1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2026-01-26 21:41:34 +03:00
Commit Graph

22 Commits

Author SHA1 Message Date
David Kilzer
0090675905 Heap-based buffer-underreads due to xmlParseName
For https://bugzilla.gnome.org/show_bug.cgi?id=759573

* parser.c:
(xmlParseElementDecl): Return early on invalid input to fix
non-minimized test case (759573-2.xml).  Otherwise the parser
gets into a bad state in SKIP(3) at the end of the function.
(xmlParseConditionalSections): Halt parsing when hitting invalid
input that would otherwise caused xmlParserHandlePEReference()
to recurse unexpectedly.  This fixes the minimized test case
(759573.xml).

* result/errors/759573-2.xml: Add.
* result/errors/759573-2.xml.err: Add.
* result/errors/759573-2.xml.str: Add.
* result/errors/759573.xml: Add.
* result/errors/759573.xml.err: Add.
* result/errors/759573.xml.str: Add.
* test/errors/759573-2.xml: Add.
* test/errors/759573.xml: Add.
2016-05-23 15:01:07 +08:00
Pranjal Jumde
38eae57111 Heap use-after-free in xmlSAX2AttributeNs
For https://bugzilla.gnome.org/show_bug.cgi?id=759020

* parser.c:
(xmlParseStartTag2): Attribute strings are only valid if the
base does not change, so add another check where the base may
change.  Make sure to set 'attvalue' to NULL after freeing it.
* result/errors/759020.xml: Added.
* result/errors/759020.xml.err: Added.
* result/errors/759020.xml.str: Added.
* test/errors/759020.xml: Added test case.
2016-05-23 15:01:07 +08:00
Pranjal Jumde
45752d2c33 Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398>
* parser.c:
(xmlParseNCNameComplex): Store start position instead of a
pointer to the name since the underlying buffer may change,
resulting in a stale pointer being used.
* result/errors/759398.xml: Added.
* result/errors/759398.xml.err: Added.
* result/errors/759398.xml.str: Added.
* test/errors/759398.xml: Added test case.
2016-05-23 15:01:07 +08:00
David Kilzer
db07dd613e Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588>
* parser.c:
(xmlParseEndTag2): Add bounds checks before dereferencing
ctxt->input->cur past the end of the buffer, or incrementing the
pointer past the end of the buffer.

* result/errors/758588.xml: Add test result.
* result/errors/758588.xml.err: Ditto.
* result/errors/758588.xml.str: Ditto.
* test/errors/758588.xml: Add regression test.
2016-05-23 15:01:07 +08:00
Daniel Veillard
a7a94612aa Heap-based buffer overread in xmlNextChar
For https://bugzilla.gnome.org/show_bug.cgi?id=759671

when the end of the internal subset isn't properly detected
xmlParseInternalSubset should just return instead of trying
to process input further.
2016-02-09 12:55:29 +01:00
Daniel Veillard
f1063fdbe7 CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
For https://bugzilla.gnome.org/show_bug.cgi?id=756525
handle properly the case where we popped out of the current entity
while processing a start tag
Reported by Kostya Serebryany @ Google

This slightly modifies the output of 754946 in regression tests
2015-11-20 16:06:59 +08:00
Daniel Veillard
4a5d80aded Fix a bug in CData error handling in the push parser
For https://bugzilla.gnome.org/show_bug.cgi?id=754947

The checking function was returning incorrect args in some cases
Adds the test to teh reg suite and fix one of the existing test output
2015-09-18 15:06:46 +08:00
Daniel Veillard
51f02b0a03 Fix a bug on name parsing at the end of current input buffer
For https://bugzilla.gnome.org/show_bug.cgi?id=754946

When hitting the end of the current input buffer while parsing
a name we could end up loosing the beginning of the name, which
led to various issues.
2015-09-15 16:50:32 +08:00
Daniel Veillard
e7bf892d8c Improve error reporting on parser errors
The extra string was being dismissed when provided.
* parser.c: handle bot case properly
* result/: this changes a few error reports
2012-07-30 20:09:25 +08:00
Daniel Veillard
4629ee02ac Do not fetch external parsed entities
Unless explicietely asked for when validating or replacing entities
with their value. Problem pointed out by Tom Lane <tgl@redhat.com>

* parser.c: do not load external parsed entities unless needed
* test/errors/extparsedent.xml result/errors/extparsedent.xml*:
  add a regression test to avoid change of the behaviour in the future
2012-07-23 14:15:40 +08:00
Daniel Veillard
d7af555327 rewrite the URI parser to update to rfc3986 (from 2396) removed the error
* uri.c include/libxml/uri.h: rewrite the URI parser to update to
  rfc3986 (from 2396)
* test/errors/webdav.xml result/errors/webdav.xml*: removed the
  error test, 'DAV:' is a correct URI under 3986
* Makefile.am: small cleanup in make check
Daniel

svn path=/trunk/; revision=3763
2008-08-04 15:29:44 +00:00
Daniel Veillard
373345764b added a skipped list, insert rmt-ns10-035 improve 'make check' clean up
* runxmlconf.c: added a skipped list, insert rmt-ns10-035
* Makefile.am: improve 'make check'
* include/libxml/xmlerror.h parser.c: clean up namespace errors
  checking and reporting, errors when a document is labelled
  as UTF-16 while it is parsed as UTF-8 and no encoding was given
  explicitely.
* result/errors/webdav.xml.*: some warnings are no recategorized
  as Namespace errors
Daniel

svn path=/trunk/; revision=3761
2008-07-31 08:20:02 +00:00
Daniel Veillard
c707d0b765 fix a memeory leak in internal subset parsing with a fix from Ashwin add
* parser.c: fix a memeory leak in internal subset parsing with
  a fix from Ashwin
* test/errors/content1.xml result/errors/content1.xml*:
  add test to regressions
Daniel

svn path=/trunk/; revision=3680
2008-01-24 14:48:54 +00:00
Daniel Veillard
da62934715 fixed a parser bug where invalid char in comment may not be detected,
* parser.c: fixed a parser bug where invalid char in comment may
  not be detected, reported by Ashwin Sinha
* test/errors/comment1.xml result/errors/comment1.xml*: added
  the example to the regression suite
Daniel

svn path=/trunk/; revision=3647
2007-08-01 07:49:06 +00:00
Daniel Veillard
b9e5acc490 fix bug #414846 where invalid characters in attributes would sometimes not
* parser.c: fix bug #414846 where invalid characters in attributes
  would sometimes not be detected.
* test/errors/attr4.xml result/errors/attr4.xml*: added a specific
  test case to the regression tests
Daniel

svn path=/trunk/; revision=3634
2007-06-12 13:43:00 +00:00
Daniel Veillard
dcec672439 fix the patch for unreproductable #343000 but also fix a line/column
* parser.c: fix the patch for unreproductable #343000 but
  also fix a line/column keeping error
* result/errors/attr1.xml.err result/errors/attr2.xml.err
  result/errors/name.xml.err result/errors/name2.xml.err
  result/schemas/anyAttr-processContents-err1_0_0.err
  result/schemas/bug312957_1_0.err: affected lines in error output
  of the regression tests
Daniel
2006-10-15 20:32:53 +00:00
William M. Brack
f810de0436 fixed problem with free on dupl attribute in dtd (bug309637). added
* parser.c: fixed problem with free on dupl attribute in
  dtd (bug309637).
* test/errors/attr3.xml, result/errors/attr3.*: added
  regression test for this
2005-07-06 22:48:41 +00:00
Daniel Veillard
3fa5e7e44c fixed a bug failing to detect UTF-8 violations in CData in push mode.
* parser.c: fixed a bug failing to detect UTF-8 violations in
  CData in push mode.
* result/errors/cdata.xml* test/errors/cdata.xml: added the test
  to the regressions
Daniel
2005-07-04 11:12:25 +00:00
Daniel Veillard
b8590d4c1a fixed bug #164556 where non-fatal errors stopped push parsing and
* parser.c: fixed bug #164556 where non-fatal errors stopped
  push parsing and xmlreader.
* Makefile.am: fixup
* test/errors/webdav.xml result/errors/webdav*: adding regression
  test for this problem.
Daniel
2005-01-21 15:10:23 +00:00
Daniel Veillard
4a14fb8fa2 fix from Steve Ball and update of the comment. William pointed out that
* xmlreader.c: fix from Steve Ball and update of the comment.
* Makefile.am result/errors/*.str: William pointed out that
  the streaming error checking part wasn't streaming, fixing
Daniel
2004-06-14 19:58:20 +00:00
Daniel Veillard
37fd307435 fixed a bug where invalid charrefs may not be detected sometimes as
* parser.c: fixed a bug where invalid charrefs may not be detected
  sometimes as pointed by Morus Walter.
* test/errors/charref1.xm result/errors/charref1.xml*: added the
  test in the regression suite.
Daniel
2004-06-03 11:22:31 +00:00
Daniel Veillard
6c662996b6 Beuah ! Daniel
Beuah !
Daniel
2004-02-21 11:55:44 +00:00