On Thu, May 13, 2021 at 05:52:16PM +0200, Jan Tojnar wrote: > Hi, trying to build the package from the tarball on NixOS, it appears that > fuzz/fuzz.h is missing from the archive: > > testFuzzer.c:13:10: fatal error: fuzz.h: No such file or directory > 13 | #include "fuzz.h" > | ^~~~~~~~ > compilation terminated. > > It appears to be available in the git repo, so perhaps it just needs to be > added to EXTRA_DIST or something?
Arghhh, indeed :-( Daniel > On Thu, May 13 2021 at 15:54:55 +0200, Daniel Veillard via xml > <xml@gnome.org> wrote: > > Pffff, I am way way behind, but now that CVE-2021-3541 is out I just > > pushed > > that long awaited release. libxml2 2.9.11 is tagged in git and a signed > > tarball is available at the usual place: > > > > ftp://xmlsoft.org/libxml2/ > > > > > > This release incoporate the various security and quadatic patches that > > Nick has found and fixed, and CVE-2021-3541. There is also a very large > > list > > of bug fixes and improvement most of them from Nick too: > > > > Security: > > - Patch for security issue CVE-2021-3541 (Daniel Veillard) > > Documentation: > > - Clarify xmlNewDocProp documentation (Nick Wellnhofer) > > Portability: > > - CMake: Only add postfixes if MSVC (Christopher Degawa) > > - Fix XPath NaN/Inf for older GCC versions (Nick Wellnhofer) > > - Use CMake PROJECT_VERSION (Markus Rickert) > > - Fix warnings in libxml.m4 with autoconf 2.70+. (Simon Josefsson) > > - Add CI for CMake on MSVC (Markus Rickert) > > - Update minimum required CMake version (Markus Rickert) > > - Add variables for configured options to CMake config files (Markus > > Rickert) > > - Check if variables exist when defining targets (Markus Rickert) > > - Check if target exists when reading target properties (Markus Rickert) > > - Add xmlcatalog target and definition to config files (Markus Rickert) > > - Remove include directories for link-only dependencies (Markus Rickert) > > - Fix ICU build in CMake (Markus Rickert) > > - Configure pkgconfig, xml2-config, and xml2Conf.sh file (Markus > > Rickert) > > - Update CMake config files (Markus Rickert) > > - Add xmlcatalog and xmllint to CMake export (Markus Rickert) > > - Simplify xmlexports.h (Nick Wellnhofer) > > - Require dependencies based on enabled CMake options (Markus Rickert) > > - Use NAMELINK_COMPONENT in CMake install (Markus Rickert) > > - Add CMake files to EXTRA_DIST (Markus Rickert) > > - Add missing compile definition for static builds to CMake (Markus > > Rickert) > > - Add CI for CMake on Linux and MinGW (Markus Rickert) > > - Fix variable name in win32/configure.js (Nick Wellnhofer) > > - Fix version parsing in win32/configure.js (Nick Wellnhofer) > > - Fix autotools warnings (Nick Wellnhofer) > > - Update config.h.cmake.in (Markus Rickert) > > - win32: allow passing *FLAGS on command line (Michael Stahl) > > - Configure file xmlwin32version.h.in on MSVC (Markus Rickert) > > - List headers individually (Markus Rickert) > > - Add CMake build files (Markus Rickert) > > - Parenthesize Py<type>_Check() in ifs (Miro Hrončok) > > - Minor fixes to configure.js (Nick Wellnhofer) > > Bug Fixes: > > - Fix null deref in legacy SAX1 parser (Nick Wellnhofer) > > - Fix handling of unexpected EOF in xmlParseContent (Nick Wellnhofer) > > - Fix line numbers in error messages for mismatched tags (Nick > > Wellnhofer) > > - Fix htmlTagLookup (Nick Wellnhofer) > > - Propagate error in xmlParseElementChildrenContentDeclPriv (Nick > > Wellnhofer) > > - Fix user-after-free with `xmllint --xinclude --dropdtd` (Nick > > Wellnhofer) > > - Fix dangling pointer with `xmllint --dropdtd` (Nick Wellnhofer) > > - Validate UTF8 in xmlEncodeEntities (Joel Hockey) > > - Fix use-after-free with `xmllint --html --push` (Nick Wellnhofer) > > - Allow FP division by zero in xmlXPathInit (Nick Wellnhofer) > > - Fix xmlGetNodePath with invalid node types (Nick Wellnhofer) > > - Fix exponential behavior with recursive entities (Nick Wellnhofer) > > - Fix quadratic behavior when looking up xml:* attributes (Nick > > Wellnhofer) > > - Fix slow parsing of HTML with encoding errors (Nick Wellnhofer) > > - Fix null deref introduced with previous commit (Nick Wellnhofer) > > - Check for invalid redeclarations of predefined entities (Nick > > Wellnhofer) > > - Add the copy of type from original xmlDoc in xmlCopyDoc() (SVGAnimate) > > - parser.c: shrink the input buffer when appropriate (Mike Dalessio) > > - Fix infinite loop in HTML parser introduced with recent commits (Nick > > Wellnhofer) > > - Fix quadratic runtime when parsing CDATA sections (Nick Wellnhofer) > > - Fix timeout when handling recursive entities (Nick Wellnhofer) > > - Fix memory leak in xmlParseElementMixedContentDecl (Nick Wellnhofer) > > - Fix null deref in xmlStringGetNodeList (Nick Wellnhofer) > > - use new htmlParseLookupCommentEnd to find comment ends (Mike Dalessio) > > - htmlParseComment: treat `--!>` as if it closed the comment (Mike > > Dalessio) > > - Fix integer overflow in xmlSchemaGetParticleTotalRangeMin (Nick > > Wellnhofer) > > - encoding: fix memleak in xmlRegisterCharEncodingHandler() (Xiaoming > > Ni) > > - xmlschemastypes.c: xmlSchemaGetFacetValueAsULong add, check > > "facet->val" (Xiaoming Ni) > > - Fix null pointer deref in xmlXPtrRangeInsideFunction (Nick Wellnhofer) > > - Fix quadratic runtime in HTML push parser with null bytes (Nick > > Wellnhofer) > > - Avoid quadratic checking of identity-constraints (Michael Matz) > > - Fix building with ICU 68. (Frederik Seiffert) > > - Convert python/libxml.c to PY_SSIZE_T_CLEAN (Victor Stinner) > > - Fix xmlURIEscape memory leaks. (Elliott Hughes) > > - Avoid call stack overflow with XML reader and recursive XIncludes > > (Nick Wellnhofer) > > - Fix caret in regexp character group (Nick Wellnhofer) > > - parser.c: xmlParseCharData peek behavior fixed wrt newlines (Mike > > Dalessio) > > - Fix memory leaks in XPointer string-range function (Nick Wellnhofer) > > - Fix use-after-free when XIncluding text from Reader (Nick Wellnhofer) > > - Fix SEGV in xmlSAXParseFileWithData (yanjinjq) > > - Fix null deref in XPointer expression error path (Nick Wellnhofer) > > - Don't call xmlXPathInit directly (Nick Wellnhofer) > > - Fix cleanup of attributes in XML reader (Nick Wellnhofer) > > - Fix double free in XML reader with XIncludes (Nick Wellnhofer) > > - Fix memory leak in xmlXIncludeAddNode error paths (Nick Wellnhofer) > > - Revert "Fix quadratic runtime in xi:fallback processing" (Nick > > Wellnhofer) > > - Fix error reporting with xi:fallback (Nick Wellnhofer) > > - Fix quadratic runtime in xi:fallback processing (Nick Wellnhofer) > > - Fix corner case with empty xi:fallback (Nick Wellnhofer) > > - Fix XInclude regression introduced with recent commit (Nick > > Wellnhofer) > > - Fix memory leak in runtest.c (Nick Wellnhofer) > > - Make "xmllint --push --recovery" work (Nick Wellnhofer) > > - Revert "Do not URI escape in server side includes" (Nick Wellnhofer) > > - Fix column number accounting in xmlParse*NameAndCompare (Nick > > Wellnhofer) > > - Stop counting nbChars in parser context (Nick Wellnhofer) > > - Fix out-of-bounds read with 'xmllint --htmlout' (Nick Wellnhofer) > > - Fix exponential runtime and memory in xi:fallback processing (Nick > > Wellnhofer) > > - Don't process siblings of root in xmlXIncludeProcess (Nick Wellnhofer) > > - Don't recurse into xi:include children in xmlXIncludeDoProcess (Nick > > Wellnhofer) > > - Fix memory leak in xmlXIncludeIncludeNode error paths (Nick > > Wellnhofer) > > - Check for custom free function in global destructor (Nick Wellnhofer) > > - Fix integer overflow when comparing schema dates (Nick Wellnhofer) > > - Fix exponential runtime in xmlFARecurseDeterminism (Nick Wellnhofer) > > - Don't try to handle namespaces when building HTML documents (Nick > > Wellnhofer) > > - Fix several quadratic runtime issues in HTML push parser (Nick > > Wellnhofer) > > - Fix quadratic runtime when push parsing HTML start tags (Nick > > Wellnhofer) > > - Reset XML parser input before reporting errors (David Kilzer) > > - Fix quadratic runtime when push parsing HTML entity refs (Nick > > Wellnhofer) > > - Fix HTML push parser lookahead (Nick Wellnhofer) > > - Make htmlCurrentChar always translate U+0000 (Nick Wellnhofer) > > - Fix UTF-8 decoder in HTML parser (Nick Wellnhofer) > > - Fix quadratic runtime when parsing HTML script content (Nick > > Wellnhofer) > > - Reset HTML parser input before reporting error (Nick Wellnhofer) > > - Fix more quadratic runtime issues in HTML push parser (Nick > > Wellnhofer) > > - Fix regression introduced with 477c7f6a (Nick Wellnhofer) > > - Fix quadratic runtime in HTML parser (Nick Wellnhofer) > > - Reset HTML parser input before reporting encoding error (Nick > > Wellnhofer) > > - Fix integer overflow in xmlFAParseQuantExact (Nick Wellnhofer) > > - Fix return value of xmlC14NDocDumpMemory (Nick Wellnhofer) > > - Don't follow next pointer on documents in xmlXPathRunStreamEval (Nick > > Wellnhofer) > > - Fix integer overflow in _xmlSchemaParseGYear (Nick Wellnhofer) > > - Fix integer overflow when parsing {min,max}Occurs (Nick Wellnhofer) > > - Fix another memory leak in xmlSchemaValAtomicType (Nick Wellnhofer) > > - Fix unsigned integer overflow in htmlParseTryOrFinish (Nick > > Wellnhofer) > > - Fix integer overflow in htmlParseCharRef (Nick Wellnhofer) > > - Fix undefined behavior in UTF16LEToUTF8 (Nick Wellnhofer) > > - Fix return value of xmlCharEncOutput (Nick Wellnhofer) > > - Never expand parameter entities in text declaration (Nick Wellnhofer) > > - Fix undefined behavior in xmlXPathTryStreamCompile (Nick Wellnhofer) > > - Fix use-after-free with validating reader (Nick Wellnhofer) > > - xmlParseBalancedChunkMemory must not be called with NULL doc (Nick > > Wellnhofer) > > - Revert "Fix memory leak in xmlParseBalancedChunkMemoryRecover" (Nick > > Wellnhofer) > > - Fix memory leak in xmlXIncludeLoadDoc error path (Nick Wellnhofer) > > - Make schema validation fail with multiple top-level elements (Nick > > Wellnhofer) > > - Call xmlCleanupParser on ELF destruction (Samuel Thibault) > > - Fix copying of entities in xmlParseReference (Nick Wellnhofer) > > - Fix memory leak in xmlSchemaValidateStream (Zhipeng Xie) > > - Fix xmlSchemaGetCanonValue formatting for date and dateTime (Kevin > > Puetz) > > - Fix memory leak when shared libxml.dll is unloaded (Kevin Puetz) > > - Fix potentially-uninitialized critical section in Win32 DLL builds > > (Kevin Puetz) > > - Fix integer overflow in xmlBufferResize (Nick Wellnhofer) > > - Check for overflow when allocating two-dimensional arrays (Nick > > Wellnhofer) > > - Remove useless comparisons (Nick Wellnhofer) > > - Fix overflow check in xmlNodeDump (Nick Wellnhofer) > > - Fix infinite loop in xmlStringLenDecodeEntities (Zhipeng Xie) > > - Fix freeing of nested documents (Nick Wellnhofer) > > - Fix more memory leaks in error paths of XPath parser (Nick Wellnhofer) > > - Fix memory leaks of encoding handlers in xmlsave.c (Nick Wellnhofer) > > - Fix xml2-config error code (Nick Wellnhofer) > > - Fix memory leak in error path of XPath expr parser (Nick Wellnhofer) > > - Fix overflow handling in xmlBufBackToBuffer (Nick Wellnhofer) > > - Null pointer handling in catalog.c (raniervf) > > - xml2-config.in: fix regressions introduced by commit 2f2bf4b2c (Dmitry > > V. Levin) > > Improvements: > > - Store per-element parser state in a struct (Nick Wellnhofer) > > - update for xsd:language type check (PaulHiggs) > > - Update INSTALL.libxml2 (Nick Wellnhofer) > > - Fix include order in c14n.h (Nick Wellnhofer) > > - Fix duplicate xmlStrEqual calls in htmlParseEndTag (Nick Wellnhofer) > > - Speed up htmlCheckAutoClose (Nick Wellnhofer) > > - Speed up htmlTagLookup (Nick Wellnhofer) > > - Stop checking attributes for UTF-8 validity (Nick Wellnhofer) > > - Reduce some fuzzer timeouts (Nick Wellnhofer) > > - Only run a few CI tests unless scheduled (Nick Wellnhofer) > > - Improve fuzzer stability (Nick Wellnhofer) > > - Check for feature flags in fuzzer tests (Nick Wellnhofer) > > - Another attempt at improving fuzzer stability (Nick Wellnhofer) > > - Revert "Improve HTML fuzzer stability" (Nick Wellnhofer) > > - Add charset names to fuzzing dictionaries (Nick Wellnhofer) > > - Improve HTML fuzzer stability (Nick Wellnhofer) > > - Add CI for MSVC x86 (Markus Rickert) > > - Add a flag to not output anything when xmllint succeeded (hhb) > > - Speed up HTML fuzzer (Nick Wellnhofer) > > - Remove unused encoding parameter of HTML output functions (Nick > > Wellnhofer) > > - Handle malloc failures in fuzzing code (Nick Wellnhofer) > > - add test coverage for incorrectly-closed comments (Mike Dalessio) > > - Enforce maximum length of fuzz input (Nick Wellnhofer) > > - Remove temporary members from struct _xmlXPathContext (Nick > > Wellnhofer) > > - Build the Python extension with PY_SSIZE_T_CLEAN (Victor Stinner) > > - Add CI test for Python 3 (Nick Wellnhofer) > > - Add fuzzing dictionaries to EXTRA_DIST (Nick Wellnhofer) > > - Add 'fuzz' subdirectory to DIST_SUBDIRS (Nick Wellnhofer) > > - Allow port numbers up to INT_MAX (Nick Wellnhofer) > > - Handle dumps of corrupted documents more gracefully (Nick Wellnhofer) > > - Limit size of free lists in XML reader when fuzzing (Nick Wellnhofer) > > - Hardcode maximum XPath recursion depth (Nick Wellnhofer) > > - Pass URL of main entity in XML fuzzer (Nick Wellnhofer) > > - Consolidate seed corpus generation (Nick Wellnhofer) > > - Test fuzz targets with dummy driver (Nick Wellnhofer) > > - Fix regression introduced with commit d88df4b (Nick Wellnhofer) > > - Fix regression introduced with commit 74dcc10b (Nick Wellnhofer) > > - Add TODO comment in xinclude.c (Nick Wellnhofer) > > - Stop using maxParserDepth in xpath.c (Nick Wellnhofer) > > - Remove dead code in xinclude.c (Nick Wellnhofer) > > - Don't add formatting newlines to XInclude nodes (Nick Wellnhofer) > > - Don't use SAX1 if all element handlers are NULL (Nick Wellnhofer) > > - Remove unneeded progress checks in HTML parser (Nick Wellnhofer) > > - Use strcmp when fuzzing (Nick Wellnhofer) > > - Fix XPath fuzzer (Nick Wellnhofer) > > - Fuzz XInclude engine (Nick Wellnhofer) > > - Add XPath and XPointer fuzzer (Nick Wellnhofer) > > - Update fuzzing code (Nick Wellnhofer) > > - More *NodeDumpOutput fixes (Nick Wellnhofer) > > - Fix *NodeDumpOutput functions (Nick Wellnhofer) > > - Make xmlNodeDumpOutputInternal non-recursive (Nick Wellnhofer) > > - Make xhtmlNodeDumpOutput non-recursive (Nick Wellnhofer) > > - Make htmlNodeDumpFormatOutput non-recursive (Nick Wellnhofer) > > - Fix .gitattributes (Nick Wellnhofer) > > - Rework control flow in htmlCurrentChar (Nick Wellnhofer) > > - Make 'xmllint --html --push -' read from stdin (Nick Wellnhofer) > > - Remove misleading comments in xpath.c (Nick Wellnhofer) > > - Update to Devhelp index file format version 2 (Andre Klapper) > > - Set project language to C (Markus Rickert) > > - Add variable for working directory of XML Conformance Test Suite > > (Markus Rickert) > > - Add additional tests and XML Conformance Test Suite (Markus Rickert) > > - Add command line option for temp directory in runtest (Markus Rickert) > > - Ensure LF line endings for test files (Markus Rickert) > > - Enable runtests and testThreads (Markus Rickert) > > - Limit regexp nesting depth (Nick Wellnhofer) > > - Fix return values and documentation in encoding.c (Nick Wellnhofer) > > - Add regexp regression tests (David Kilzer) > > - Report error for invalid regexp quantifiers (Nick Wellnhofer) > > - Fix rebuilding docs, by hiding __attribute__((...)) behind a macro. > > (Martin Vidner) > > - Copy xs:duration parser from libexslt (Nick Wellnhofer) > > - Fuzz target for XML Schemas (Nick Wellnhofer) > > - Move entity recorder to fuzz.c (Nick Wellnhofer) > > - Fuzz target for HTML parser (Nick Wellnhofer) > > - Update GitLab CI container (Nick Wellnhofer) > > - Add options file for xml fuzzer (Nick Wellnhofer) > > - Add a couple of libFuzzer targets (Nick Wellnhofer) > > - Guard new calls to xmlValidatePopElement in xml_reader.c (Daniel > > Cheng) > > - Add LIBXML_VALID_ENABLED to xmlreader (Łukasz Wojniłowicz) > > - Fix typos (Nick Wellnhofer) > > - Disable LeakSanitizer (Nick Wellnhofer) > > - Stop calling SAX getEntity handler from XMLReader (Nick Wellnhofer) > > - Add test case for recursive external parsed entities (Nick Wellnhofer) > > - Enable error tests with entity substitution (Nick Wellnhofer) > > - Don't load external entity from xmlSAX2GetEntity (Nick Wellnhofer) > > - Merge code paths loading external entities (Nick Wellnhofer) > > - Copy some XMLReader option flags to parser context (Nick Wellnhofer) > > - Add xmlPopOutputCallbacks (Nick Wellnhofer) > > - Updated Python test reader2.py (Pieter van Oostrum) > > - Updated python/tests/tstLastError.py (Pieter van Oostrum) > > - Use random seed in xmlDictComputeFastKey (Ranier Vilela) > > - Enable more undefined behavior sanitizers (Nick Wellnhofer) > > > > Thanks everybody who contributed for this release, obviously Nick did > > the bulk of the work but there were a number of other contributors, > > > > enjoy ! > > > > Daniel > > > > -- > > Daniel Veillard | Red Hat Developers Tools > > http://developer.redhat.com/ > > veill...@redhat.com | libxml Gnome XML XSLT toolkit > > http://xmlsoft.org/ > > http://veillard.com/ | virtualization library http://libvirt.org/ > > > > _______________________________________________ > > xml mailing list, project page http://xmlsoft.org/ > > xml@gnome.org > > https://mail.gnome.org/mailman/listinfo/xml > -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veill...@redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/ _______________________________________________ xml mailing list, project page http://xmlsoft.org/ xml@gnome.org https://mail.gnome.org/mailman/listinfo/xml
