The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.
The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.
Found with afl-fuzz.
Fixes CVE-2016-5131.
* HTMLparser.c parser.c SAX2.c debugXML.c tree.c valid.c xmlreader.c
xmllint.c include/libxml/HTMLparser.h include/libxml/parser.h:
added a parser XML_PARSE_COMPACT option to allocate small
text nodes (less than 8 bytes on 32bits, less than 16bytes on 64bits)
directly within the node, various changes to cope with this.
* result/XPath/tests/* result/XPath/xptr/* result/xmlid/*: this
slightly change the output
Daniel
* check-xinclude-test-suite.py: improved the script accordingly
to the XInclude regression tests updates
* xpointer.c: Implemented XPointer element() Scheme W3C PR of 13
November 2002
* result/XPath/xptr/chapterschildseq result/XPath/xptr/vidchildseq
test/XPath/xptr/chapterschildseq test/XPath/xptr/vidchildseq:
augmented the Xpointer testsuite for the element() scheme
Daniel
- HTMLparser.c: some fixes on auto-open of html/head/body
- encoding.c: fixed a compilation error on some gcc env
- xpath.c xpointer.[ch] xpathInternals.h: improved the
XPointer implementation
- test/XPath/xptr/strpoint test/XPath/xptr/strrange3: added
related XPointer tests and associated results
Daniel
- xpointer.c: added support for the 2 extra parameters of
string-range, fixed a stoopid error when '0' was present
in XPointer expressions
- test/XPath/xptr/strrange2 result/XPath/xptr/strrange2: added
testsuite for the above
Daniel
- xpath.c xpointer.c: XPointer reorder of ranges start/end and
string-range for empty strings
- test/XPath/docs/str test/XPath/xptr/chaptersrange
test/XPath/xptr/strrange: augmented the XPointer testsuite
Daniel
- testXPath.c xpath.[ch]: moved some debug functions to xpath core
- xpointer.c: implemented string-range() at least a good first version
- test/XPath/docs/str test/XPath/xptr/strrange
result/XPath/xptr/strrange: the string-range() tests
Daniel
Added XPointer:
- configure.in Makefile.am include/makefile.am: adding XPointer
and XPtrtests target
- xpointer.[ch] : new files for XPointer support
- test/XPath/xptr result/XPath/xptr: added XPointer testsuite and
more XPath tests
Daniel
