From 4a4dfe850ed05c81ea90d4165962494c94f8be6d Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Fri, 11 Sep 2020 08:47:15 +0100
Subject: [PATCH] Add fix for CVE-2020-24977 (RHBZ#1877788, RHBZ#1877789).

---
 libxml2-2.9.10-CVE-2020-24977.patch | 41 +++++++++++++++++++++++++++++
 mingw-libxml2.spec                  |  7 ++++-
 2 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 libxml2-2.9.10-CVE-2020-24977.patch

diff --git a/libxml2-2.9.10-CVE-2020-24977.patch b/libxml2-2.9.10-CVE-2020-24977.patch
new file mode 100644
index 0000000..b5a7bec
--- /dev/null
+++ b/libxml2-2.9.10-CVE-2020-24977.patch
@@ -0,0 +1,41 @@
+From 8e7c20a1af8776677d7890f30b7a180567701a49 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Mon, 3 Aug 2020 17:30:41 +0200
+Subject: [PATCH] Fix integer overflow when comparing schema dates
+
+Found by OSS-Fuzz.
+---
+ xmlschemastypes.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/xmlschemastypes.c b/xmlschemastypes.c
+index 4249d700..d6b9f924 100644
+--- a/xmlschemastypes.c
++++ b/xmlschemastypes.c
+@@ -3691,6 +3691,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
+ 	minday = 0;
+ 	maxday = 0;
+     } else {
++        if (myear > LONG_MAX / 366)
++            return -2;
+         /* FIXME: This doesn't take leap year exceptions every 100/400 years
+            into account. */
+ 	maxday = 365 * myear + (myear + 3) / 4;
+@@ -4079,6 +4081,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
+     if ((x == NULL) || (y == NULL))
+         return -2;
+ 
++    if ((x->value.date.year > LONG_MAX / 366) ||
++        (x->value.date.year < LONG_MIN / 366) ||
++        (y->value.date.year > LONG_MAX / 366) ||
++        (y->value.date.year < LONG_MIN / 366)) {
++        /* Possible overflow when converting to days. */
++        return -2;
++    }
++
+     if (x->value.date.tz_flag) {
+ 
+         if (!y->value.date.tz_flag) {
+-- 
+2.28.0.rc2
+
diff --git a/mingw-libxml2.spec b/mingw-libxml2.spec
index 3138d92..82f44d8 100644
--- a/mingw-libxml2.spec
+++ b/mingw-libxml2.spec
@@ -2,7 +2,7 @@
 
 Name:           mingw-libxml2
 Version:        2.9.10
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        MinGW Windows libxml2 XML processing library
 
 License:        MIT
@@ -18,6 +18,8 @@ Patch2:         mingw-libxml2-2.9.10-fix-relaxed-approach-to-nested-documents.pa
 Patch3:         mingw-libxml2-2.9.10-CVE-2019-20388.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1799788
 Patch4:         mingw-libxml2-2.9.10-CVE-2020-7595.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1877788
+Patch6:         libxml2-2.9.10-CVE-2020-24977.patch
 
 BuildArch:      noarch
 
@@ -149,6 +151,9 @@ find $RPM_BUILD_ROOT -name "*.la" -delete
 
 
 %changelog
+* Fri Sep 11 2020 Richard W.M. Jones <rjones@redhat.com> - 2.9.10-7
+- Add fix for CVE-2020-24977 (RHBZ#1877788, RHBZ#1877789).
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.10-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild