mirror of
https://gitlab.gnome.org/GNOME/libxml2.git
synced 2025-03-12 16:58:16 +03:00
40f5852149
When traversing the "preceding" axis from an attribute node, we must first go up to the attribute's containing element. Otherwise, text children of other attributes could be returned. This made it possible to hit a code path in xmlXPathNextAncestor which contained another bug: The attribute node was initialized with the context node instead of the current node. Normally, this code path is only hit via xmlXPathNextAncestorOrSelf in which case the current and context node are the same. The combination of the two bugs could result in an infinite loop, found with libFuzzer. Traversing the "following" and the "preceding" axis from namespace nodes should be handled similarly. This wasn't supported at all previously.
17 lines
626 B
Plaintext
17 lines
626 B
Plaintext
/child::*
|
|
/child::EXAMPLE
|
|
/child::EXAMPLE/child::head
|
|
/child::EXAMPLE/child::*
|
|
/child::EXAMPLE/child::head/child::title
|
|
/child::EXAMPLE/child::head/child::title/child::text()
|
|
/child::EXAMPLE/child::head/node()
|
|
/child::EXAMPLE/attribute::prop1/self::node()
|
|
/child::EXAMPLE/attribute::prop1/self::*
|
|
/child::EXAMPLE/attribute::prop1/descendant-or-self::node()
|
|
/child::EXAMPLE/attribute::prop1/descendant-or-self::*
|
|
/child::EXAMPLE/attribute::prop1/ancestor-or-self::node()
|
|
/child::EXAMPLE/attribute::prop1/ancestor-or-self::*
|
|
/descendant::title
|
|
/descendant::p/ancestor::chapter
|
|
/child::EXAMPLE/attribute::prop2/preceding::text()
|