From 348be18ac4b40caa531048d977df7d54b4ea9d14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Mon, 14 Jul 2025 10:31:12 +0200
Subject: [PATCH] libxml2_13: add patch for CVE-2025-6021

---
 .../libraries/libxml2/CVE-2025-6021.patch     | 40 +++++++++++++++++++
 pkgs/development/libraries/libxml2/common.nix |  3 +-
 .../development/libraries/libxml2/default.nix |  8 ++--
 3 files changed, 47 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/libraries/libxml2/CVE-2025-6021.patch

diff --git a/pkgs/development/libraries/libxml2/CVE-2025-6021.patch b/pkgs/development/libraries/libxml2/CVE-2025-6021.patch
new file mode 100644
index 000000000000..7d20a17c7038
--- /dev/null
+++ b/pkgs/development/libraries/libxml2/CVE-2025-6021.patch
@@ -0,0 +1,40 @@
+diff --git a/tree.c b/tree.c
+index f097cf87..4d966ec9 100644
+--- a/tree.c
++++ b/tree.c
+@@ -47,6 +47,10 @@
+ #include "private/error.h"
+ #include "private/tree.h"
+ 
++#ifndef SIZE_MAX
++  #define SIZE_MAX ((size_t) -1)
++#endif
++
+ int __xmlRegisterCallbacks = 0;
+ 
+ /************************************************************************
+@@ -167,10 +168,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
+ xmlChar *
+ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
+ 	      xmlChar *memory, int len) {
+-    int lenn, lenp;
++    size_t lenn, lenp;
+     xmlChar *ret;
+ 
+-    if (ncname == NULL) return(NULL);
++    if ((ncname == NULL) || (len < 0)) return(NULL);
+     if (prefix == NULL) return((xmlChar *) ncname);
+ 
+ #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+@@ -181,8 +182,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
+ 
+     lenn = strlen((char *) ncname);
+     lenp = strlen((char *) prefix);
++    if (lenn >= SIZE_MAX - lenp - 1)
++        return(NULL);
+ 
+-    if ((memory == NULL) || (len < lenn + lenp + 2)) {
++    if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
+ 	ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
+ 	if (ret == NULL)
+ 	    return(NULL);
diff --git a/pkgs/development/libraries/libxml2/common.nix b/pkgs/development/libraries/libxml2/common.nix
index 3a2d6836fc11..7ab55b3f10bb 100644
--- a/pkgs/development/libraries/libxml2/common.nix
+++ b/pkgs/development/libraries/libxml2/common.nix
@@ -29,6 +29,7 @@
   enableHttp ? false,
 
   version,
+  extraPatches ? [ ],
   src,
   extraMeta ? { },
   freezeUpdateScript ? false,
@@ -65,7 +66,7 @@ stdenv'.mkDerivation (finalAttrs: {
     # See also https://gitlab.gnome.org/GNOME/libxml2/-/issues/906
     # Source: https://github.com/chromium/chromium/blob/4fb4ae8ce3daa399c3d8ca67f2dfb9deffcc7007/third_party/libxml/chromium/xml-attr-extra.patch
     ./xml-attr-extra.patch
-  ];
+  ] ++ extraPatches;
 
   strictDeps = true;
 
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 940f007b97da..8bc4ddcdd079 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -15,11 +15,13 @@ let
         tag = "v${packages.libxml2_13.version}";
         hash = "sha256-acemyYs1yRSTSLH7YCGxnQzrEDm8YPTK4HtisC36LsY=";
       };
+      extraPatches = [
+        # same as upstream patch but fixed conflict and added required import:
+        # https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0.diff
+        ./CVE-2025-6021.patch
+      ];
       freezeUpdateScript = true;
       extraMeta = {
-        knownVulnerabilities = [
-          "CVE-2025-6021"
-        ];
         maintainers = with lib.maintainers; [
           gepbird
         ];