1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-01-27 14:03:36 +03:00

Fix xmlSetTreeDoc with entity references

The children member of entity reference nodes points to the entity
declaration and must never be followed when traversing a tree. In
the worst case, this could lead to an infinite loop.

It's somewhat unclear how moving entity references to other documents
should work exactly. For now we simply set the children pointer to NULL
to avoid a reference to the original document.

Fixes #42.
This commit is contained in:
Nick Wellnhofer 2022-02-07 22:09:25 +01:00
parent 8be44aeb16
commit 57b3abd592

9
tree.c
View File

@ -2856,8 +2856,15 @@ xmlSetTreeDoc(xmlNodePtr tree, xmlDocPtr doc) {
prop = prop->next;
}
}
if (tree->children != NULL)
if (tree->type == XML_ENTITY_REF_NODE) {
/*
* Clear 'children' which points to the entity declaration
* from the original document.
*/
tree->children = NULL;
} else if (tree->children != NULL) {
xmlSetListDoc(tree->children, doc);
}
tree->doc = doc;
}
}