Version in base suite: 1.4.29-3 Base version: xapian-core_1.4.29-3 Target version: xapian-core_1.4.29-3+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/x/xapian-core/xapian-core_1.4.29-3.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/x/xapian-core/xapian-core_1.4.29-3+deb13u1.dsc changelog | 8 + patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch | 54 ++++++++++ patches/series | 1 3 files changed, 63 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp4txpq2av/xapian-core_1.4.29-3.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp4txpq2av/xapian-core_1.4.29-3+deb13u1.dsc: no acceptable signature found diff -Nru xapian-core-1.4.29/debian/changelog xapian-core-1.4.29/debian/changelog --- xapian-core-1.4.29/debian/changelog 2025-05-01 23:29:34.000000000 +0000 +++ xapian-core-1.4.29/debian/changelog 2026-08-15 21:59:21.000000000 +0000 @@ -1,3 +1,11 @@ +xapian-core (1.4.29-3+deb13u1) trixie; urgency=medium + + * Cherry-pick fix for missed corner case of CVE-2018-0499. New patch: + cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch + (Closes: #1144490) + + -- Olly Betts Sun, 16 Aug 2026 09:59:21 +1200 + xapian-core (1.4.29-3) unstable; urgency=medium * debian/rules: Drop dependency on debian/control from diff -Nru xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch --- xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch 1970-01-01 00:00:00.000000000 +0000 +++ xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch 2026-08-14 23:41:17.000000000 +0000 @@ -0,0 +1,54 @@ +Description: Fix missing escaping in MSet::snippet() + Fix missing escaping when hi_start and hi_end are empty and the + input string is already within the requested length. +Origin: upstream, commit:b39620db6fa87c7aea83abef1a94dff96444ba29 +Last-Update: 2026-08-14 +Applied-Upstream: 1.4.32 + +--- a/queryparser/termgenerator_internal.cc ++++ b/queryparser/termgenerator_internal.cc +@@ -760,8 +760,11 @@ + const string & omit) const + { + if (hi_start.empty() && hi_end.empty() && text.size() <= length) { +- // Too easy! +- return text; ++ // The text is already short enough so we just need to perform ++ // escaping. ++ string output; ++ append_escaping_xml(text.data(), text.data() + text.size(), output); ++ return output; + } + + bool try_word_break = (flags & MSet::SNIPPET_CJK_NGRAM); +--- a/tests/api_snippets.cc ++++ b/tests/api_snippets.cc +@@ -350,6 +350,13 @@ + TEST_STRINGS_EQUAL(mset.snippet(input, 12, stem), + "...<foo.h> to..."); + ++ // Check escaping still happens without highlighting when the text is ++ // already short enough. Regression test for bug fixed in 1.4.32 and ++ // 2.0.1. ++ input = " &"; ++ TEST_STRINGS_EQUAL(mset.snippet(input, 12, stem, 0, "", ""), ++ "<foo> &amp;"); ++ + input = "¡foo!"; + TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem), + "¡foo!"); +@@ -456,6 +463,14 @@ + input = "foo for 10¢"; + TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem), + "foo for 10¢"); ++ ++ // Check escaping still happens without highlighting when the text is ++ // already short enough. Regression test for bug fixed in 1.4.32 and ++ // 2.0.1. ++ input = "&foo takes the address of foo"; ++ TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem, 0, "", ""), ++ "&foo takes the address of foo"); ++ + } + + /// Test snippets with small and zero length. diff -Nru xapian-core-1.4.29/debian/patches/series xapian-core-1.4.29/debian/patches/series --- xapian-core-1.4.29/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ xapian-core-1.4.29/debian/patches/series 2026-08-14 23:26:55.000000000 +0000 @@ -0,0 +1 @@ +cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch