lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-26 00:37:43 +03:00
Code Activity

Revert "Fix quadratic runtime in xi:fallback processing"

Browse Source 
This reverts commit 27119ec33c.

Not copying fallback children didn't fix up namespaces and could lead
to use-after-free errors.

Found by OSS-Fuzz.
This commit is contained in:
Nick Wellnhofer
2020-08-19 13:07:28 +02:00
parent d63cfeca35
commit 19cae17f5a
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
xinclude.c
View File

@@ -1984,7 +1984,8 @@ xmlXIncludeLoadFallback(xmlXIncludeCtxtPtr ctxt, xmlNodePtr fallback, int nr) {
ret = -1; ret = -1;
xmlXIncludeFreeContext(newctxt); xmlXIncludeFreeContext(newctxt);
ctxt->incTab[nr]->inc = fallback->children; ctxt->incTab[nr]->inc = xmlDocCopyNodeList(ctxt->doc,
fallback->children);
} else { } else {
ctxt->incTab[nr]->inc = NULL; ctxt->incTab[nr]->inc = NULL;
} }
@@ -2240,6 +2241,12 @@ xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt, int nr) {
if (ctxt->incTab[nr]->fallback) if (ctxt->incTab[nr]->fallback)
xmlUnsetProp(cur, BAD_CAST "href"); xmlUnsetProp(cur, BAD_CAST "href");
cur->type = XML_XINCLUDE_START; cur->type = XML_XINCLUDE_START;
/* Remove fallback children */
for (child = cur->children; child != NULL; child = next) {
next = child->next;
xmlUnlinkNode(child);
xmlFreeNode(child);
}
end = xmlNewDocNode(cur->doc, cur->ns, cur->name, NULL); end = xmlNewDocNode(cur->doc, cur->ns, cur->name, NULL);
if (end == NULL) { if (end == NULL) {
xmlXIncludeErr(ctxt, ctxt->incTab[nr]->ref, xmlXIncludeErr(ctxt, ctxt->incTab[nr]->ref,
@@ -2255,16 +2262,10 @@ xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt, int nr) {
* Add the list of nodes * Add the list of nodes
*/ */
while (list != NULL) { while (list != NULL) {
next = list->next; cur = list;
xmlAddPrevSibling(end, list); list = list->next;
list = next;
}
/* Remove fallback node */ xmlAddPrevSibling(end, cur);
for (child = cur->children; child != NULL; child = next) {
next = child->next;
xmlUnlinkNode(child);
xmlFreeNode(child);
} }
} }