shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-01-29 21:46:59 +03:00
Code
4,614 Commits 8 Branches 224 Tags
Commit Graph

12 Commits

Author SHA1 Message Date
Nick Wellnhofer
07e227ed00 Fix memory leak in LZMA decompressor 2017-09-07 19:08:43 +02:00
Nick Wellnhofer
e2a9122b8d Set memory limit for LZMA decompression 
Otherwise malicious LZMA compressed files could consume large amounts
of memory when decompressed.

According to the xz man page, files compressed with `xz -9` currently
require 65 MB to decompress, so set the limit to 100 MB.

Should fix bug 786696.
 2017-09-07 19:08:43 +02:00
Daniel Veillard
18b8988511 Reenable xz support by default 
For https://bugzilla.gnome.org/show_bug.cgi?id=757466

problem was introduced by commit f3f86ff465c92c79f834d7b981f3c7274a8bb5c8
for https://bugzilla.gnome.org/show_bug.cgi?id=711026
 2015-11-03 15:46:29 +08:00
Daniel Veillard
f0709e3ca8 CVE-2015-8035 Fix XZ compression support loop 
For https://bugzilla.gnome.org/show_bug.cgi?id=757466
DoS when parsing specially crafted XML document if XZ support
is compiled in (which wasn't the case for 2.9.2 and master since
Nov 2013, fixed in next commit !)
 2015-11-03 15:31:25 +08:00
Mike Alexander
a1313a6f8c Fix a bug loading some compressed files 
For https://bugzilla.gnome.org/show_bug.cgi?id=712528
Related to https://bugzilla.redhat.com/show_bug.cgi?id=877567

There is a bug in xzlib.c which causes certain compressed XML files to fail to
load correctly.  The code in xz_decomp which attempts to verify the checksum
and length of the expanded data fails if the checksum or length at the end of
the file crosses a 1024 byte boundary.  It calls gz_next4 to get those two
values.  This function uses the stream state in state->zstrm, but calls
xz_avail which uses the state->strm stream info.  This causes gz_next4 to
signal a premature EOF if the data it is fetching crosses a 1024 byte boundary.
 2013-11-28 23:21:23 +08:00
Daniel Veillard
63588f476f Fix a regression in xmlGetDocCompressMode() 
The switch to xzlib had for consequence that the compression
level of the input was not gathered anymore in ctxt->input->buf,
then the parser compression flags was left to -1 and propagated
to the resulting document.
Fix the I/O layer to get compression detection in xzlib,
then carry it in the input buffer and the resulting document

  This should fix
    https://lsbbugs.linuxfoundation.org/show_bug.cgi?id=3456
 2013-05-10 14:01:46 +08:00
Daniel Veillard
94431ecba6 Fix various bugs in new code raised by the API checking 
* testapi.c: regenerated and covering new APIs
* tree.c: xmlBufferDetach can't work on immutable buffers
* xzlib.c: fix a deallocation error
 2012-05-15 10:45:05 +08:00
Daniel Veillard
9f3cdef08a Fix a memory leak in the xzlib code 
The freeing function wasn't called due to a bogus #ifdef surrounding
value. Also switch the code to use the normal libxml2 allocation and
freeing routines.
 2012-05-15 09:38:13 +08:00
Marcus Meissner
996449273f fixed a 64bit big endian issue 
For https://bugzilla.gnome.org/show_bug.cgi?id=671176
patch fixes a 64bit endian issue, making libxml2 work (again) on ppc64
unsigned int and size_t are differently sized on 64bit.
 2012-05-07 18:41:42 +08:00
Daniel Veillard
72789ef21f Do not use unsigned but unsigned int 
as this breaks the API generator
 2012-04-02 17:52:20 +08:00
Daniel Veillard
adf5ec9496 Cleanups of lzma support 
- fix inclusion of the separated file
- use namespaced name for the 4 non-static routines
- add padding after external structures included in-situ
- add new requirement to spec file
- general cleanup of code
 2012-01-27 22:19:53 +08:00
Anders F Bjorklund
6bdc774350 move xz/lzma helpers to separate included files 2012-01-27 22:19:52 +08:00