external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 | 64 ++++++
external/libxml2/UnpackedTarball_libxml2.mk | 1
external/libxslt/UnpackedTarball_libxslt.mk | 1
external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 | 99
++++++++++
4 files changed, 165 insertions(+)
New commits:
commit e87d9198fbaf2d5cd301b1ff70f589895497731d
Author: Michael Stahl <michael.st...@collabora.com>
AuthorDate: Thu Aug 7 16:28:20 2025 +0200
Commit: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
CommitDate: Fri Aug 8 12:03:53 2025 +0200
libxml2: add upstream patch for CVE-2025-7425
Change-Id: I84110fc1ed54eac4a0ce4d8b8070a031c761fb39
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189104
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
(cherry picked from commit 88e2be781bc22f8500f57c84cec572ead8af32c4)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189123
Tested-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
diff --git a/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
b/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
new file mode 100644
index 000000000000..5984d25e957d
--- /dev/null
+++ b/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
@@ -0,0 +1,64 @@
+From 9de92ed78d8495527c5d7a4d0cc76c1f83768195 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnho...@aevum.de>
+Date: Tue, 5 Aug 2025 22:26:27 +0200
+Subject: [PATCH] tree: Guard against atype corruption
+
+Always remove ids if `id` member is set.
+
+Untested, but this should fix CVE-2025-7425 reported against libxslt:
+
+https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
+---
+ tree.c | 8 ++++----
+ valid.c | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tree.c b/tree.c
+index 2e8df00b8..ddb8bdb3b 100644
+--- a/tree.c
++++ b/tree.c
+@@ -1892,8 +1892,8 @@ xmlFreeProp(xmlAttrPtr cur) {
+ xmlDeregisterNodeDefaultValue((xmlNodePtr)cur);
+
+ /* Check for ID removal -> leading to invalid references ! */
+- if ((cur->doc != NULL) && (cur->atype == XML_ATTRIBUTE_ID)) {
+- xmlRemoveID(cur->doc, cur);
++ if (cur->doc != NULL && cur->id != NULL) {
++ xmlRemoveID(cur->doc, cur);
+ }
+ if (cur->children != NULL) xmlFreeNodeList(cur->children);
+ DICT_FREE(cur->name)
+@@ -2736,7 +2736,7 @@ xmlNodeSetDoc(xmlNodePtr node, xmlDocPtr doc) {
+ * TODO: ID attributes should also be added to the new
+ * document, but it's not clear how to handle clashes.
+ */
+- if (attr->atype == XML_ATTRIBUTE_ID)
++ if (attr->id != NULL)
+ xmlRemoveID(oldDoc, attr);
+
+ break;
+@@ -6919,7 +6919,7 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar
*name,
+ return(NULL);
+ }
+
+- if (prop->atype == XML_ATTRIBUTE_ID) {
++ if (prop->id != NULL) {
+ xmlRemoveID(node->doc, prop);
+ prop->atype = XML_ATTRIBUTE_ID;
+ }
+diff --git a/valid.c b/valid.c
+index 34b6757cb..e625f0c1b 100644
+--- a/valid.c
++++ b/valid.c
+@@ -4296,7 +4296,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr
doc,
+ attr->name, elem->name, NULL);
+ return(0);
+ }
+- if (attr->atype == XML_ATTRIBUTE_ID)
++ if (attr->id != NULL)
+ xmlRemoveID(doc, attr);
+ attr->atype = attrDecl->atype;
+
+--
+GitLab
+
diff --git a/external/libxml2/UnpackedTarball_libxml2.mk
b/external/libxml2/UnpackedTarball_libxml2.mk
index c92e46992db3..b0555e648b2c 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -25,6 +25,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
$(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
external/libxml2/libxml2-icu-sym.patch.0, \
external/libxml2/libxml2-icu.patch.0) \
+ external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 \
))
$(eval $(call
gb_UnpackedTarball_add_file,libxml2,xml2-config.in,external/libxml2/xml2-config.in))
commit 63e5fbb08d294c4dc78c486dfba3800f7b1805ff
Author: Michael Stahl <michael.st...@collabora.com>
AuthorDate: Thu Aug 7 16:50:26 2025 +0200
Commit: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
CommitDate: Fri Aug 8 12:03:47 2025 +0200
libxslt: add patch for CVE-2025-7424
See https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
Change-Id: I68f01dcb6b540ddf3d2e74927ec21c0ca4fc865f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189105
Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
(cherry picked from commit 0f59405c5b255e80707a550129045c3dadd3c46f)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189126
Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
Tested-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
diff --git a/external/libxslt/UnpackedTarball_libxslt.mk
b/external/libxslt/UnpackedTarball_libxslt.mk
index edfb266f2f17..06519e74ae4b 100644
--- a/external/libxslt/UnpackedTarball_libxslt.mk
+++ b/external/libxslt/UnpackedTarball_libxslt.mk
@@ -20,6 +20,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxslt,\
external/libxslt/libxslt-msvc-sym.patch.2, \
external/libxslt/libxslt-msvc.patch.2) \
external/libxslt/rpath.patch.0 \
+ external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 \
))
# vim: set noet sw=4 ts=4:
diff --git a/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1
b/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1
new file mode 100644
index 000000000000..62a34fa61d39
--- /dev/null
+++ b/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1
@@ -0,0 +1,99 @@
+From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
+From: David Kilzer <ddkil...@apple.com>
+Date: Sat, 24 May 2025 15:06:42 -0700
+Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
+ and source nodes
+
+* libxslt/functions.c:
+(xsltDocumentFunctionLoadDocument):
+- Implement fix suggested by Ivan Fratric. This copies the xmlDoc,
+ calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
+ xmlDoc to tctxt->docList.
+- Add error handling for functions that may return NULL.
+* libxslt/transform.c:
+- Remove static keyword so this can be called from
+ xsltDocumentFunctionLoadDocument().
+* libxslt/transformInternals.h: Add.
+(xsltCleanupSourceDoc): Add declaration.
+
+Fixes #139.
+---
+ libxslt/functions.c | 16 +++++++++++++++-
+ libxslt/transform.c | 3 ++-
+ libxslt/transformInternals.h | 9 +++++++++
+ 3 files changed, 26 insertions(+), 2 deletions(-)
+ create mode 100644 libxslt/transformInternals.h
+
+diff --git a/libxslt/functions.c b/libxslt/functions.c
+index 72a58dc4..11ec039f 100644
+--- a/libxslt/functions.c
++++ b/libxslt/functions.c
+@@ -34,6 +34,7 @@
+ #include "numbersInternals.h"
+ #include "keys.h"
+ #include "documents.h"
++#include "transformInternals.h"
+
+ #ifdef WITH_XSLT_DEBUG
+ #define WITH_XSLT_DEBUG_FUNCTION
+@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr
ctxt,
+ /*
+ * This selects the stylesheet's doc itself.
+ */
+- doc = tctxt->style->doc;
++ doc = xmlCopyDoc(tctxt->style->doc, 1);
++ if (doc == NULL) {
++ xsltTransformError(tctxt, NULL, NULL,
++ "document() : failed to copy style doc
");
++ goto out_fragment;
++ }
++ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
++ idoc = xsltNewDocument(tctxt, doc);
++ if (idoc == NULL) {
++ xsltTransformError(tctxt, NULL, NULL,
++ "document() : failed to create xsltDocument
");
++ xmlFreeDoc(doc);
++ goto out_fragment;
++ }
+ } else {
+ goto out_fragment;
+ }
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 54ef821b..38c2dce6 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -43,6 +43,7 @@
+ #include "xsltlocale.h"
+ #include "pattern.h"
+ #include "transform.h"
++#include "transformInternals.h"
+ #include "variables.h"
+ #include "numbersInternals.h"
+ #include "namespaces.h"
+@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
+ *
+ * Resets source node flags and ids stored in 'psvi' member.
+ */
+-static void
++void
+ xsltCleanupSourceDoc(xmlDocPtr doc) {
+ xmlNodePtr cur = (xmlNodePtr) doc;
+ void **psviPtr;
+diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
+new file mode 100644
+index 00000000..d0f42823
+--- /dev/null
++++ b/libxslt/transformInternals.h
+@@ -0,0 +1,9 @@
++/*
++ * Summary: set of internal interfaces for the XSLT engine transformation
part.
++ *
++ * Copy: See Copyright for the status of this software.
++ *
++ * Author: David Kilzer <ddkil...@apple.com>
++ */
++
++void xsltCleanupSourceDoc(xmlDocPtr doc);
+--
+2.39.5 (Apple Git-154)
+
