From a59bd55ca7ab5c173531aa554ddff3f79ce9ff19 Mon Sep 17 00:00:00 2001
From: Mamoru TASAKA <mtasaka@fedoraproject.org>
Date: Mon, 30 Dec 2024 17:48:04 +0900
Subject: [PATCH] Backport PR3395 for SAX::ParserContex to prevent possible
 use-after-free

---
 ...95-sax-parsecontext-keep-referenence.patch | 73 +++++++++++++++++++
 rubygem-nokogiri.spec                         |  8 +-
 2 files changed, 80 insertions(+), 1 deletion(-)
 create mode 100644 rubygem-nokogiri-1.16.8-pr3395-sax-parsecontext-keep-referenence.patch

diff --git a/rubygem-nokogiri-1.16.8-pr3395-sax-parsecontext-keep-referenence.patch b/rubygem-nokogiri-1.16.8-pr3395-sax-parsecontext-keep-referenence.patch
new file mode 100644
index 0000000..7371b3a
--- /dev/null
+++ b/rubygem-nokogiri-1.16.8-pr3395-sax-parsecontext-keep-referenence.patch
@@ -0,0 +1,73 @@
+From f2a9275e442178084db43505d6425354e016d259 Mon Sep 17 00:00:00 2001
+From: Mike Dalessio <mike.dalessio@gmail.com>
+Date: Sat, 28 Dec 2024 22:21:04 -0500
+Subject: [PATCH] fix: SAX::ParserContext keeps a reference to the input
+
+to prevent it from being GCed before we parse it.
+---
+ ext/nokogiri/xml_sax_parser_context.c | 10 ++++++++--
+ test/test_memory_usage.rb             | 24 ++++++++++++++++++++++++
+ 2 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/ext/nokogiri/xml_sax_parser_context.c b/ext/nokogiri/xml_sax_parser_context.c
+index 75fe2e4f017..0d2b65b599f 100644
+--- a/ext/nokogiri/xml_sax_parser_context.c
++++ b/ext/nokogiri/xml_sax_parser_context.c
+@@ -68,7 +68,10 @@ parse_io(VALUE klass, VALUE io, VALUE encoding)
+     ctxt->sax = NULL;
+   }
+ 
+-  return noko_xml_sax_parser_context_wrap(klass, ctxt);
++  VALUE rb_context = noko_xml_sax_parser_context_wrap(klass, ctxt);
++  rb_iv_set(rb_context, "@input", io);
++
++  return rb_context;
+ }
+ 
+ /*
+@@ -114,7 +117,10 @@ parse_memory(VALUE klass, VALUE data)
+     ctxt->sax = NULL;
+   }
+ 
+-  return noko_xml_sax_parser_context_wrap(klass, ctxt);
++  VALUE rb_context = noko_xml_sax_parser_context_wrap(klass, ctxt);
++  rb_iv_set(rb_context, "@input", data);
++
++  return rb_context;
+ }
+ 
+ static VALUE
+diff --git a/test/test_memory_usage.rb b/test/test_memory_usage.rb
+index a23bb675e07..1b2044b448f 100644
+--- a/test/test_memory_usage.rb
++++ b/test/test_memory_usage.rb
+@@ -311,5 +311,29 @@ class TestMemoryUsage < Nokogiri::TestCase
+         # Expected error. This comment makes rubocop happy.
+       end
+     end
++
++    it "XML::SAX::ParserContext.io holds a reference to IO input" do
++      content = File.read(XML_ATOM_FILE)
++
++      memwatch(__method__) do
++        pc = Nokogiri::XML::SAX::ParserContext.io(StringIO.new(content), "ISO-8859-1")
++        parser = Nokogiri::XML::SAX::Parser.new(Nokogiri::SAX::TestCase::Doc.new)
++        GC.stress
++        pc.parse_with(parser)
++
++        assert_equal(472, parser.document.data.length)
++      end
++    end
++
++    it "XML::SAX::ParserContext.memory holds a reference to string input" do
++      memwatch(__method__) do
++        pc = Nokogiri::XML::SAX::ParserContext.memory(File.read(XML_ATOM_FILE), "ISO-8859-1")
++        parser = Nokogiri::XML::SAX::Parser.new(Nokogiri::SAX::TestCase::Doc.new)
++        GC.stress
++        pc.parse_with(parser)
++
++        assert_equal(472, parser.document.data.length)
++      end
++    end
+   end if ENV["NOKOGIRI_MEMORY_SUITE"] && Nokogiri.uses_libxml?
+ end
diff --git a/rubygem-nokogiri.spec b/rubygem-nokogiri.spec
index 8bbb785..0eccb0d 100644
--- a/rubygem-nokogiri.spec
+++ b/rubygem-nokogiri.spec
@@ -1,7 +1,7 @@
 %global	mainver		1.16.8
 #%%global	prever		.rc4
 
-%global	baserelease		1
+%global	baserelease		2
 %global	prerpmver		%(echo "%{?prever}" | sed -e 's|\\.||g')
 
 %global	gem_name	nokogiri
@@ -32,6 +32,8 @@ Patch0:	%{name}-1.11.0.rc4-shutdown-libxml2-warning.patch
 # https://github.com/sparklemotion/nokogiri/pull/3177
 # Make rubygem-minizip dependency optional
 Patch1:	%{name}-pr3177-rubyzip-dep-optional.patch
+# Backport: https://github.com/sparklemotion/nokogiri/pull/3395
+Patch2:	%{name}-1.16.8-pr3395-sax-parsecontext-keep-referenence.patch
 BuildRequires:	ruby(release)
 BuildRequires:	ruby(rubygems)
 ##
@@ -89,6 +91,7 @@ mv ../%{gem_name}-%{version}.gemspec .
 # patches
 %patch -P0 -p1
 %patch -P1 -p1
+%patch -P2 -p1
 
 # remove bundled external libraries
 sed -i \
@@ -280,6 +283,9 @@ popd
 %doc	%{gem_dir}/doc/%{gem_name}-%{mainver}%{?prever}/
 
 %changelog
+* Mon Dec 30 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.16.8-2
+- Backport PR3395 for SAX::ParserContex to prevent possible use-after-free
+
 * Thu Dec 05 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.16.8-1
 - 1.16.8