[pkgsrc/trunk]: pkgsrc/textproc/libxml2 libxml2: Fix for CVE-2018-9251

[tez <tez%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/a96e8d644215
branches:  trunk
changeset: 309574:a96e8d644215
user:      tez <tez%pkgsrc.org@localhost>
date:      Wed Jun 20 18:22:45 2018 +0000

description:
libxml2: Fix for CVE-2018-9251

from https://bugzilla.gnome.org/show_bug.cgi?id=794914

diffstat:

 textproc/libxml2/Makefile              |   4 +++-
 textproc/libxml2/distinfo              |   3 ++-
 textproc/libxml2/patches/patch-xzlib.c |  17 +++++++++++++++++
 3 files changed, 22 insertions(+), 2 deletions(-)

diffs (49 lines):

diff -r 3bb678614c9b -r a96e8d644215 textproc/libxml2/Makefile
--- a/textproc/libxml2/Makefile Wed Jun 20 15:08:34 2018 +0000
+++ b/textproc/libxml2/Makefile Wed Jun 20 18:22:45 2018 +0000
@@ -1,7 +1,9 @@
-# $NetBSD: Makefile,v 1.147 2018/03/14 10:49:00 maya Exp $
+# $NetBSD: Makefile,v 1.148 2018/06/20 18:22:45 tez Exp $
 
 .include "../../textproc/libxml2/Makefile.common"
 
+PKGREVISION=   1
+
 COMMENT=       XML parser library from the GNOME project
 LICENSE=       modified-bsd
 
diff -r 3bb678614c9b -r a96e8d644215 textproc/libxml2/distinfo
--- a/textproc/libxml2/distinfo Wed Jun 20 15:08:34 2018 +0000
+++ b/textproc/libxml2/distinfo Wed Jun 20 18:22:45 2018 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.124 2018/03/11 17:49:53 wiz Exp $
+$NetBSD: distinfo,v 1.125 2018/06/20 18:22:45 tez Exp $
 
 SHA1 (libxml2-2.9.8.tar.gz) = 66bcefd98a6b7573427cf66f9d3841b59eb5b8c3
 RMD160 (libxml2-2.9.8.tar.gz) = a3bf30ed652cfa2e06c64ae62c95a5ebd889c7a7
@@ -13,3 +13,4 @@
 SHA1 (patch-python_libxml.py) = 869a72ae5ba2e27e6d46552878890acb22337675
 SHA1 (patch-python_libxml2.py) = 209d105b0f3aedb834091390a7c6819705108e34
 SHA1 (patch-python_setup.py) = 7771fd02ee6779463f1d3321f099d7e6d19cd1b1
+SHA1 (patch-xzlib.c) = eb20e3ef1504dacf1363f86c662918365306e84c
diff -r 3bb678614c9b -r a96e8d644215 textproc/libxml2/patches/patch-xzlib.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/textproc/libxml2/patches/patch-xzlib.c    Wed Jun 20 18:22:45 2018 +0000
@@ -0,0 +1,17 @@
+$NetBSD: patch-xzlib.c,v 1.3 2018/06/20 18:22:45 tez Exp $
+
+Fix for CVE-2018-9251 from https://bugzilla.gnome.org/show_bug.cgi?id=794914
+
+--- xzlib.c.orig       2018-06-20 16:11:09.322482100 +0000
++++ xzlib.c
+@@ -575,6 +575,10 @@ xz_decomp(xz_statep state)
+         } else                  /* state->how == LZMA */
+ #endif
+             ret = lzma_code(strm, action);
++        if (ret == LZMA_MEMLIMIT_ERROR) {
++            xz_error(state, LZMA_MEMLIMIT_ERROR, "memory limit error");
++            return -1;
++        }
+         if (ret == LZMA_MEM_ERROR) {
+             xz_error(state, LZMA_MEM_ERROR, "out of memory");
+             return -1;