From ea206de8eddee0816c04229af6fbbbffb5e05d14 Mon Sep 17 00:00:00 2001 From: sergio Date: Mon, 13 Jul 2026 17:22:52 -0400 Subject: [PATCH] kde/Plasma: libxml2-PIC/shared variante (libqalculate linkea en .so) + ktexteditor +kbookmarks --- recipes/incoming-kde/CVE-2026-6732-test.patch | 84 +++++++++++++++++++ recipes/incoming-kde/CVE-2026-6732.patch | 32 +++++++ recipes/incoming-kde/ktexteditor.toml | 2 +- recipes/incoming-kde/libxml2.toml | 29 +++++++ 4 files changed, 146 insertions(+), 1 deletion(-) create mode 100644 recipes/incoming-kde/CVE-2026-6732-test.patch create mode 100644 recipes/incoming-kde/CVE-2026-6732.patch create mode 100644 recipes/incoming-kde/libxml2.toml diff --git a/recipes/incoming-kde/CVE-2026-6732-test.patch b/recipes/incoming-kde/CVE-2026-6732-test.patch new file mode 100644 index 00000000..e88d2b8a --- /dev/null +++ b/recipes/incoming-kde/CVE-2026-6732-test.patch @@ -0,0 +1,84 @@ +--- a/testparser.c ++++ b/testparser.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include + +@@ -777,6 +778,63 @@ + } + #endif /* WIN32 */ + ++#if defined(LIBXML_READER_ENABLED) && defined(LIBXML_SCHEMAS_ENABLED) ++/* ++ * Regression test for CVE-2026-6732: a type confusion in xmlParseReference ++ * crashed a schema-validating xmlTextReader whenever the document expanded ++ * an internal entity. Without the fix this triggers SIGSEGV on the first ++ * read; with the fix the entity expansion is read and the schema correctly ++ * reports the substituted content as invalid against xs:integer. ++ * ++ * Backport of upstream commit 7cea3fd1 adapted for the libxml2 2.13 ++ * testparser.c layout (which predates the testReaderSchemaResourceLoader ++ * helper that upstream uses as an anchor on master). ++ */ ++static int ++testReaderSchemaEntityExpansion(void) { ++ static const char xsd[] = ++ "\n" ++ "\n" ++ " \n" ++ "\n"; ++ static const char xml[] = ++ "]>\n" ++ "&n;"; ++ xmlSchemaParserCtxtPtr spc; ++ xmlSchemaPtr schema; ++ xmlTextReaderPtr reader; ++ int err = 0; ++ int ret; ++ ++ spc = xmlSchemaNewMemParserCtxt(xsd, (int) sizeof(xsd) - 1); ++ schema = xmlSchemaParse(spc); ++ xmlSchemaFreeParserCtxt(spc); ++ if (schema == NULL) { ++ fprintf(stderr, "xmlSchemaParse failed\n"); ++ return 1; ++ } ++ ++ reader = xmlReaderForMemory(xml, (int) sizeof(xml) - 1, "doc.xml", NULL, ++ XML_PARSE_NOENT | XML_PARSE_DTDLOAD); ++ xmlTextReaderSetSchema(reader, schema); ++ ++ while ((ret = xmlTextReaderRead(reader)) == 1) ++ ; ++ if (ret != 0) { ++ fprintf(stderr, "reader failed on entity-expanded document\n"); ++ err = 1; ++ } ++ if (xmlTextReaderIsValid(reader) != 0) { ++ fprintf(stderr, "schema missed invalid entity-expanded text\n"); ++ err = 1; ++ } ++ ++ xmlFreeTextReader(reader); ++ xmlSchemaFree(schema); ++ return err; ++} ++#endif ++ + int + main(void) { + int err = 0; +@@ -807,6 +865,9 @@ + #ifdef LIBXML_XINCLUDE_ENABLED + err |= testReaderXIncludeError(); + #endif ++#ifdef LIBXML_SCHEMAS_ENABLED ++ err |= testReaderSchemaEntityExpansion(); ++#endif + #endif + #ifdef LIBXML_WRITER_ENABLED + err |= testWriterClose(); diff --git a/recipes/incoming-kde/CVE-2026-6732.patch b/recipes/incoming-kde/CVE-2026-6732.patch new file mode 100644 index 00000000..66ce0a32 --- /dev/null +++ b/recipes/incoming-kde/CVE-2026-6732.patch @@ -0,0 +1,32 @@ +diff --git a/parser.c b/parser.c +index 6e7621a86b5b9256b7a068f09a7e1650e7264aa5..85bc39b1c2739574ab90fde34a24459e5ef9928f 100644 +--- a/parser.c ++++ b/parser.c +@@ -7261,10 +7261,10 @@ xmlParseReference(xmlParserCtxt *ctxt) { + if ((cur->type == XML_TEXT_NODE) || + (ctxt->options & XML_PARSE_NOCDATA)) { + if (ctxt->sax->characters != NULL) +- ctxt->sax->characters(ctxt, cur->content, len); ++ ctxt->sax->characters(ctxt->userData, cur->content, len); + } else { + if (ctxt->sax->cdataBlock != NULL) +- ctxt->sax->cdataBlock(ctxt, cur->content, len); ++ ctxt->sax->cdataBlock(ctxt->userData, cur->content, len); + } + + cur = cur->next; +@@ -7284,10 +7284,12 @@ xmlParseReference(xmlParserCtxt *ctxt) { + if ((cur->type == XML_TEXT_NODE) || + (ctxt->options & XML_PARSE_NOCDATA)) { + if (ctxt->sax->characters != NULL) +- ctxt->sax->characters(ctxt, cur->content, len); ++ ctxt->sax->characters(ctxt->userData, cur->content, ++ len); + } else { + if (ctxt->sax->cdataBlock != NULL) +- ctxt->sax->cdataBlock(ctxt, cur->content, len); ++ ctxt->sax->cdataBlock(ctxt->userData, cur->content, ++ len); + } + + break; diff --git a/recipes/incoming-kde/ktexteditor.toml b/recipes/incoming-kde/ktexteditor.toml index 5882feb1..58557c57 100644 --- a/recipes/incoming-kde/ktexteditor.toml +++ b/recipes/incoming-kde/ktexteditor.toml @@ -52,4 +52,4 @@ install = "DESTDIR=/out cmake --install build" # NOTA: faltan "ksyntaxhighlighting" y "qtspeech" en [deps].build (sellar primero, ver cabecera). [deps] -build = ["cmake", "samurai", "python3", "pkgconf", "qtbase", "dbus", "extra-cmake-modules", "qttools", "mesa", "libdrm", "libxkbcommon", "wayland", "gettext-tiny", "qtdeclarative", "qtsvg", "kio", "kparts", "karchive", "kconfig", "kguiaddons", "ki18n", "sonnet", "kcolorscheme", "kauth", "kcoreaddons", "kwidgetsaddons", "kcodecs", "kservice", "kcompletion", "kconfigwidgets", "kwindowsystem", "libX11", "xorgproto", "libXau", "libXdmcp", "libXext", "libXrender", "libXfixes", "libXi", "libxcb", "syntax-highlighting", "qtspeech", "qtmultimedia"] +build = ["cmake", "samurai", "python3", "pkgconf", "qtbase", "dbus", "extra-cmake-modules", "qttools", "mesa", "libdrm", "libxkbcommon", "wayland", "gettext-tiny", "qtdeclarative", "qtsvg", "kio", "kparts", "karchive", "kconfig", "kguiaddons", "ki18n", "sonnet", "kcolorscheme", "kauth", "kcoreaddons", "kwidgetsaddons", "kcodecs", "kservice", "kcompletion", "kconfigwidgets", "kwindowsystem", "libX11", "xorgproto", "libXau", "libXdmcp", "libXext", "libXrender", "libXfixes", "libXi", "libxcb", "syntax-highlighting", "qtspeech", "qtmultimedia", "kbookmarks"] diff --git a/recipes/incoming-kde/libxml2.toml b/recipes/incoming-kde/libxml2.toml new file mode 100644 index 00000000..35715567 --- /dev/null +++ b/recipes/incoming-kde/libxml2.toml @@ -0,0 +1,29 @@ +# libxml2 2.13.9 — VARIANTE PIC + SHARED para la campaña KDE (ADR 0011, Capa 0). La canónica +# (recipes/libxml2.toml) es static-sin-PIC ⇒ libqalculate (y otros consumidores .so) fallan al linkearla +# ("R_X86_64_PC32 ... xmlFree ... recompile with -fPIC"). Aquí --enable-shared (libxml2.so) + PIC. Override +# incoming-kde (mismo name). compiler=gcc (zig miscompila). Sin python/lzma; CON zlib no (mantener mínimo). +name = "libxml2" +version = "2.13.9" + +[source] +tarball = "https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.9.tar.xz" +sha256 = "a2c9ae7b770da34860050c309f903221c67830c86e4a7e760692b803df95143a" +patches = ["CVE-2026-6732.patch", "CVE-2026-6732-test.patch"] + +[build] +compiler = "gcc" +target = "x86_64-linux-musl" +link = "dynamic" +flags = [] + +[build.phases] +configure = ''' +./configure \ + --build=$CBUILD --host=$CHOST \ + --prefix=/usr \ + --enable-shared --disable-static --with-pic \ + --without-python --without-lzma --without-zlib \ + --with-legacy +''' +compile = 'make' +install = "make DESTDIR=/out install && find /out -name '*.la' -delete"