[Bug 288306] textproc/libxslt: Anticipate release of security patches from somewhere

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=288306

--- Comment #11 from bagas <bagas1983@mail.ru> ---
taken from here.

https://forums.freebsd.org/threads/libxslt.98744/#post-715796

debian fix
http://deb.debian.org/debian/pool/main/libx/libxslt/libxslt_1.1.43-0.2.debian.tar.xz
CVE-2025-7424


[22:08:45] [linsux!root]/usr/ports/textproc/libxslt#cat
files/patch-gnome-libxslt-bug-139-apple-fix.diff
From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
From: David Kilzer <ddkilzer@apple.com>
Date: Sat, 24 May 2025 15:06:42 -0700
Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
 and source nodes

* libxslt/functions.c:
(xsltDocumentFunctionLoadDocument):
- Implement fix suggested by Ivan Fratric.  This copies the xmlDoc,
  calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
  xmlDoc to tctxt->docList.
- Add error handling for functions that may return NULL.
* libxslt/transform.c:
- Remove static keyword so this can be called from
  xsltDocumentFunctionLoadDocument().
* libxslt/transformInternals.h: Add.
(xsltCleanupSourceDoc): Add declaration.

Fixes #139.
---
 libxslt/functions.c          | 16 +++++++++++++++-
 libxslt/transform.c          |  3 ++-
 libxslt/transformInternals.h |  9 +++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 libxslt/transformInternals.h

diff --git a/libxslt/functions.c b/libxslt/functions.c
index 72a58dc4..11ec039f 100644
--- libxslt/functions.c.orig
+++ libxslt/functions.c
@@ -34,6 +34,7 @@
 #include "numbersInternals.h"
 #include "keys.h"
 #include "documents.h"
+#include "transformInternals.h"

 #ifdef WITH_XSLT_DEBUG
 #define WITH_XSLT_DEBUG_FUNCTION
@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr
ctxt,
         /*
         * This selects the stylesheet's doc itself.
         */
-        doc = tctxt->style->doc;
+        doc = xmlCopyDoc(tctxt->style->doc, 1);
+        if (doc == NULL) {
+        xsltTransformError(tctxt, NULL, NULL,
+            "document() : failed to copy style doc\n");
+        goto out_fragment;
+        }
+        xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
+        idoc = xsltNewDocument(tctxt, doc);
+        if (idoc == NULL) {
+        xsltTransformError(tctxt, NULL, NULL,
+            "document() : failed to create xsltDocument\n");
+        xmlFreeDoc(doc);
+        goto out_fragment;
+        }
     } else {
             goto out_fragment;
     }
diff --git a/libxslt/transform.c b/libxslt/transform.c
index 54ef821b..38c2dce6 100644
--- libxslt/transform.c.orig
+++ libxslt/transform.c
@@ -43,6 +43,7 @@
 #include "xsltlocale.h"
 #include "pattern.h"
 #include "transform.h"
+#include "transformInternals.h"
 #include "variables.h"
 #include "numbersInternals.h"
 #include "namespaces.h"
@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
  *
  * Resets source node flags and ids stored in 'psvi' member.
  */
-static void
+void
 xsltCleanupSourceDoc(xmlDocPtr doc) {
     xmlNodePtr cur = (xmlNodePtr) doc;
     void **psviPtr;
diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
new file mode 100644
index 00000000..d0f42823
--- /dev/null
+++ libxslt/transformInternals.h
@@ -0,0 +1,9 @@
+/*
+ * Summary: set of internal interfaces for the XSLT engine transformation
part.
+ *
+ * Copy: See Copyright for the status of this software.
+ *
+ * Author: David Kilzer <ddkilzer@apple.com>
+ */
+
+void xsltCleanupSourceDoc(xmlDocPtr doc);
--
2.39.5 (Apple Git-154)

-- 
You are receiving this mail because:
You are the assignee for the bug.