sergioandClaude Opus 4.8
30ad3e57bf
Track de libs fundacionales (pivote tras gmp). Ambas static-musl, gcc: - pcre2 10.47 → libpcre2-8.a + libpcre2-posix.a (regex; dep de pcre2-sys, grep-variants) - libxml2 2.13.9 → libxml2.a (XML/HTML; dep de mucha cola C + crates -sys) FIX CLAVE de comportamiento del lab (causa de los fallos previos, gmp incluido): el lab tiene fases configure Y compile SEPARADAS; si configure se deja vacío, la heurística inyecta su propio ./configure minimal (defaults → python/probe) que corre ANTES y aborta. Solución: definir [build.phases].configure explícito. libxml2 con --without-python/lzma/zlib; configure-phase split lo desbloqueó. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
85 lines
2.5 KiB
Diff
85 lines
2.5 KiB
Diff
--- a/testparser.c
|
|
+++ b/testparser.c
|
|
@@ -11,6 +11,7 @@
|
|
#include <libxml/xmlreader.h>
|
|
#include <libxml/xmlwriter.h>
|
|
#include <libxml/HTMLparser.h>
|
|
+#include <libxml/xmlschemas.h>
|
|
|
|
#include <string.h>
|
|
|
|
@@ -777,6 +778,63 @@
|
|
}
|
|
#endif /* WIN32 */
|
|
|
|
+#if defined(LIBXML_READER_ENABLED) && defined(LIBXML_SCHEMAS_ENABLED)
|
|
+/*
|
|
+ * Regression test for CVE-2026-6732: a type confusion in xmlParseReference
|
|
+ * crashed a schema-validating xmlTextReader whenever the document expanded
|
|
+ * an internal entity. Without the fix this triggers SIGSEGV on the first
|
|
+ * read; with the fix the entity expansion is read and the schema correctly
|
|
+ * reports the substituted content as invalid against xs:integer.
|
|
+ *
|
|
+ * Backport of upstream commit 7cea3fd1 adapted for the libxml2 2.13
|
|
+ * testparser.c layout (which predates the testReaderSchemaResourceLoader
|
|
+ * helper that upstream uses as an anchor on master).
|
|
+ */
|
|
+static int
|
|
+testReaderSchemaEntityExpansion(void) {
|
|
+ static const char xsd[] =
|
|
+ "<?xml version='1.0'?>\n"
|
|
+ "<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'>\n"
|
|
+ " <xs:element name='e' type='xs:integer'/>\n"
|
|
+ "</xs:schema>\n";
|
|
+ static const char xml[] =
|
|
+ "<!DOCTYPE e [<!ENTITY n \"not-an-int\">]>\n"
|
|
+ "<e>&n;</e>";
|
|
+ xmlSchemaParserCtxtPtr spc;
|
|
+ xmlSchemaPtr schema;
|
|
+ xmlTextReaderPtr reader;
|
|
+ int err = 0;
|
|
+ int ret;
|
|
+
|
|
+ spc = xmlSchemaNewMemParserCtxt(xsd, (int) sizeof(xsd) - 1);
|
|
+ schema = xmlSchemaParse(spc);
|
|
+ xmlSchemaFreeParserCtxt(spc);
|
|
+ if (schema == NULL) {
|
|
+ fprintf(stderr, "xmlSchemaParse failed\n");
|
|
+ return 1;
|
|
+ }
|
|
+
|
|
+ reader = xmlReaderForMemory(xml, (int) sizeof(xml) - 1, "doc.xml", NULL,
|
|
+ XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
|
|
+ xmlTextReaderSetSchema(reader, schema);
|
|
+
|
|
+ while ((ret = xmlTextReaderRead(reader)) == 1)
|
|
+ ;
|
|
+ if (ret != 0) {
|
|
+ fprintf(stderr, "reader failed on entity-expanded document\n");
|
|
+ err = 1;
|
|
+ }
|
|
+ if (xmlTextReaderIsValid(reader) != 0) {
|
|
+ fprintf(stderr, "schema missed invalid entity-expanded text\n");
|
|
+ err = 1;
|
|
+ }
|
|
+
|
|
+ xmlFreeTextReader(reader);
|
|
+ xmlSchemaFree(schema);
|
|
+ return err;
|
|
+}
|
|
+#endif
|
|
+
|
|
int
|
|
main(void) {
|
|
int err = 0;
|
|
@@ -807,6 +865,9 @@
|
|
#ifdef LIBXML_XINCLUDE_ENABLED
|
|
err |= testReaderXIncludeError();
|
|
#endif
|
|
+#ifdef LIBXML_SCHEMAS_ENABLED
|
|
+ err |= testReaderSchemaEntityExpansion();
|
|
+#endif
|
|
#endif
|
|
#ifdef LIBXML_WRITER_ENABLED
|
|
err |= testWriterClose();
|