From e294a43a5dd4d7f0c2a6f383cfa1f01875a4adfa Mon Sep 17 00:00:00 2001
From: Emmanuele Bassi <[email protected]>
Date: Thu, 04 Jun 2026 23:20:12 -0700
Subject: [PATCH] Roll libxml2 to v2.15.0-114-g962bd10d

* Drop fix-xmlEscapeText-integer-overflow.patch: fix included upstream
* Update roll.py and README.chromium
* CVE fixes: CVE-2025-7425, CVE-2025-49794, CVE-2025-49796,
  CVE-2025-49795, CVE-2025-6170, CVE-2025-32415, CVE-2025-32414

https://gitlab.gnome.org/GNOME/libxml2/-/compare/962bd10d01151d29190567e2d15ccf641be55063...d23960a130c5bb82779c9405fbbf85e65fb3c57c

Bug: 519665978
Change-Id: I2bb7dcb54f1513c0ccc6568cca0b86291aeb857d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7899458
Reviewed-by: Dominik Röttsches <[email protected]>
Reviewed-by: Daniel Cheng <[email protected]>
Commit-Queue: Dominik Röttsches <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1642164}
---

diff --git a/third_party/libxml/README.chromium b/third_party/libxml/README.chromium
index 1172eab8..4c92e0f 100644
--- a/third_party/libxml/README.chromium
+++ b/third_party/libxml/README.chromium
@@ -1,7 +1,7 @@
 Name: libxml
 URL: http://xmlsoft.org
-Version: 22f9d730898d2dfcc03a484e65e1f8fc3675225f
-Revision: 22f9d730898d2dfcc03a484e65e1f8fc3675225f
+Version: 962bd10d01151d29190567e2d15ccf641be55063
+Revision: 962bd10d01151d29190567e2d15ccf641be55063
 Update Mechanism: Manual
 CPEPrefix: cpe:/a:xmlsoft:libxml2:2.14.6
 License: MIT
diff --git a/third_party/libxml/chromium/roll.py b/third_party/libxml/chromium/roll.py
index 40cb99d..dfb9753 100755
--- a/third_party/libxml/chromium/roll.py
+++ b/third_party/libxml/chromium/roll.py
@@ -75,7 +75,6 @@
     'remove-getentropy.patch',
     'xml-attr-extra.patch',
     'widen-extra-field-in-_xmlNode-to-an-int.patch',
-    'fix-xmlEscapeText-integer-overflow.patch',
 ]
 
 
diff --git a/third_party/libxml/linux/include/libxml/xmlversion.h b/third_party/libxml/linux/include/libxml/xmlversion.h
index 0d7aa7d5..eac2eb75 100644
--- a/third_party/libxml/linux/include/libxml/xmlversion.h
+++ b/third_party/libxml/linux/include/libxml/xmlversion.h
@@ -141,6 +141,13 @@
 #define LIBXML_SGML_CATALOG_ENABLED
 #endif
 
+#if 0
+/**
+ * Whether the Windows path support is configured in
+ */
+#define LIBXML_WINPATH_ENABLED
+#endif
+
 #if 1
 /**
  * Whether XPath is configured in
diff --git a/third_party/libxml/linux/xml2-config b/third_party/libxml/linux/xml2-config
index d03bf27..a882382 100755
--- a/third_party/libxml/linux/xml2-config
+++ b/third_party/libxml/linux/xml2-config
@@ -86,7 +86,7 @@
             shift
             libs="-lxml2 "
         else
-            libs="-lxml2   -licuuc -licudata  -lm "
+            libs="-lxml2   -licuuc -lm "
         fi
 
         if [ "${exec_prefix}/lib" != "/usr/lib" -a "${exec_prefix}/lib" != "/usr/lib64" ]; then
diff --git a/third_party/libxml/src/Makefile.am b/third_party/libxml/src/Makefile.am
index 19ec305..0a2a729 100644
--- a/third_party/libxml/src/Makefile.am
+++ b/third_party/libxml/src/Makefile.am
@@ -23,6 +23,7 @@
 	runxmlconf \
 	testModule \
 	testapi \
+	testcatalog \
 	testchar \
 	testdict \
 	testlimits \
@@ -110,7 +111,7 @@
 
 runtest_SOURCES=runtest.c
 runtest_DEPENDENCIES = $(DEPS)
-runtest_LDADD= $(THREAD_LIBS) $(LDADDS)
+runtest_LDADD= $(THREAD_LIBS) $(Z_LIBS) $(LDADDS)
 
 testrecurse_SOURCES=testrecurse.c
 testrecurse_DEPENDENCIES = $(DEPS)
@@ -120,6 +121,10 @@
 testlimits_DEPENDENCIES = $(DEPS)
 testlimits_LDADD= $(LDADDS)
 
+testcatalog_SOURCES=testcatalog.c
+testcatalog_DEPENDENCIES = $(DEPS)
+testcatalog_LDADD= $(LDADDS)
+
 testchar_SOURCES=testchar.c
 testchar_DEPENDENCIES = $(DEPS)
 testchar_LDADD= $(LDADDS)
@@ -137,9 +142,9 @@
 runsuite_LDADD= $(LDADDS)
 
 xmllint_SOURCES = xmllint.c shell.c lintmain.c
-xmllint_CFLAGS = $(AM_CFLAGS) $(RDL_CFLAGS)
+xmllint_CFLAGS = $(AM_CFLAGS) $(RDL_CFLAGS) $(Z_CFLAGS)
 xmllint_DEPENDENCIES = $(DEPS)
-xmllint_LDADD=  $(RDL_LIBS) $(LDADDS)
+xmllint_LDADD = $(RDL_LIBS) $(Z_LIBS) $(LDADDS)
 
 testModule_SOURCES=testModule.c
 testModule_DEPENDENCIES = $(DEPS)
@@ -167,6 +172,7 @@
 	$(CHECKER) ./runtest$(EXEEXT)
 	$(CHECKER) ./testrecurse$(EXEEXT)
 	$(CHECKER) ./testapi$(EXEEXT)
+	$(CHECKER) ./testcatalog$(EXEEXT)
 	$(CHECKER) ./testchar$(EXEEXT)
 	$(CHECKER) ./testdict$(EXEEXT)
 	$(CHECKER) ./testparser$(EXEEXT)
@@ -186,10 +192,12 @@
 # Compatibility name of the check target
 runtests: check
 
+VALGRIND = valgrind -q --leak-check=full --error-exitcode=1
+
 check-valgrind valgrind:
 	@echo '## Running the regression tests under Valgrind'
 	@echo '## Go get a cup of coffee it is gonna take a while ...'
-	$(MAKE) CHECKER='valgrind -q' check
+	$(MAKE) check CHECKER="$(LIBTOOL) --mode=execute $(VALGRIND)"
 
 dist-hook:
 	(cd $(srcdir) ; tar -cf - --exclude .git win32 test result) | (cd $(distdir); tar xf -)
diff --git a/third_party/libxml/src/README.md b/third_party/libxml/src/README.md
index d711137..2d959444 100644
--- a/third_party/libxml/src/README.md
+++ b/third_party/libxml/src/README.md
@@ -21,11 +21,29 @@
 
 ## Security
 
-This is open-source software written by hobbyists, maintained by a single
-volunteer, badly tested, written in a memory-unsafe language and full of
-security bugs. It is foolish to use this software to process untrusted data.
-As such, we treat security issues like any other bug. Each security report
-we receive will be made public immediately and won't be prioritized.
+This is open-source software written by hobbyists and maintained by
+volunteers.
+
+It's NOT recommended to use this software to process **untrusted data**.
+There is a lot of ways that a malicious crafted xml could exploit a
+hidden vulnerability in the software.
+
+The software is provided "as is", without warranty of any kind,
+express or implied. Use this software at your own risk.
+
+To **report security bugs**, you can create a confidential issue with
+the "security" label. We will review and work on it as a best effort.
+But remember that this is a community project, maintained by volunteer
+developers, so if you are concern about any important security bug
+that's critical for you, feel free to collaborate and provide a patch.
+
+The main rule is to be kind. Do not pressure developers to fix a CVE
+or to work on a functionality that you need, because that won't work.
+This is a community project, developers will work in the issues that
+they consider interesting and when they want. All contributions are
+welcome, so if something is important for you, you can always get
+involved, implement it yourself and be part of the open source
+community.
 
 ## Build instructions
 
@@ -75,6 +93,7 @@
     --with-threads          multithreading support (on)
     --with-thread-alloc     per-thread malloc hooks (off)
     --with-valid            DTD validation support (on)
+    --with-winpath          Windows path support (on for Windows)
     --with-writer           xmlWriter serialization interface (on)
     --with-xinclude         XInclude 1.0 support (on)
     --with-xpath            XPath 1.0 support (on)
@@ -171,6 +190,18 @@
 All code must conform to C89 and pass the GitLab CI tests. Add regression
 tests if possible.
 
+### Strict No LLM / No AI Policy
+
+No LLMs for issues.
+
+No LLMs for patches / pull requests.