download.lst | 4 external/libxslt/ExternalPackage_libxslt.mk | 2 external/libxslt/UnpackedTarball_libxslt.mk | 1 external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 | 99 ---------------- 4 files changed, 3 insertions(+), 103 deletions(-)
New commits: commit ed14fd4aa973326863d7eb7d7e7bb765d22f9c00 Author: Xisco Fauli <[email protected]> AuthorDate: Thu Dec 4 12:13:56 2025 +0100 Commit: Xisco Fauli <[email protected]> CommitDate: Thu Dec 4 13:43:37 2025 +0100 libxslt: upgrade to 1.1.45 it fixes CVE-2025-11731 external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 has been fixed upstream Downloaded from https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.45.tar.xz Change-Id: If1acddfd1730faedfd015132c132a307509641c9 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/194986 Tested-by: Jenkins Reviewed-by: Xisco Fauli <[email protected]> diff --git a/download.lst b/download.lst index 4ad9689ad12e..1e87103999d2 100644 --- a/download.lst +++ b/download.lst @@ -466,8 +466,8 @@ LIBXML_TARBALL := libxml2-2.14.$(LIBXML_VERSION_MICRO).tar.xz # three static lines # so that git cherry-pick # will not run into conflicts -LIBXSLT_SHA256SUM := 5a3d6b383ca5afc235b171118e90f5ff6aa27e9fea3303065231a6d403f0183a -LIBXSLT_VERSION_MICRO := 43 +LIBXSLT_SHA256SUM := 9acfe68419c4d06a45c550321b3212762d92f41465062ca4ea19e632ee5d216e +LIBXSLT_VERSION_MICRO := 45 LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz # three static lines # so that git cherry-pick diff --git a/external/libxslt/ExternalPackage_libxslt.mk b/external/libxslt/ExternalPackage_libxslt.mk index 6d34589ea71a..287c529b4b72 100644 --- a/external/libxslt/ExternalPackage_libxslt.mk +++ b/external/libxslt/ExternalPackage_libxslt.mk @@ -25,7 +25,7 @@ $(eval $(call gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.dl endif else # OS!=WNT $(eval $(call gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libxslt.so.1,libxslt/.libs/libxslt.so.1.1.$(LIBXSLT_VERSION_MICRO))) -$(eval $(call gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.24)) +$(eval $(call gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.25)) endif endif # DISABLE_DYNLOADING diff --git a/external/libxslt/UnpackedTarball_libxslt.mk b/external/libxslt/UnpackedTarball_libxslt.mk index bd2417841e07..8941aba71c0a 100644 --- a/external/libxslt/UnpackedTarball_libxslt.mk +++ b/external/libxslt/UnpackedTarball_libxslt.mk @@ -20,7 +20,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxslt,\ external/libxslt/libxslt-msvc-sym.patch.2, \ external/libxslt/libxslt-msvc.patch.2) \ external/libxslt/rpath.patch.0 \ - external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 \ external/libxslt/77.patch.1 \ )) diff --git a/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 b/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 deleted file mode 100644 index 62a34fa61d39..000000000000 --- a/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 +++ /dev/null @@ -1,99 +0,0 @@ -From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001 -From: David Kilzer <[email protected]> -Date: Sat, 24 May 2025 15:06:42 -0700 -Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet - and source nodes - -* libxslt/functions.c: -(xsltDocumentFunctionLoadDocument): -- Implement fix suggested by Ivan Fratric. This copies the xmlDoc, - calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the - xmlDoc to tctxt->docList. -- Add error handling for functions that may return NULL. -* libxslt/transform.c: -- Remove static keyword so this can be called from - xsltDocumentFunctionLoadDocument(). -* libxslt/transformInternals.h: Add. -(xsltCleanupSourceDoc): Add declaration. - -Fixes #139. ---- - libxslt/functions.c | 16 +++++++++++++++- - libxslt/transform.c | 3 ++- - libxslt/transformInternals.h | 9 +++++++++ - 3 files changed, 26 insertions(+), 2 deletions(-) - create mode 100644 libxslt/transformInternals.h - -diff --git a/libxslt/functions.c b/libxslt/functions.c -index 72a58dc4..11ec039f 100644 ---- a/libxslt/functions.c -+++ b/libxslt/functions.c -@@ -34,6 +34,7 @@ - #include "numbersInternals.h" - #include "keys.h" - #include "documents.h" -+#include "transformInternals.h" - - #ifdef WITH_XSLT_DEBUG - #define WITH_XSLT_DEBUG_FUNCTION -@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, - /* - * This selects the stylesheet's doc itself. - */ -- doc = tctxt->style->doc; -+ doc = xmlCopyDoc(tctxt->style->doc, 1); -+ if (doc == NULL) { -+ xsltTransformError(tctxt, NULL, NULL, -+ "document() : failed to copy style doc "); -+ goto out_fragment; -+ } -+ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */ -+ idoc = xsltNewDocument(tctxt, doc); -+ if (idoc == NULL) { -+ xsltTransformError(tctxt, NULL, NULL, -+ "document() : failed to create xsltDocument "); -+ xmlFreeDoc(doc); -+ goto out_fragment; -+ } - } else { - goto out_fragment; - } -diff --git a/libxslt/transform.c b/libxslt/transform.c -index 54ef821b..38c2dce6 100644 ---- a/libxslt/transform.c -+++ b/libxslt/transform.c -@@ -43,6 +43,7 @@ - #include "xsltlocale.h" - #include "pattern.h" - #include "transform.h" -+#include "transformInternals.h" - #include "variables.h" - #include "numbersInternals.h" - #include "namespaces.h" -@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt) - * - * Resets source node flags and ids stored in 'psvi' member. - */ --static void -+void - xsltCleanupSourceDoc(xmlDocPtr doc) { - xmlNodePtr cur = (xmlNodePtr) doc; - void **psviPtr; -diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h -new file mode 100644 -index 00000000..d0f42823 ---- /dev/null -+++ b/libxslt/transformInternals.h -@@ -0,0 +1,9 @@ -+/* -+ * Summary: set of internal interfaces for the XSLT engine transformation part. -+ * -+ * Copy: See Copyright for the status of this software. -+ * -+ * Author: David Kilzer <[email protected]> -+ */ -+ -+void xsltCleanupSourceDoc(xmlDocPtr doc); --- -2.39.5 (Apple Git-154) -
