lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-07-29 11:41:22 +03:00
Code Activity

Fix a segfault on XSD validation on pattern error

Browse Source 
As reported by Sven <sven@e7o.de>:
The following pattern will cause a segmentation fault in my
Apache (using PHP5 to validate a XML against a XSD):

<xs:pattern value="(.*)|"/>

Fix a cascade of error handling failures which led to the
crash in that scenario.
This commit is contained in:
Daniel Veillard
2012-08-17 20:34:05 +08:00
parent b60061a7a5
commit 40851d0c59
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
xmlregexp.c
View File

@ -3202,7 +3202,7 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
memset(exec->counts, 0, comp->nbCounters * sizeof(int));
} else
exec->counts = NULL;
while ((exec->status == 0) &&
while ((exec->status == 0) && (exec->state != NULL) &&
((exec->inputString[exec->index] != 0) ||
((exec->state != NULL) &&
(exec->state->type != XML_REGEXP_FINAL_STATE)))) {
@ -3456,6 +3456,8 @@ error:
}
xmlFree(exec->rollbacks);
}
if (exec->state == NULL)
return(-1);
if (exec->counts != NULL)
xmlFree(exec->counts);
if (exec->status == 0)
@ -5373,6 +5375,10 @@ xmlFAParseRegExp(xmlRegParserCtxtPtr ctxt, int top) {
end = ctxt->state;
while ((CUR == '|') && (ctxt->error == 0)) {
NEXT;
if (CUR == 0) {
ERROR("expecting a branch after |")
return;
}
ctxt->state = start;
ctxt->end = NULL;
xmlFAParseBranch(ctxt, end);