1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-10-26 12:25:09 +03:00
XML parser and toolkit
Go to file
Nick Wellnhofer e4f85f1bd2 [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType
Fix a null pointer dereference when parsing (invalid) XML schemas.

Thanks to Robby Simpson for the report!

Fixes #491.
2023-04-11 14:29:50 +02:00
.gitlab-ci gitlab-ci: Revert accidental change to setup_mingw.sh 2022-12-21 22:30:25 +01:00
doc win32: Remove broken libxml2.def.src 2023-03-12 16:04:17 +01:00
example Don't overlink executables 2022-04-03 14:08:43 +02:00
fuzz fuzz: Add valid.options 2023-03-12 19:47:07 +01:00
include parser: Rework EBCDIC code page detection 2023-03-21 21:35:15 +01:00
m4 Move local Autoconf macros into m4 directory 2022-04-03 19:11:13 +02:00
os400 fix Schematron spelling 2022-05-06 10:44:03 +02:00
python xmlValidatePopElement() can return invalid value (-1) 2023-04-10 13:21:53 -07:00
result [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType 2023-04-11 14:29:50 +02:00
test [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType 2023-04-11 14:29:50 +02:00
vms Remove remaining definitions of STDC_HEADERS 2022-04-20 19:18:17 +02:00
win32 win32: Remove broken libxml2.def.src 2023-03-12 16:04:17 +01:00
xstc Use python3 not python 2022-12-07 13:21:12 +00:00
.editorconfig Fix .editorconfig 2022-11-22 17:01:21 +01:00
.gitattributes Fix .gitattributes 2020-07-23 20:46:42 +02:00
.gitignore Remove RPM build, Makefile.tests, README.tests 2022-12-21 22:05:47 +01:00
.gitlab-ci.yml gitlab-ci: Enable all "integer" sanitizers 2023-03-12 14:45:14 +01:00
autogen.sh Build Autotools CI tests out of source tree (VPATH) 2022-04-21 06:59:02 +02:00
buf.c malloc-fail: Fix null deref in xmlBufResize 2023-01-24 11:32:15 +01:00
build_glob.py Remove XMLCALL and XMLCDECL macros from public headers 2022-12-08 02:48:27 +01:00
c14n.c Don't build unneeded .c source files 2022-09-02 18:33:35 +02:00
catalog.c catalog: Fix memory leaks 2023-02-21 15:22:01 +01:00
check-relaxng-test-suite2.py Use python3 not python 2022-12-07 13:21:12 +00:00
check-relaxng-test-suite.py Use python3 not python 2022-12-07 13:21:12 +00:00
check-xinclude-test-suite.py Use python3 not python 2022-12-07 13:21:12 +00:00
check-xml-test-suite.py Use python3 not python 2022-12-07 13:21:12 +00:00
check-xsddata-test-suite.py Use python3 not python 2022-12-07 13:21:12 +00:00
chvalid.c libxml.h: Don't include stdio.h 2022-12-08 04:24:57 +01:00
chvalid.def Remove executable bit from non-executable files 2019-09-16 15:48:59 +02:00
CMakeLists.txt cmake: Link against dl and dld only when LIBXML2_WITH_MODULES is enabled 2023-02-24 12:45:01 +00:00
config.h.cmake.in build: Remove check for broken ss_family 2022-09-06 01:07:24 +02:00
configure.ac Remove RPM build, Makefile.tests, README.tests 2022-12-21 22:05:47 +01:00
Copyright Cleanup the Copyright to be pure MIT Licence wording 2012-09-20 21:46:19 +08:00
dbgen.pl add a Timingtests target to check bad behaviour from the streaming engine 2003-09-17 22:33:22 +00:00
dbgenattr.pl add a Timingtests target to check bad behaviour from the streaming engine 2003-09-17 22:33:22 +00:00
debugXML.c Remove hacky heuristic from b2dc5675e9 2022-12-01 15:31:25 +00:00
dict.c gitlab-ci: Enable all "integer" sanitizers 2023-03-12 14:45:14 +01:00
encoding.c encoding: Fix error code in asciiToUTF8 2023-03-26 15:42:02 +02:00
entities.c entities: Stop counting entities 2022-12-21 20:19:10 +01:00
error.c error: Don't move past current position 2023-01-24 11:12:31 +01:00
genChRanges.py libxml.h: Don't include stdio.h 2022-12-08 04:24:57 +01:00
gentest.py gentest.py: Fix memory leak in API tests 2022-12-08 19:18:10 +01:00
genUnicode.py Remove XMLCALL and XMLCDECL macros from public headers 2022-12-08 02:48:27 +01:00
global.data Fix SetGenericErrorFunc and SetStructured clash 2009-08-24 17:34:25 +02:00
globals.c threads: Allocate mutexes statically 2022-11-25 15:12:56 +01:00
hash.c gitlab-ci: Enable all "integer" sanitizers 2023-03-12 14:45:14 +01:00
HTMLparser.c malloc-fail: Fix buffer overread with HTML doctype declarations 2023-03-26 22:42:13 +02:00
HTMLtree.c html: Don't escape ASCII chars in href attributes 2022-11-20 21:16:03 +01:00
legacy.c Mark more static data as const 2022-04-07 12:01:23 -07:00
libxml2-config.cmake.cmake.in Add variables for configured options to CMake config files 2021-01-05 22:03:47 +01:00
libxml2-config.cmake.in Add variables for configured options to CMake config files 2021-01-05 22:03:47 +01:00
libxml2.doap Remove broken VxWorks support 2022-03-01 17:18:56 +01:00
libxml2.syms Remove symbols from version script 2023-01-17 16:18:48 +01:00
libxml-2.0-uninstalled.pc.in Update libxml-2.0-uninstalled.pc.in 2022-04-03 14:37:45 +02:00
libxml-2.0.pc.in Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS 2022-04-03 14:08:45 +02:00
libxml.h libxml.h: Add comments and indentation 2022-12-08 04:39:03 +01:00
libxml.m4 libxml.m4: deprecate AM_PATH_XML2, wrap PKG_CHECK_MODULES instead 2022-12-06 18:17:49 +00:00
list.c Remove elfgcchack.h 2022-02-20 21:49:04 +01:00
MAINTAINERS.md Move Dockerfile to .gitlab-ci directory 2022-09-04 20:27:27 +02:00
Makefile.am autotools: Fix make distcheck 2023-02-13 11:14:34 +01:00
nanoftp.c sources: Silence C4013 warnings on Visual Studio 2022-11-22 15:20:53 +08:00
nanohttp.c sources: Silence C4013 warnings on Visual Studio 2022-11-22 15:20:53 +08:00
NEWS doc: Mention new location of XML catalog as breaking change 2022-11-13 15:21:22 +01:00
parser.c parser: Rework EBCDIC code page detection 2023-03-21 21:35:15 +01:00
parserInternals.c parser: Halt parser if switching encodings fails 2023-03-30 14:09:15 +02:00
pattern.c pattern: Merge identical branches 2023-02-21 15:46:06 +01:00
README.md Update README.md 2022-12-08 00:54:13 +01:00
README.zOS Large batch of typo fixes 2019-09-30 18:04:38 +02:00
relaxng.c relaxng: Remove useless if statement 2023-02-21 15:46:06 +01:00
rngparser.c Remove elfgcchack.h 2022-02-20 21:49:04 +01:00
runsuite.c runsuite: Some errors are expected 2022-12-22 15:35:28 +01:00
runtest.c Remove XMLDECL macro from .c files 2022-12-08 02:43:17 +01:00
runxmlconf.c tests: Remove unneeded #includes 2022-11-22 16:03:05 +01:00
SAX2.c SAX2: Ignore namespaces in HTML documents 2023-03-31 17:08:43 +02:00
SAX.c Remove DOCBparser 2022-03-04 22:56:21 +01:00
schematron.c schematron: Use logical and 2023-02-22 14:25:29 +01:00
testapi.c testapi.c: Initialize catalog early 2022-12-08 19:44:09 +01:00
testchar.c error: Limit number of parser errors 2022-12-27 14:41:19 +01:00
testdict.c warnings: Work around MSVC bug 2022-11-22 15:49:27 +01:00
testdso.c warning patches from Peter Breitenlohner serious DTD parsing speedups, 2005-01-25 00:22:52 +00:00
testlimits.c Remove XMLDECL macro from .c files 2022-12-08 02:43:17 +01:00
testModule.c testModule: exit if the module can't be opened 2022-12-06 17:24:37 +00:00
testOOM.c Remove unneeded #includes 2022-03-04 22:11:49 +01:00
testOOMlib.c Don't check for standard C89 headers 2022-03-02 00:43:54 +01:00
testOOMlib.h Remove unneeded #includes 2022-03-04 22:11:49 +01:00
testrecurse.c parser: Tighten expansion limits 2023-03-08 13:58:49 +01:00
testThreads.c tests: Remove unneeded #includes 2022-11-22 16:03:05 +01:00
threads.c threads: Really fix crash with weak pthread symbols 2023-02-23 14:30:45 +01:00
timsort.h Large batch of typo fixes 2019-09-30 18:04:38 +02:00
tree.c malloc-fail: Fix memory leak in xmlCopyNamespaceList 2023-03-08 13:17:47 +01:00
trio.c Don't check for standard C89 headers 2022-03-02 00:43:54 +01:00
trio.h Fix typos 2020-03-08 17:41:53 +01:00
triodef.h Fix typos 2020-03-08 17:41:53 +01:00
trionan.c Fix typos 2020-03-08 17:41:53 +01:00
trionan.h Fix typos 2020-03-08 17:41:53 +01:00
triop.h Fix typos 2020-03-08 17:41:53 +01:00
triostr.c Fix typos 2020-03-08 17:41:53 +01:00
triostr.h Fix typos 2020-03-08 17:41:53 +01:00
uri.c uri: Add explicit cast in xmlSaveUri 2023-01-24 11:32:15 +01:00
valid.c xmlValidatePopElement() can return invalid value (-1) 2023-04-10 13:21:53 -07:00
xinclude.c malloc-fail: Fix memory leak in xmlXIncludeLoadTxt 2023-02-17 17:16:52 +01:00
xlink.c Remove unneeded #includes 2022-03-04 22:11:49 +01:00
xml2-config.in Remove LIBS from XML_PRIVATE_LIBS 2022-04-03 14:37:45 +02:00
xmlcatalog.c catalog: Fix memory leaks 2023-02-21 15:22:01 +01:00
xmlIO.c malloc-fail: Fix memory leak in xmlParserInputBufferCreateMem 2023-02-17 17:16:50 +01:00
xmllint.c xmllint: Fix memory leak with --pattern --stream 2023-03-14 14:55:39 +01:00
xmlmemory.c xmllint: Fix use-after-free with --maxmem 2023-03-14 14:55:34 +01:00
xmlmodule.c Fix Windows compiler warnings in python/types.c 2022-09-04 18:36:04 +02:00
xmlreader.c malloc-fail: Handle memory errors in xmlTextReaderEntPush 2023-01-24 11:32:15 +01:00
xmlregexp.c regexp: Add sanity check in xmlRegCalloc2 2023-02-21 15:43:32 +01:00
xmlsave.c malloc-fail: Fix memory leak in xmlDocDumpFormatMemoryEnc 2023-02-17 17:16:51 +01:00
xmlschemas.c [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType 2023-04-11 14:29:50 +02:00
xmlschemastypes.c malloc-fail: Handle malloc failures in xmlSchemaInitTypes 2023-03-14 15:14:38 +01:00
xmlstring.c malloc-fail: Don't call xmlErrMemory in xmlstring.c 2023-01-24 11:47:33 +01:00
xmlunicode.c Mark more static data as const 2022-04-07 12:01:23 -07:00
xmlwriter.c Remove XMLDECL macro from .c files 2022-12-08 02:43:17 +01:00
xpath.c malloc-fail: Check for malloc failures when creating XPath strings 2023-03-18 16:51:43 +01:00
xpointer.c Don't use sizeof(xmlChar) or sizeof(char) 2022-09-01 03:35:19 +02:00
xzlib.c xzlib: Fix implicit sign change in xz_open 2023-03-14 15:16:04 +01:00

libxml2

libxml2 is an XML toolkit implemented in C, originally developed for the GNOME Project.

Official releases can be downloaded from https://download.gnome.org/sources/libxml2/

The git repository is hosted on GNOME's GitLab server: https://gitlab.gnome.org/GNOME/libxml2

Bugs should be reported at https://gitlab.gnome.org/GNOME/libxml2/-/issues

Documentation is available at https://gitlab.gnome.org/GNOME/libxml2/-/wikis

License

This code is released under the MIT License, see the Copyright file.

Build instructions

libxml2 can be built with GNU Autotools, CMake, or several other build systems in platform-specific subdirectories.

Autotools (for POSIX systems like Linux, BSD, macOS)

If you build from a Git tree, you have to install Autotools and start by generating the configuration files with:

./autogen.sh

If you build from a source tarball, extract the archive with:

tar xf libxml2-xxx.tar.gz
cd libxml2-xxx

To see a list of build options:

./configure --help

Also see the INSTALL file for additional instructions. Then you can configure and build the library:

./configure [possible options]
make

Note that by default, no optimization options are used. You have to enable them manually, for example with:

CFLAGS='-O2 -fno-semantic-interposition' ./configure

Now you can run the test suite with:

make check

Please report test failures to the mailing list or bug tracker.

Then you can install the library:

make install

At that point you may have to rerun ldconfig or a similar utility to update your list of installed shared libs.

CMake (mainly for Windows)

Another option for compiling libxml is using CMake:

cmake -E tar xf libxml2-xxx.tar.gz
cmake -S libxml2-xxx -B libxml2-xxx-build [possible options]
cmake --build libxml2-xxx-build
cmake --install libxml2-xxx-build

Common CMake options include:

-D BUILD_SHARED_LIBS=OFF            # build static libraries
-D CMAKE_BUILD_TYPE=Release         # specify build type
-D CMAKE_INSTALL_PREFIX=/usr/local  # specify the install path
-D LIBXML2_WITH_ICONV=OFF           # disable iconv
-D LIBXML2_WITH_LZMA=OFF            # disable liblzma
-D LIBXML2_WITH_PYTHON=OFF          # disable Python
-D LIBXML2_WITH_ZLIB=OFF            # disable libz

You can also open the libxml source directory with its CMakeLists.txt directly in various IDEs such as CLion, QtCreator, or Visual Studio.

Dependencies

Libxml does not require any other libraries. A platform with somewhat recent POSIX support should be sufficient (please report any violation to this rule you may find).

However, if found at configuration time, libxml will detect and use the following libraries:

  • libz, a highly portable and widely available compression library.
  • liblzma, another compression library.
  • libiconv, a character encoding conversion library. The iconv function is part of POSIX.1-2001, so libiconv isn't required on modern UNIX-like systems like Linux, BSD or macOS.
  • ICU, a Unicode library. Mainly useful as an alternative to iconv on Windows. Unnecessary on most other systems.

Contributing

The current version of the code can be found in GNOME's GitLab at at https://gitlab.gnome.org/GNOME/libxml2. The best way to get involved is by creating issues and merge requests on GitLab. Alternatively, you can start discussions and send patches to the mailing list. If you want to work with patches, please format them with git-format-patch and use plain text attachments.

All code must conform to C89 and pass the GitLab CI tests. Add regression tests if possible.

Authors

  • Daniel Veillard
  • Bjorn Reese
  • William Brack
  • Igor Zlatkovic for the Windows port
  • Aleksey Sanin
  • Nick Wellnhofer