shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-04-01 10:50:08 +03:00
Code

fuzz: Don't unlink DTD when replacing nodes

Browse Source 
OP_XML_REPLACE_NODE needs the same check as OP_XML_UNLINK_NODE.
This commit is contained in:
Nick Wellnhofer 2024-10-10 12:14:47 +02:00
parent a4c16a140c
commit bf3619c328
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fuzz/api.c
View File

@ -2287,7 +2287,7 @@ LLVMFuzzerTestOneInput(const char *data, size_t size) {
case OP_XML_REPLACE_NODE: {
xmlNodePtr old, oldParent, node, oldNodeParent, result;
xmlDocPtr oldNodeDoc;
xmlDocPtr oldDoc, oldNodeDoc;
startOp("xmlReplaceNode");
old = getNode(0);
@ -2296,8 +2296,18 @@ LLVMFuzzerTestOneInput(const char *data, size_t size) {
/*
* Unlinking DTD children can cause invalid references
* which would be expensive to fix.
*
* Don't unlink DTD if it is the internal or external
* subset of the document.
*/
if (isDtdChild(old))
old = old ? old->parent : NULL;
oldDoc = old ? old->doc : NULL;
if (old != NULL &&
(isDtdChild(old) ||
(old->type == XML_DTD_NODE &&
oldDoc != NULL &&
((xmlDtdPtr) old == oldDoc->intSubset ||
(xmlDtdPtr) old == oldDoc->extSubset))))
old = NULL;
if (old != NULL && !isValidChild(old->parent, node))
node = NULL;