1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-10-27 04:55:04 +03:00
Commit Graph

4851 Commits

Author SHA1 Message Date
Mohammed Sadiq
c7461f6547 reader: Fix documentation comment 2018-11-29 21:57:45 +01:00
Nikolai Weibull
c64d4efb31 Remove redefined starts and defines inside include elements
When including a grammar from another grammar, we need to make sure that any
redefines of starts and includes that that grammar does inside any of its
include elements are also removed.
2018-11-29 21:06:06 +01:00
Nikolai Weibull
46da8fc529 Allow choice within choice in nameClass in RELAX NG
The pattern nameClass allows for nested choice elements, for example

  <name>
    <choice>
      <choice>
        <name>a</name>
        <name>b</name>
      </choice>
      <name>c</name>
    </choice>
  </name>

which is semantically equivalent to

  <name>
    <choice>
      <name>a</name>
      <name>b</name>
      <name>c</name>
    </choice>
  </name>

The old code didn’t handle this correctly, as it never expected a choice inside
another choice.  This patch fixes this by flattening any nested choices.

This pattern of nested choice elements comes up in RELAX NG simplification,
where all choice elements are rewritten in this nested manner, see section 4.12
of the RELAX NG specification.
2018-11-29 21:03:11 +01:00
Nikolai Weibull
4338c310eb Look inside divs for starts and defines inside include
RELAX NG allows for div elements inside of include elements.  We need to look
inside those div elements for start and define elements that may be redefining
start and define elements in the included grammar.
2018-11-29 21:00:46 +01:00
Nikolai Weibull
3c614191aa Add compile and libxml2-config.cmake to .gitignore 2018-11-29 20:59:55 +01:00
Nikolai Weibull
c8e5f9588b Problem with data in interleave in RelaxNG validation
Reported in https://mail.gnome.org/archives/xml/2018-October/msg00003.html

The issue seems to be that we build groups of what can be matched by
the interleave, but that these groups don’t include data, list,
and value elements, only element and text elements.  This patch
extends xmlRelaxNGGetElements so that it can return these elements
for us in xmlRelaxNGComputeInterleaves.  Then we make sure to
updatexmlRelaxNGNodeMatchesList as well so that it accepts the correct
types.
2018-11-22 18:14:47 +01:00
Nick Wellnhofer
3776cb4745 Fix memory leak in xmlSwitchInputEncodingInt error path
Found by OSS-Fuzz.
2018-11-22 16:28:46 +01:00
Nick Wellnhofer
1567b55b72 Set doc on element obtained from freeElems
In commit 8c9daf79, a call to xmlFreeNode was added in
xmlSAX2StartElementNs. If a node was obtained from the freeElems list,
make sure to set the doc, otherwise xmlFreeNode wouldn't realize that
the node name might be in the dictionary, causing an invalid free.

Note that the issue fixed in commit 8c9daf79 requires commit 0ed6addb
and this one to work properly.

Found by OSS-Fuzz.
2018-11-22 16:28:46 +01:00
Nick Wellnhofer
fc27759d2a Fix MSVC build with lzma 2018-11-06 10:17:35 +01:00
Nick Wellnhofer
d459831c1b Fix HTML serialization with UTF-8 encoding
If the encoding is specified as UTF-8, make sure to use a NULL encoding
handler.
2018-10-13 16:47:13 +02:00
Nick Wellnhofer
ee501f5449 Stop using doc->charset outside parser code
doc->charset does not specify the in-memory encoding which is always
UTF-8.
2018-10-13 16:47:01 +02:00
Nick Wellnhofer
39fbfb4fd0 Use actual doc in xmlTextReaderRead*Xml
Otherwise the encoding of the document is ignored and non-ASCII
characters are serialized as numeric references even if the encoding
is specified as UTF-8.
2018-09-25 13:55:46 +02:00
Nick Wellnhofer
da35eeae5b Add newlines to 'xmllint --xpath' output
Separate nodes in a node-set with newlines and always add a terminating
newline. This is a breaking change but the old behavior of dumping text
nodes without separator was mostly useless.

Also use buffered I/O when dumping node-sets.
2018-09-23 01:34:26 +02:00
Michael Haubenwallner
73b2417c51 Variables need 'extern' in static lib on Cygwin
While the dllimport/dllexport macros now work for Cygwin, using the
static library still requires variables to be declared as 'extern'.
This is a regression of c65c9e8ee0,
found+fixed by Bruno Haible using static libxml embedded in gettext.
2018-09-22 15:45:02 +02:00
Nick Wellnhofer
0ed6addb8f Unlink node before freeing it in xmlSAX2StartElement
The node may have been added to the document already, so it must be
unlinked first. Thanks to David Kilzer for spotting this.
2018-09-22 15:41:01 +02:00
Nick Wellnhofer
8c9daf790a Check return value of nodePush in xmlSAX2StartElement
If the maximum depth is exceeded, nodePush halts the parser which
results in freeing the input buffer since the previous commit. This
invalidates the attribute pointers, so the error condition must be
checked.

Found by OSS-Fuzz.
2018-09-12 13:52:47 +02:00
Nick Wellnhofer
123234f2cf Free input buffer in xmlHaltParser
This avoids miscalculation of available bytes.

Thanks to Yunho Kim for the report.

Closes: #26
2018-09-11 15:06:17 +02:00
Nick Wellnhofer
60173c821e Reset HTML parser input pointers on encoding failure
Call xmlBufResetInput before bailing out if switching the encoding
fails. Otherwise, the input pointers could be left in an invalid state.

Similar to commit f9e7997e80 for the
XML parser.

Thanks to Yunho Kim for the report.

Closes: #27
2018-09-11 14:08:39 +02:00
Nick Wellnhofer
dc6d2a4987 Don't run icu_parse_test if EUC-JP is unsupported
Closes: #25
2018-09-04 17:13:29 +02:00
Greg Hildstrom
b697d7bb59 Fix xmlSchemaValidCtxtPtr reuse memory leak
When reusing an xmlSchemaValidCtxtPtr to validate multiple xml documents
against the same schema, there is a memory leak in xmlschemas.c in
xmlSchemaClearValidCtxt(). The vctxt->idcKeys and associated counters
are not cleaned up in xmlSchemaClearValidCtxt() as they are in
xmlSchemaFreeValidCtxt(). As a result, vctxt->idcKeys grows with each
xmlValidateDoc() call that uses the same context and that memory is
never freed. Similarly, vctxt->nbIdcKeys and vctxt->sizeIdcKeys
increment and are never reset.

Closes: #23
2018-09-04 16:48:15 +02:00
Nick Wellnhofer
1dafb427d9 Don't include SAX.h from globals.h
SAX.h contains a legacy interface with several unprefixed symbols
like `reference`, causing severe namespace pollution. The globals.h
header doesn't need any of these symbols, so remove the #include.
2018-09-03 15:33:19 +02:00
Felix Bünemann
bfec41b3de Support xmlTextReaderNextSibling w/o preparsed doc
This implements missing support for readers that are not based on a
preparsed document in xmlTextReaderNextSibling.
2018-09-01 14:32:25 +02:00
Felix Bünemann
d2ef114c6b Fix xmlTextReaderNext with preparsed document
This fixes the traversal of parent nodes using xmlTextReaderNext()
when the reader is based on a preparsed document (created using
xmlReaderWalker(doc)).

Without this fix the parser will abort even though there are parent
nodes it should traverse to, if it is not currently on an element or
attribute node. This is incorrect, since it can be for example on a
text node when it needs to enter backtracking.
2018-09-01 14:31:34 +02:00
Michael Haubenwallner
c65c9e8ee0 Really declare dllexport/dllimport for Cygwin
Cygwin does not define _WIN32, but still requires dllexport/dllimport
tags for when applications use the --disable-auto-import linker flag,
probably set by the gl_WOE32_DLL autoconf macro in woe32-dll.m4 file.
2018-08-31 11:42:14 +02:00
Nick Wellnhofer
33d7ca53af Merge branch 'patch-2' into 'master'
Change dir to $THEDIR after ACLOCAL_PATH check

See merge request GNOME/libxml2!6
2018-08-24 10:10:02 +00:00
Vitaly Buka
19f5efd677 Change dir to $THEDIR after ACLOCAL_PATH check
autoreconf creates aclocal.m4 in $srcdir
2018-08-23 20:42:23 +00:00
Nick Wellnhofer
b6ab8b449c Improve error message if pkg.m4 couldn't be found
Check whether aclocal.m4 contains the pkg.m4 macro package after running
autoreconf and print a more helpful error message.

Thanks to 林博仁 (Buo-ren Lin) for the initial patch.

Closes: #21
2018-08-19 19:31:19 +02:00
林博仁(Buo-ren Lin)
173ea684dd Don't instruct user to run make when autogen.sh failed
Currently the autogen script will always tell user to run make even
when the configure script failed, this patch changes the behavior to
only show this message when the configure script terminates without
error.
2018-08-19 19:02:12 +02:00
Nick Wellnhofer
2240fbf591 Fix infinite loop in LZMA decompression
Check the liblzma error code more thoroughly to avoid infinite loops.

Closes: https://gitlab.gnome.org/GNOME/libxml2/issues/13
Closes: https://bugzilla.gnome.org/show_bug.cgi?id=794914

This is CVE-2018-9251 and CVE-2018-14567.

Thanks to Dongliang Mu and Simon Wörner for the reports.
2018-07-30 14:35:17 +02:00
Nick Wellnhofer
a436374994 Fix nullptr deref with XPath logic ops
If the XPath stack is corrupted, for example by a misbehaving extension
function, the "and" and "or" XPath operators could dereference NULL
pointers. Check that the XPath stack isn't empty and optimize the
logic operators slightly.

Closes: https://gitlab.gnome.org/GNOME/libxml2/issues/5

Also see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817
https://bugzilla.redhat.com/show_bug.cgi?id=1595985

This is CVE-2018-14404.

Thanks to Guy Inbar for the report.
2018-07-30 12:54:38 +02:00
Nick Wellnhofer
b7c50b8dde Remove stray character from comment
Fixes bug #795316:

https://bugzilla.gnome.org/show_bug.cgi?id=795316
2018-07-30 12:40:59 +02:00
Andrey Bienkowski
d2293cdbc8 Remove a misleading line from xmlCharEncOutput
Closes: https://bugzilla.gnome.org/show_bug.cgi?id=793028

It seams this line was accidentally copied over from xmlCharEncOutFunc.
In xmlCharEncOutput output is a pointer so incrementing it by ret can
point it where it wasn't supposed to be pointing. Luckily the current
implementation doesn't dereference the pointer after advancing it.

Signed-off-by: Daniel Veillard <veillard@redhat.com>
2018-07-23 10:21:38 +08:00
Daniel Veillard
35e8348850 HTML noscript should not close p
For https://bugzilla.gnome.org/show_bug.cgi?id=795343

- HTMLparser.c: noscript should not close <p> but it should close <script>
2018-04-18 16:04:27 +02:00
Nick Wellnhofer
e61c82175e Run Travis ASan tests with "sudo: required"
See https://github.com/travis-ci/travis-ci/issues/9033
2018-04-16 20:46:13 +02:00
Nick Wellnhofer
fa33bf317a Improve restoring of context size and position
Restore context size and position where it is modified, not in
seemingly random places.
2018-04-16 20:23:48 +02:00
Nick Wellnhofer
665df41dcc Simplify and harden nodeset filtering
If a nodeset to be filtered is empty, it can be returned without popping
it from the stack.

Make sure to restore the context node in all error paths and never set
it to NULL.

Save and restore the context node in RANGETO operations.
2018-04-16 19:45:37 +02:00
Nick Wellnhofer
029d0e960c Avoid unnecessary backups of the context node 2018-04-16 18:28:42 +02:00
Nick Wellnhofer
938835e763 Don't change context node in xmlXPathRoot 2018-04-16 18:28:42 +02:00
Nick Wellnhofer
e22a83b1d0 Stop using XPATH_OP_RESET
It only sets the context node to NULL which doesn't seem useful and can
even cause bugs like bug #795299:

https://bugzilla.gnome.org/show_bug.cgi?id=795299
2018-04-16 18:20:43 +02:00
Nick Wellnhofer
ebe12882ee Fix inconsistency in xmlXPathIsInf
We don't use HUGE_VAL for INFINITY after the most recent fix.
2018-04-16 18:18:11 +02:00
Nick Wellnhofer
7a1bd7f649 Revert "Change calls to xmlCharEncInput to set flush false"
This reverts commit 6e6ae5daa6 which
broke decoding of larger documents with ICU.

See https://bugs.chromium.org/p/chromium/issues/detail?id=820163
2018-03-17 00:03:24 +01:00
Nick Wellnhofer
7abec67147 NaN and Inf fixes for pre-C99 compilers
On some pre-C99 compilers, the NAN and INFINITY macros don't expand to
constant expressions.

Some MSVC versions complain about floating point division by zero in
constants.

Thanks to Fabrice Manfroi for the report.
2018-03-16 15:09:42 +01:00
Daniel Veillard
18890f471c Release of libxml2-2.9.8
* configure.ac doc/* libxml2.syms testapi.c: updated for the new release
2018-03-05 17:09:43 +01:00
Patrick Welche
d910e99c32 python: remove single use of _PyVerify_fd
_PyVerify_fd disappeared from python with:

  https://hg.python.org/cpython/rev/e88e2049b793

https://bugzilla.gnome.org/show_bug.cgi?id=776815
2018-03-05 16:29:58 +01:00
Nick Wellnhofer
707ad080e6 Fix xmlParserEntityCheck
A previous commit removed the check for XML_ERR_ENTITY_LOOP which is
required to abort early in case of excessive entity recursion.
2018-01-23 16:37:54 +01:00
Nick Wellnhofer
ab362ab0ad Halt parser in case of encoding error
Should fix crbug.com/793715, although I wasn't able to reproduce the
issue.
2018-01-22 15:42:26 +01:00
Nick Wellnhofer
60dded12cb Clear entity content in case of errors
This only affects recovery mode and avoids integer overflow in
xmlStringGetNodeList and possibly other nasty surprises.

See bug 783052 and

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3874
https://bugs.chromium.org/p/chromium/issues/detail?id=796804
2018-01-22 15:23:22 +01:00
Joel Hockey
6e6ae5daa6 Change calls to xmlCharEncInput to set flush false when not final call. Having flush incorrectly set to true causes errors for ICU. 2018-01-08 19:57:53 +01:00
Nick Wellnhofer
1637d612d1 Disable pointer-overflow UBSan checks under Travis
clang 5 added UBSan checks for pointer overflow which are triggered by
an API test.
2018-01-08 19:19:42 +01:00
Nick Wellnhofer
132af1a0d1 Fix buffer over-read in xmlParseNCNameComplex
Calling GROW can halt the parser if the buffer grows too large. This
will set the buffer to an empty string. Return immediately in this case,
otherwise the "current" pointer is advanced leading to a buffer over-read.

Found with OSS-Fuzz. See

https://oss-fuzz.com/testcase?key=6683819592646656
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5031
2018-01-08 18:48:01 +01:00