1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-04-06 02:50:06 +03:00

6202 Commits

Author SHA1 Message Date
Nick Wellnhofer
00301f0fe8 Release v2.12.9 v2.12.9 2024-07-24 15:51:56 +02:00
Nick Wellnhofer
4c2b237174 [CVE-2024-40896] Fix XXE protection in downstream code
Some users set an entity's children manually in the getEntity SAX
callback to restrict entity expansion. This stopped working after
renaming the "checked" member of xmlEntity, making at least one
downstream project and its dependants susceptible to XXE attacks.

See #761.
2024-07-24 15:50:30 +02:00
Nick Wellnhofer
bf3e56f3bf Undeprecate xmlKeepBlanksDefault 2024-07-06 20:24:19 +02:00
Nick Wellnhofer
83fce0a3f9 Release v2.12.8 v2.12.8 2024-06-12 12:57:59 +02:00
Nick Wellnhofer
b71f09c134 parser: Fix performance regression when parsing namespaces
The namespace hash table didn't reuse deleted buckets, leading to
quadratic behavior.

Also ignore deleted buckets when resizing.

Fixes #726.
2024-06-06 15:53:43 +02:00
Nick Wellnhofer
0b6d813073 Release v2.12.7 v2.12.7 2024-05-13 11:34:02 +02:00
Nick Wellnhofer
2876ac5392 [CVE-2024-34459] Fix buffer overread with xmllint --htmlout
Add a missing bounds check.
2024-05-13 11:32:02 +02:00
Nick Wellnhofer
8e9fdc20f0 xmllint: Fix --pedantic option
Regressed in 74c84a8c.
2024-05-13 11:31:41 +02:00
Nick Wellnhofer
f907f785ce ci: Remove Python 2 job, update C89 job
Python 2 isn't supported on newer Ubuntu releases. Newer Python
releases have header files which aren't compatible with C89.
2024-04-02 16:34:08 +02:00
Nick Wellnhofer
5a8d9a35a4 save: Handle invalid parent pointers in xhtmlNodeDumpOutput
See #255 and commit 85b1792e.
2024-04-02 16:21:59 +02:00
Nick Wellnhofer
505e2e872e Release v2.12.6 v2.12.6 2024-03-15 12:15:36 +01:00
Nick Wellnhofer
4462d4afb9 doc: Update xmllint documentation 2024-03-15 12:15:17 +01:00
Nick Wellnhofer
ece73bd8fd parser: Fix detection of duplicate attributes in XML namespace
Fixes a regression from commit e0dd330b, resulting in duplicate
attributes in the predefined XML namespace not being detected or
extraneous default attributes being passed.

Fixes #704.
2024-03-12 22:35:10 +01:00
Nick Wellnhofer
4365a5e115 xmlreader: Fix xmlTextReaderConstEncoding
Regression from commit f1c1f5c6.

Fixes #697.
2024-02-26 16:02:52 +01:00
Nick Wellnhofer
0b5650067b html: Fix htmlCreatePushParserCtxt with encoding
Regression from commit ec7be506.

Fixes #696.
2024-02-26 01:20:02 +01:00
Nick Wellnhofer
387a952bdb xmllint: Return error code if XPath returns empty nodeset
Return an error code as before but make it possible to distinguish from
real errors.

Fixes #690.
2024-02-12 17:00:38 +01:00
Nick Wellnhofer
e189e99453 Release v2.12.5 v2.12.5 2024-02-04 14:53:18 +01:00
Nick Wellnhofer
9272197088 [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking
Fixes a use-after-free if XML Reader if used with DTD validation and
XInclude expansion.

Fixes #604.
2024-02-04 14:44:15 +01:00
Nick Wellnhofer
8b9b972aaa parser: Fix crash in xmlParseInNodeContext with HTML documents
Ignore namespaces if we have an HTML document with namespaces added
manually.

Fixes #672.
2024-02-04 14:43:15 +01:00
Nick Wellnhofer
8292f36145 Release v2.12.4 v2.12.4 2024-01-15 16:41:16 +01:00
Nick Wellnhofer
c22c85f2bf gitlab-ci: Disable Python tests on MinGW
See #658.
2024-01-15 16:32:22 +01:00
Nick Wellnhofer
1e6b17b834 parser: Fix regression parsing standalone declarations
Fix parsing of standalone declarations if an encoding was provided.

Fixes #661.
2024-01-15 16:29:51 +01:00
Nick Wellnhofer
be0ff6b7f0 autotools: Readd --with-xptr-locs configuration option
The option was removed accidentally in 4e4c89a4.
2024-01-10 18:12:21 +01:00
Nick Wellnhofer
f006355eda parser: Fix build --without-output 2023-12-14 13:42:16 +01:00
Nick Wellnhofer
d7714f977d parser: Don't grow or shrink pull parser memory buffers
Readd check for memory buffers without a read callback to avoid
XML_MAX_LOOKUP_LIMIT errors if users provide a custom input buffer.
Regressed with commit 834b8123 and later changes.
2023-12-14 13:38:54 +01:00
Nick Wellnhofer
1b6362ea44 io: Fix memory lifetime issue with input buffers
xmlParserInputBufferCreateMem must make a copy of the buffer.

This fixes a regression from 2.11 which could cause reads from freed
memory depending on the use case.

Undeprecate xmlParserInputBufferCreateStatic which can avoid copying
the whole buffer.
2023-12-12 23:58:33 +01:00
Nick Wellnhofer
30d22bec03 Release v2.12.3 v2.12.3 2023-12-12 15:36:12 +01:00
Nick Wellnhofer
8d42c447d6 parser: Fix namespaces redefined from default attributes
This regressed in commit e0dd330b.

Also fixes a long-standing issue where namespaces from default
attributes weren't added if they match an existing namespace.

Fixes #643.
2023-12-08 16:05:22 +01:00
Nick Wellnhofer
23dd0b7627 include: Rename XML_EMPTY helper macro
Avoid name clash with downstream projects.
2023-12-07 14:40:13 +01:00
Nick Wellnhofer
7f767866b3 include: Move declaration of xmlInitGlobals
Fix downstream build issues after reworking globals.h.
2023-12-07 14:15:29 +01:00
Nick Wellnhofer
34a9665751 include: Add missing includes 2023-12-07 12:04:02 +01:00
Nick Wellnhofer
942f5a9387 include: Move globals from xmlsave.h to parser.h
Fix downstream build issues after reworking globals.h.
2023-12-06 19:56:50 +01:00
Nick Wellnhofer
72007096e2 include: Readd circular dependency between tree.h and parser.h
There are dozens of downstream projects that only include tree.h but use
declarations from parser.h. This broke after the recent cleanup of
circular dependencies.

Make tree.h include parser.h again. This is a hack but doesn't change
the include directory struture.
2023-12-06 18:35:30 +01:00
Nick Wellnhofer
4d8fa5b292 Release v2.12.2 v2.12.2 2023-12-05 20:49:22 +01:00
Nick Wellnhofer
f5b3296a1e build: Disable compiler TLS by default
The global struct is quite large (~700 bytes on 64-bit systems which
will be allocated for each thread whether it uses libxml2 or not) and
already close to the total size limit on some platforms.

Disable compiler TLS by default.
2023-12-05 20:40:20 +01:00
Nick Wellnhofer
f76ee97a81 parser: Fix invalid free in xmlParseBalancedChunkMemoryRecover
Set the dictionary for newDoc in xmlParseBalancedChunkMemoryRecover.
This is a long-standing bug which was masked by

- xmlParseBalancedChunkMemoryRecover changing the document of the root
  node. This is a really bad idea, resulting in a mismatch between
  ctxt->myDoc and ctxt->node->doc.
- SAX2.c preferring ctxt->node->doc over ctxt->myDoc until commit
  a31e1b06.

Fixes #641.
2023-12-01 20:20:07 +01:00
Nick Wellnhofer
367d5ce813 tree: Another fix related to #538
Should fix #639.
2023-12-01 20:19:59 +01:00
Nick Wellnhofer
d4a12403f8 globals: Disable TLS in static Windows builds
The cleanup callback would run after TLS was deallocated.
2023-12-01 20:19:50 +01:00
Nick Wellnhofer
8672bf253b html: Reenable buggy detection of XML declarations
Switch to UTF-8 if a document starts with '<?xm' to match old behavior.
Also enable this check in the push parser.

Fixes #637.
2023-12-01 17:26:47 +01:00
Nick Wellnhofer
c4d22fe4b4 cmake: Update config.h.cmake.in
This should enable TLS and destructors.
2023-12-01 17:26:33 +01:00
Nick Wellnhofer
30d7660ba8 tree: Fix #583 again
Only set doc->intSubset after successful copy to avoid dangling pointers
in error case.
2023-12-01 17:24:45 +01:00
Nick Wellnhofer
f45cd84cec tree: Fix regression when copying DTDs
This reverts commit d39f78069dff496ec865c73aa44d7110e429bce9.

Fixes #634.
2023-12-01 17:24:32 +01:00
Nick Wellnhofer
e1071e9d03 tests: Fix tests --with-valid --without-xinclude
Fix a copy/paste error from commit 4eba9f9c.

Fixes #632.
2023-12-01 17:24:19 +01:00
Nick Wellnhofer
6ec42951cf parser: Make CRLF increment line number
Partial revert of cb927e85 fixing CRLFs not incrementing the line
number.

This requires to rework xmlParseQNameHashed. The original implementation
prompted the change to xmlCurrentChar which really shouldn't modify the
'cur' pointer as side effect. But the NEXTL macro relies on this
behavior.

Ultimately, we should reintroduce the change to xmlCurrentChar and fix
the NEXTL macro. This will lead to single CRs incrementing the line
number as well which seems more consistent.

Fixes #628.
2023-12-01 17:23:59 +01:00
Nick Wellnhofer
f4ac9926a4 Release v2.12.1 v2.12.1 2023-11-23 16:25:34 +01:00
Nick Wellnhofer
65230d536f autotools: Stop checking for snprintf
This works around a bug when cross-compiling to 32-bit MinGW:

https://sourceforge.net/p/mingw-w64/bugs/935/

This means that we don't fall back to the bundled Trio library if
snprintf couldn't be detected. Trio support is completely untested, most
likely broken and will be removed soon.

Fixes #625.
2023-11-23 16:20:54 +01:00
Nick Wellnhofer
3fe3d50786 hash: Fix deletion of entries during scan
Functions like xmlCleanSpecialAttr scan a hash table and possibly delete
entries in the callback. xmlHashScanFull must detect such deletions and
rescan the entry.

This regressed when rewriting the hash table code in 4a513d56.

Fixes #626.
2023-11-23 16:20:54 +01:00
Nick Wellnhofer
2bc8e7a307 parser: Only enable SAX2 if there are SAX2 element handlers
This reverts part of commit 235b15a5 for backward compatibility and
adds some comments trying to clarify the whole mess.

Fixes #623.
2023-11-23 16:20:54 +01:00
Nick Wellnhofer
0af49eb97a dict: Fix '__thread' before 'static'
When used with extern or static, __thread must appear immediately after
the other storage class specifier.

Fixes #621.
2023-11-23 16:20:54 +01:00
Mike Dalessio
dd643d0a34 fix: more pthread weak references in globals.c 2023-11-23 16:20:54 +01:00