IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
Now that replacement of parameter entities goes exclusively through
xmlSkipBlankChars, we can account for the surrounding space characters
there and remove the "blanks wrapper" hack.
Make sure to finish all entities in the internal subset. Nevertheless,
readd a sanity check in xmlParseStartTag2 that was lost in my previous
commit. Also add a sanity check in xmlPopInput. Popping an input
unexpectedly was the source of many recent memory bugs. The check
doesn't mitigate such issues but helps with diagnosis.
Always base entity boundary checks on the input ID, not the input
pointer. The pointer could have been reallocated to the old address.
Always throw a well-formedness error if a boundary check fails. In a
few places, a validity error was thrown.
Fix a few error codes and improve indentation.
xmlSnprintfElementContent failed to correctly check the available
buffer space in two locations.
Fixes bug 781333 (CVE-2017-9047) and bug 781701 (CVE-2017-9048).
Thanks to Marcel Böhme and Thuan Pham for the report.
There were two bugs where parameter-entity references could lead to an
unexpected change of the input buffer in xmlParseNameComplex and
xmlDictLookup being called with an invalid pointer.
Percent sign in DTD Names
=========================
The NEXTL macro used to call xmlParserHandlePEReference. When parsing
"complex" names inside the DTD, this could result in entity expansion
which created a new input buffer. The fix is to simply remove the call
to xmlParserHandlePEReference from the NEXTL macro. This is safe because
no users of the macro require expansion of parameter entities.
- xmlParseNameComplex
- xmlParseNCNameComplex
- xmlParseNmtoken
The percent sign is not allowed in names, which are grammatical tokens.
- xmlParseEntityValue
Parameter-entity references in entity values are expanded but this
happens in a separate step in this function.
- xmlParseSystemLiteral
Parameter-entity references are ignored in the system literal.
- xmlParseAttValueComplex
- xmlParseCharDataComplex
- xmlParseCommentComplex
- xmlParsePI
- xmlParseCDSect
Parameter-entity references are ignored outside the DTD.
- xmlLoadEntityContent
This function is only called from xmlStringLenDecodeEntities and
entities are replaced in a separate step immediately after the function
call.
This bug could also be triggered with an internal subset and double
entity expansion.
This fixes bug 766956 initially reported by Wei Lei and independently by
Chromium's ClusterFuzz, Hanno Böck, and Marco Grassi. Thanks to everyone
involved.
xmlParseNameComplex with XML_PARSE_OLD10
========================================
When parsing Names inside an expanded parameter entity with the
XML_PARSE_OLD10 option, xmlParseNameComplex would call xmlGROW via the
GROW macro if the input buffer was exhausted. At the end of the
parameter entity's replacement text, this function would then call
xmlPopInput which invalidated the input buffer.
There should be no need to invoke GROW in this situation because the
buffer is grown periodically every XML_PARSER_CHUNK_SIZE characters and,
at least for UTF-8, in xmlCurrentChar. This also matches the code path
executed when XML_PARSE_OLD10 is not set.
This fixes bugs 781205 (CVE-2017-9049) and 781361 (CVE-2017-9050).
Thanks to Marcel Böhme and Thuan Pham for the report.
Additional hardening
====================
A separate check was added in xmlParseNameComplex to validate the
buffer size.
For https://bugzilla.gnome.org/show_bug.cgi?id=759671
when the end of the internal subset isn't properly detected
xmlParseInternalSubset should just return instead of trying
to process input further.
For https://bugzilla.gnome.org/show_bug.cgi?id=737840
the fix for 724903 introduced a regression on external entities carrying
IDs, revert that patch in part and add a specific test to avoid readding it
Use the tree node to provide the error context instead
of the parser input which is not relevant anymore,
based on a suggestion by François Delyon <f.delyon@satimage.fr>
* valid.c: fix a bug when valdating mixed content lists and some
name use namespaces prefixes.
* result/valid/notes.xml* test/valid/dtds/notes.dtd * test/valid/notes.xml:
add the test case to the regression suite
* parser.c: fix a problem reported by Ashwin for system parameter
entities referenced from entities in external subset, add a
specific loading routine.
* test/valid/dtds/external.ent test/valid/dtds/external2.ent
test/valid/t11.xml result/valid/t11.xml*: added the test to
the regression suite
Daniel
svn path=/trunk/; revision=3713
* encoding.c: poblem with encoding detection for UTF-16 reported by
Ashwin and found by Bill
* test/valid/dtds/utf16b.ent test/valid/dtds/utf16l.ent
test/valid/UTF16Entity.xml result/valid/UTF16Entity.xml*: added
the example to the regression tests
Daniel
svn path=/trunk/; revision=3700
* parser.c: fixed bug #170489 reported by Jirka Kosek
* test/valid/objednavka.xml test/valid/dtds/objednavka.dtd
result/valid/objednavka*: added the test to the regression suite.
Daniel
* valid.c: implemented bugfix from Massimo Morara for DTD
dumping problem.
* test/valid/t10.xml, result/valid/t10.*: added regression
for above
* configure.in: small change for my profile settings
* entities.c: fixed#127877, never output " in element content
* result/isolat3 result/slashdot16.xml result/noent/isolat3
result/noent/slashdot16.xml result/valid/REC-xml-19980210.xml
result/valid/index.xml result/valid/xlink.xml: this changes the
output of a few tests
Daniel
* parser.c: swapped the attribute defaulting and attribute checking
parts of parsing a new element start, fixes bug #127772
* result/valid/127772.* test/valid/127772.xml
test/valid/dtds/127772.dtd: added the example in the regression tests
Daniel
* HTMLparser.c: fixed to not send NULL to %s printing
* python/tests/error.py result/HTML/doc3.htm.err
result/HTML/test3.html.err result/HTML/wired.html.err
result/valid/t8.xml.err result/valid/t8a.xml.err: cleaning
up some of the regression tests error
Daniel
* error.c include/libxml/xmlerror.h include/libxml/xpath.h
include/libxml/xpathInternals.h xpath.c: cleaning up XPath
error reporting that time.
* threads.c: applied the two patches for TLS threads
on Windows from Jesse Pelton
* parser.c: tiny safety patch for xmlStrPrintf() make sure the
return is always zero terminated. Should also help detecting
passing wrong buffer size easilly.
* result/VC/* result/valid/rss.xml.err result/valid/xlink.xml.err:
updated the results to follow the errors string generated by
last commit.
Daniel
* Makefile.am: more cleanup in make tests
* error.c valid.c parser.c include/libxml/xmlerror.h: more work
in the transition to the new error reporting strategy.
* python/tests/reader2.py result/VC/* result/valid/*:
few changes in the strings generated by the validation output
Daniel
* Makefile.am: changed 'make tests' to use a concise output,
scrolling to see where thing broke wasn't pleasant
* configure.in: some beta4 preparation, but not ready yet
* error.c globals.c include/libxml/globals.h include/libxml/xmlerror.h:
new error handling code, last error informations are stored
in the parsing context or a global variable, new APIs to
handle the xmlErrorPtr type.
* parser.c parserInternals.c valid.c : started migrating to the
new error handling code, it's a royal pain.
* include/libxml/parser.h include/libxml/parserInternals.h:
moved the definition of xmlNewParserCtxt()
* parser.c: small potential buffer access problem in push code
provided by Justin Fletcher
* result/*.sax result/VC/PENesting* result/namespaces/*
result/valid/*.err: some error messages were sligthly changed.
Daniel
* SAX2.c: fixing namespace DTD validations
* result/valid/ns2.xml result/valid/ns.xml: the output of defaulted
namespaces is slightly different now.
* Makefile.am: report the memory used in Timingtests (as well as time)
Daniel
* parser.c include/libxml/xmlerror.h: factoring of more
error handling code, serious size reduction and more lisibility
of the resulting code.
* parserInternals.c parser.c include/libxml/parserInternals.h
include/libxml/parser.h: changing the way VC:Proper Group/PE Nesting
checks are done, use a counter for entities. Entities where freed and
reallocated at the same address failing the check.
* tree.c: avoid a warning
* result/valid/* result/VC/*: this slightly changes some validation
error messages.
Daniel
* valid.c: fixed bug #118712 about mixed content, and namespaced
element names.
* test/valid/mixed_ns.xml result/valid/mixed_ns*: added a check
in the regression tests
Daniel
* SAX.c test/valid/ns* test/result/ns*: applied the patch
provided by Brent Hendricks fixing #105992 and integrated the
examples in the testsuite.
Daniel
* parser.c: fixing bug #108976 get the ID/REFs to reference
the ID in the document content and not in the entity copy
* SAX.c include/libxml/parser.h: more checking of the ID/REF
stuff, better solution for #107208
* xmlregexp.c: removed a direct printf, dohhh
* xmlreader.c: fixed a bug on streaming validation of empty
elements in entities
* result/VC/ElementValid8 test/VCM/v20.xml result/valid/xhtml1.xhtml:
cleanup of the validation tests
* test/valid/id* test/valid/dtds/destfoo.ent result/valid/id*:
added more ID/IDREF tests to the suite
Daniel
* tree.c include/libxml/tree.h: modified the existing APIs
to handle XHTML1 serialization rules automatically, also add
xmlIsXHTML() to libxml2 API. Some tweaking to make sure
libxslt serialization uses it when needed without changing
the library API.
* test/xhtml1 result/noent/xhtml1 result/valid/xhtml1.xhtml
result/xhtml1: added a new test specifically for xhtml1 output
and updated the result of one XHTML1 test
Daniel
* SAX.c valid.c include/libxml/valid.h: fixed bug #92518 validation
error were not covering namespace declarations.
* result/valid/dia.xml test/valid/dia.xml: the test wasn't valid,
it was missing the attribute declaration for the namespace
* result/VC/NS3: the fix now report breakages in that test
Daniel
* error.c valid.c: working on better error reporting of validity
errors, especially providing an accurate context.
* result/valid/xlink.xml.err result/valid/rss.xml.err: better
error reports in those cases.
Daniel
* parser.c include/libxml/parser.h: adding a new API for Christian
Glahn: xmlParseBalancedChunkMemoryRecover
* valid.c: patch from Rick Jones for some grammar cleanup in
validation messages
* result/VC/* result/valid/*: this slightly change some of the
regression tests outputs
Daniel
* parser.c: applied a couple of patches from Peter Jacobi to start
to get rid of ctxt->token, with a possible significant speed
improvement to be gained once done. Better compliance with PE
references constructs in DTDs too.
* test/valid/t[0-9]* result/valid/t[0-9]*: added a set of tests
from Peter too
Daniel
* valid.c SAX.c: Never commit without running "make tests" :-(
fix a couple of stupidities in the previous commit
* result/*: a few changes in some attribute order result of previous
commit.
Daniel
* valid.c include/libxml/tree.h: trying to fix namespaces +
validation problems for good, closing #63619 in the process
* result/valid/dia.xml test/valid/dia.xml: the Dia test was
wrong in this respect, fixed it.
Daniel
* parser.c: fixed an erroneous validation bug when PE refs
occurs in external parsed entities referenced from the
internals subset
* test/valid/index.xml test/valid/dtds/nitf-2-5.dtd
test/valid/dtds/NewsMLv1.0.dtd result/valid/index.xml*:
added the associated testcase, it's a nice one.
* HTMLparser.c: generate the DTD node as HTML still ...
* HTMLtree.c: fixed errors in Set/GetMetaEncoding
Daniel
- encoding.[ch] HTMLtree.[ch] parser.c HTMLparser.c: I18N encoding
improvements, both parser and filters, added ASCII & HTML,
fixed the ISO-Latin-1 one
- xmllint.c testHTML.c: added/made visible --encode
- debugXML.c : cleanup
- most .c files: applied patches due to warning on Windows and
when using Sun Pro cc compiler
- xpath.c : cleanup memleaks
- nanoftp.c : added a TESTING preprocessor flag for standalong
compile so that people can report bugs more easilly
- nanohttp.c : ditched socklen_t which was a portability mess
and replaced it with unsigned int.
- tree.[ch]: added xmlHasProp()
- TODO: updated
- test/ : added more test for entities, NS, encoding, HTML, wap
- configure.in: preparing for 2.2.0 release
Daniel
- changed the way Windows socket stuff get included
- removed an indetermination xmLDecl/PI(xml...)
- xmlNewNs wasn't checking for double definition
- fixed a problem with dist-hook duplicates
- fixed the loading of external entities APIs, now xmlLoadExternalEntity()
is used everywhere
- now the xhtml spec validates with the xhtml DTD.
- error.c: fixed crashes in case of no input stream
- added the xhtml spec and dtds to the validation tests and results
Daniel
Added xmlValidGetValidElements and xmlValidGetPotentialChildren,
Completed and cleaned up the tests,
Added doc for new modules gnome-xml-xmlmemory.html and gnome-xml-nanohttp.html,
Daniel
