ++} ++#endif ++ + int + main(void) { + int err = 0; +@@ -807,6 +865,9 @@ + #ifdef LIBXML_XINCLUDE_ENABLED + err |= testReaderXIncludeError(); + #endif ++#ifdef LIBXML_SCHEMAS_ENABLED ++ err |= testReaderSchemaEntityExpansion(); ++#endif + #endif + #ifdef LIBXML_WRITER_ENABLED + err |= testWriterClose(); diff --git a/recipes/CVE-2026-6732.patch b/recipes/CVE-2026-6732.patch new file mode 100644 index 00000000..66ce0a32 --- /dev/null +++ b/recipes/CVE-2026-6732.patch @@ -0,0 +1,32 @@ +diff --git a/parser.c b/parser.c +index 6e7621a86b5b9256b7a068f09a7e1650e7264aa5..85bc39b1c2739574ab90fde34a24459e5ef9928f 100644 +--- a/parser.c ++++ b/parser.c +@@ -7261,10 +7261,10 @@ xmlParseReference(xmlParserCtxt *ctxt) { + if ((cur->type == XML_TEXT_NODE) || + (ctxt->options & XML_PARSE_NOCDATA)) { + if (ctxt->sax->characters != NULL) +- ctxt->sax->characters(ctxt, cur->content, len); ++ ctxt->sax->characters(ctxt->userData, cur->content, len); + } else { + if (ctxt->sax->cdataBlock != NULL) +- ctxt->sax->cdataBlock(ctxt, cur->content, len); ++ ctxt->sax->cdataBlock(ctxt->userData, cur->content, len); + } + + cur = cur->next; +@@ -7284,10 +7284,12 @@ xmlParseReference(xmlParserCtxt *ctxt) { + if ((cur->type == XML_TEXT_NODE) || + (ctxt->options & XML_PARSE_NOCDATA)) { + if (ctxt->sax->characters != NULL) +- ctxt->sax->characters(ctxt, cur->content, len); ++ ctxt->sax->characters(ctxt->userData, cur->content, ++ len); + } else { + if (ctxt->sax->cdataBlock != NULL) +- ctxt->sax->cdataBlock(ctxt, cur->content, len); ++ ctxt->sax->cdataBlock(ctxt->userData, cur->content, ++ len); + } + + break; diff --git a/recipes/libxml2.toml b/recipes/libxml2.toml new file mode 100644 index 00000000..6f8f5a86 --- /dev/null +++ b/recipes/libxml2.toml @@ -0,0 +1,34 @@ +# libxml2 2.13.9 — parser XML/HTML (C). Lib FUNDACIONAL: dep de muchísima cola C + crates *-sys. +# De-Alpinizada (Etapa G): +# - compiler=gcc: zig-cc miscompila libs C (patrón file/jq); gcc del rootfs es musl. +# - --disable-shared --enable-static: el lab linkea estático; queremos libxml2.a en /usr/lib. +# - core sin compresión/bindings: --without-lzma (no hay xz en corpus), --without-zlib, +# --without-python (el binding no aplica al userland estático). El parseo XML —el valor— no los pide. +# - patches CVE de Alpine conservados (seguridad). +name = "libxml2" +version = "2.13.9" + +[source] +tarball = "https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.9.tar.xz" +sha256 = "a2c9ae7b770da34860050c309f903221c67830c86e4a7e760692b803df95143a" +patches = ["CVE-2026-6732.patch", "CVE-2026-6732-test.patch"] + +[build] +compiler = "gcc" +target = "x86_64-linux-musl" +link = "static" +flags = [] + +# configure EXPLÍCITO: si se deja vacío, la heurística del lab inyecta su propio ./configure +# minimal (defaults → exige python-3.12) que corre antes y aborta. Definirlo lo desactiva. +[build.phases] +configure = ''' +./configure \ + --build=$CBUILD --host=$CHOST \ + --prefix=/usr \ + --disable-shared --enable-static \ + --without-python --without-lzma --without-zlib \ + --with-legacy +''' +compile = 'make' +install = 'make DESTDIR=/out install' diff --git a/recipes/pcre2.toml b/recipes/pcre2.toml new file mode 100644 index 00000000..1082c844 --- /dev/null +++ b/recipes/pcre2.toml @@ -0,0 +1,34 @@ +# pcre2 10.47 — biblioteca de regex Perl-compatible (C). Lib FUNDACIONAL: dep de grep-variants, +# pcre2-sys (crates Rust), y mucha cola C. De-Alpinizada (Etapa G): +# - compiler=gcc: C portable pero zig-cc miscompila libs C (patrón file/jq); gcc del rootfs es musl. +# - --disable-shared --enable-static: el lab linkea estático; queremos libpcre2-*.a en /usr/lib. +# - sin --enable-pcre2test-libedit (libedit no está en corpus, es solo para el test interactivo). +name = "pcre2" +version = "10.47" + +[source] +tarball = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2" +sha256 = "47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7" + +[build] +compiler = "gcc" +target = "x86_64-linux-musl" +link = "static" +flags = [] + +[build.phases] +compile = ''' +./configure \ + --build=$CBUILD --host=$CHOST \ + --prefix=/usr \ + --disable-shared --enable-static \ + --enable-pcre2-16 --enable-pcre2-32 \ + --enable-jit \ + --enable-pcre2grep-libz \ + --disable-symvers +make +''' +install = 'make DESTDIR=/out install' + +[deps] +build = ["zlib"]