lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-23 01:52:48 +03:00
Code Activity

Properly handle nested documents in xmlFreeNode

Browse Source 
Client code should never add document nodes as children of other nodes,
but even our own XPointer code has a bug that can produce such trees.
Make sure to really free nested documents. Also see commits 0815302d
and 0762c9b6.

Should fix #269.
This commit is contained in:
Nick Wellnhofer
2022-02-07 18:24:03 +01:00
parent 9653565765
commit ea53fc18bc
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
tree.c
View File

@@ -3695,17 +3695,14 @@ xmlFreeNodeList(xmlNodePtr cur) {
xmlFreeNsList((xmlNsPtr) cur); xmlFreeNsList((xmlNsPtr) cur);
return; return;
} }
if ((cur->type == XML_DOCUMENT_NODE) ||
#ifdef LIBXML_DOCB_ENABLED
(cur->type == XML_DOCB_DOCUMENT_NODE) ||
#endif
(cur->type == XML_HTML_DOCUMENT_NODE)) {
xmlFreeDoc((xmlDocPtr) cur);
return;
}
if (cur->doc != NULL) dict = cur->doc->dict; if (cur->doc != NULL) dict = cur->doc->dict;
while (1) { while (1) {
while ((cur->children != NULL) && while ((cur->children != NULL) &&
(cur->type != XML_DOCUMENT_NODE) &&
#ifdef LIBXML_DOCB_ENABLED
(cur->type != XML_DOCB_DOCUMENT_NODE) &&
#endif
(cur->type != XML_HTML_DOCUMENT_NODE) &&
(cur->type != XML_DTD_NODE) && (cur->type != XML_DTD_NODE) &&
(cur->type != XML_ENTITY_REF_NODE)) { (cur->type != XML_ENTITY_REF_NODE)) {
cur = cur->children; cur = cur->children;
@@ -3714,7 +3711,13 @@ xmlFreeNodeList(xmlNodePtr cur) {
next = cur->next; next = cur->next;
parent = cur->parent; parent = cur->parent;
if (cur->type != XML_DTD_NODE) { if ((cur->type == XML_DOCUMENT_NODE) ||
#ifdef LIBXML_DOCB_ENABLED
(cur->type == XML_DOCB_DOCUMENT_NODE) ||
#endif
(cur->type == XML_HTML_DOCUMENT_NODE)) {
xmlFreeDoc((xmlDocPtr) cur);
} else if (cur->type != XML_DTD_NODE) {
if ((__xmlRegisterCallbacks) && (xmlDeregisterNodeDefaultValue)) if ((__xmlRegisterCallbacks) && (xmlDeregisterNodeDefaultValue))
xmlDeregisterNodeDefaultValue(cur); xmlDeregisterNodeDefaultValue(cur);
@@ -3728,11 +3731,6 @@ xmlFreeNodeList(xmlNodePtr cur) {
(cur->type != XML_XINCLUDE_START) && (cur->type != XML_XINCLUDE_START) &&
(cur->type != XML_XINCLUDE_END) && (cur->type != XML_XINCLUDE_END) &&
(cur->type != XML_ENTITY_REF_NODE) && (cur->type != XML_ENTITY_REF_NODE) &&
(cur->type != XML_DOCUMENT_NODE) &&
#ifdef LIBXML_DOCB_ENABLED
(cur->type != XML_DOCB_DOCUMENT_NODE) &&
#endif
(cur->type != XML_HTML_DOCUMENT_NODE) &&
(cur->content != (xmlChar *) &(cur->properties))) { (cur->content != (xmlChar *) &(cur->properties))) {
DICT_FREE(cur->content) DICT_FREE(cur->content)
} }