8 Commits

Author	SHA1	Message	Date
Nick Wellnhofer	9ab01a277d	Fix XPointer paths beginning with range-to ... The old code would invoke the broken xmlXPtrRangeToFunction. range-to isn't really a function but a special kind of location step. Remove this function and always handle range-to in the XPath code. The old xmlXPtrRangeToFunction could also be abused to trigger a use-after-free error with the potential for remote code execution. Found with afl-fuzz. Fixes CVE-2016-5131.	2016-10-12 13:12:18 +02:00
Nick Wellnhofer	d8083bf779	Fix NULL pointer deref in XPointer range-to ... - Check for errors after evaluating first operand. - Add sanity check for empty stack. Found with afl-fuzz.	2016-06-25 14:24:51 +02:00
Daniel Veillard	9a237c9d26	improved the script accordingly to the XInclude regression tests updates ... * check-xinclude-test-suite.py: improved the script accordingly to the XInclude regression tests updates * xpointer.c: Implemented XPointer element() Scheme W3C PR of 13 November 2002 * result/XPath/xptr/chapterschildseq result/XPath/xptr/vidchildseq test/XPath/xptr/chapterschildseq test/XPath/xptr/vidchildseq: augmented the Xpointer testsuite for the element() scheme Daniel	2003-02-13 15:52:58 +00:00
Daniel Veillard	f62ceffb7e	General fixes, XPointer improvements: ... - HTMLparser.c: some fixes on auto-open of html/head/body - encoding.c: fixed a compilation error on some gcc env - xpath.c xpointer.[ch] xpathInternals.h: improved the XPointer implementation - test/XPath/xptr/strpoint test/XPath/xptr/strrange3: added related XPointer tests and associated results Daniel	2000-11-24 23:36:01 +00:00
Daniel Veillard	2ffc3591c1	- parser.[ch]: added xmlIOParseDTD() ... - xpointer.c: added support for the 2 extra parameters of string-range, fixed a stoopid error when '0' was present in XPointer expressions - test/XPath/xptr/strrange2 result/XPath/xptr/strrange2: added testsuite for the above Daniel	2000-10-30 15:36:47 +00:00
Daniel Veillard	ff9c330753	More work on XPointer ... - xpath.c xpointer.c: XPointer reorder of ranges start/end and string-range for empty strings - test/XPath/docs/str test/XPath/xptr/chaptersrange test/XPath/xptr/strrange: augmented the XPointer testsuite Daniel	2000-10-13 16:38:25 +00:00
Daniel Veillard	c2df4cde4e	Going forward in XPointer implementation: ... - testXPath.c xpath.[ch]: moved some debug functions to xpath core - xpointer.c: implemented string-range() at least a good first version - test/XPath/docs/str test/XPath/xptr/strrange result/XPath/xptr/strrange: the string-range() tests Daniel	2000-10-12 23:15:24 +00:00
Daniel Veillard	c8df0aaf9f	Added XPointer: - configure.in Makefile.am include/makefile.am: adding ... Added XPointer: - configure.in Makefile.am include/makefile.am: adding XPointer and XPtrtests target - xpointer.[ch] : new files for XPointer support - test/XPath/xptr result/XPath/xptr: added XPointer testsuite and more XPath tests Daniel	2000-10-10 23:50:30 +00:00