lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-07-30 22:43:14 +03:00
Code Activity

Fix a segfault on XSD validation on pattern error

Browse Source 
As reported by Sven <sven@e7o.de>:
The following pattern will cause a segmentation fault in my
Apache (using PHP5 to validate a XML against a XSD):

<xs:pattern value="(.*)|"/>

Fix a cascade of error handling failures which led to the
crash in that scenario.
This commit is contained in:
Daniel Veillard
2012-08-17 20:34:05 +08:00
parent b60061a7a5
commit 40851d0c59
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
xmlregexp.c
View File

@ -3202,7 +3202,7 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
memset(exec->counts, 0, comp->nbCounters * sizeof(int)); memset(exec->counts, 0, comp->nbCounters * sizeof(int));
} else } else
exec->counts = NULL; exec->counts = NULL;
while ((exec->status == 0) && while ((exec->status == 0) && (exec->state != NULL) &&
((exec->inputString[exec->index] != 0) || ((exec->inputString[exec->index] != 0) ||
((exec->state != NULL) && ((exec->state != NULL) &&
(exec->state->type != XML_REGEXP_FINAL_STATE)))) { (exec->state->type != XML_REGEXP_FINAL_STATE)))) {
@ -3456,6 +3456,8 @@ error:
} }
xmlFree(exec->rollbacks); xmlFree(exec->rollbacks);
} }
if (exec->state == NULL)
return(-1);
if (exec->counts != NULL) if (exec->counts != NULL)
xmlFree(exec->counts); xmlFree(exec->counts);
if (exec->status == 0) if (exec->status == 0)
@ -5373,6 +5375,10 @@ xmlFAParseRegExp(xmlRegParserCtxtPtr ctxt, int top) {
end = ctxt->state; end = ctxt->state;
while ((CUR == '|') && (ctxt->error == 0)) { while ((CUR == '|') && (ctxt->error == 0)) {
NEXT; NEXT;
if (CUR == 0) {
ERROR("expecting a branch after |")
return;
}
ctxt->state = start; ctxt->state = start;
ctxt->end = NULL; ctxt->end = NULL;
xmlFAParseBranch(ctxt, end); xmlFAParseBranch(ctxt, end);