kc3-lang/libxml2

2017-06-08T18:25:30

Fix xmlBuildRelativeURI for URIs starting with './' If the relative URI started with './', the 'pos' index was increased which also affected indexing into the base path. Aside from producing wrong results, this could also lead to a heap overread of the base path buffer. The data read from beyond the buffer was only compared to some char values, so this is mostly harmless. Inside libxml2, xmlBuildRelativeURI is only called from xinclude.c. Found with libFuzzer and ASan.