|
030b1f7a
|
2017-06-06T15:53:42
|
|
Revert "Add an XML_PARSE_NOXXE flag to block all entities loading even local"
This reverts commit 2304078555896cf1638c628f50326aeef6f0e0d0.
The new flag doesn't work and the change even broke the XML_PARSE_NONET
option.
|
|
|
897dffba
|
2017-06-06T13:21:14
|
|
Check for integer overflow in memory debug code
Fixes bug 783026.
Thanks to Pranjal Jumde for the report.
|
|
|
932cc989
|
2017-06-03T02:01:29
|
|
Fix buffer size checks in xmlSnprintfElementContent
xmlSnprintfElementContent failed to correctly check the available
buffer space in two locations.
Fixes bug 781333 (CVE-2017-9047) and bug 781701 (CVE-2017-9048).
Thanks to Marcel Böhme and Thuan Pham for the report.
|
|
|
e2663054
|
2017-06-05T15:37:17
|
|
Fix handling of parameter-entity references
There were two bugs where parameter-entity references could lead to an
unexpected change of the input buffer in xmlParseNameComplex and
xmlDictLookup being called with an invalid pointer.
Percent sign in DTD Names
=========================
The NEXTL macro used to call xmlParserHandlePEReference. When parsing
"complex" names inside the DTD, this could result in entity expansion
which created a new input buffer. The fix is to simply remove the call
to xmlParserHandlePEReference from the NEXTL macro. This is safe because
no users of the macro require expansion of parameter entities.
- xmlParseNameComplex
- xmlParseNCNameComplex
- xmlParseNmtoken
The percent sign is not allowed in names, which are grammatical tokens.
- xmlParseEntityValue
Parameter-entity references in entity values are expanded but this
happens in a separate step in this function.
- xmlParseSystemLiteral
Parameter-entity references are ignored in the system literal.
- xmlParseAttValueComplex
- xmlParseCharDataComplex
- xmlParseCommentComplex
- xmlParsePI
- xmlParseCDSect
Parameter-entity references are ignored outside the DTD.
- xmlLoadEntityContent
This function is only called from xmlStringLenDecodeEntities and
entities are replaced in a separate step immediately after the function
call.
This bug could also be triggered with an internal subset and double
entity expansion.
This fixes bug 766956 initially reported by Wei Lei and independently by
Chromium's ClusterFuzz, Hanno Böck, and Marco Grassi. Thanks to everyone
involved.
xmlParseNameComplex with XML_PARSE_OLD10
========================================
When parsing Names inside an expanded parameter entity with the
XML_PARSE_OLD10 option, xmlParseNameComplex would call xmlGROW via the
GROW macro if the input buffer was exhausted. At the end of the
parameter entity's replacement text, this function would then call
xmlPopInput which invalidated the input buffer.
There should be no need to invoke GROW in this situation because the
buffer is grown periodically every XML_PARSER_CHUNK_SIZE characters and,
at least for UTF-8, in xmlCurrentChar. This also matches the code path
executed when XML_PARSE_OLD10 is not set.
This fixes bugs 781205 (CVE-2017-9049) and 781361 (CVE-2017-9050).
Thanks to Marcel Böhme and Thuan Pham for the report.
Additional hardening
====================
A separate check was added in xmlParseNameComplex to validate the
buffer size.
|
|
|
7482f41f
|
2017-06-01T22:00:19
|
|
Check for integer overflow in xmlXPathFormatNumber
Check for overflow before casting double to int.
Found with afl-fuzz and UBSan.
|
|
|
863b5792
|
2017-06-01T17:53:16
|
|
Make Travis print UBSan stacktraces
|
|
|
a2b53178
|
2017-06-01T01:21:27
|
|
Add .travis.yml
For now this is mainly useful if you work on a fork of the libxml2
mirror on GitHub:
https://github.com/GNOME/libxml2
Start with two build setups:
- GCC with as many GNU extensions disabled as possible, trying to
emulate a C89 compiler on a POSIX system.
- clang with ASan and UBSan.
The Python tests don't set an exit code, so Travis won't detect
failures. The same goes for "make tests", but we only run "make check"
anyway.
|
|
|
83212ff4
|
2017-06-01T12:42:03
|
|
Fix expected error output in Python tests
|
|
|
855c19ef
|
2017-06-01T01:04:08
|
|
Avoid reparsing in xmlParseStartTag2
The code in xmlParseStartTag2 must handle the case that the input
buffer was grown and reallocated which can invalidate pointers to
attribute values. Before, this was handled by detecting changes of
the input buffer "base" pointer and, in case of a change, jumping
back to the beginning of the function and reparsing the start tag.
The major problem of this approach is that whether an input buffer is
reallocated is nondeterministic, resulting in seemingly random test
failures. See the mailing list thread "runtest mystery bug: name2.xml
error case regression test" from 2012, for example.
If a reallocation was detected, the code also made no attempts to
continue parsing in case of errors which makes a difference in
the lax "recover" mode.
Now we store the current input buffer "base" pointer for each (not
separately allocated) attribute in the namespace URI field, which isn't
used until later. After the whole start tag was parsed, the pointers
to the attribute values are reconstructed using the offset between the
new and the old input buffer. This relies on arithmetic on dangling
pointers which is technically undefined behavior. But it seems like
the easiest and most efficient fix and a similar approach is used in
xmlParserInputGrow.
This changes the error output of several tests, typically making it
more verbose because we try harder to continue parsing in case of
errors.
(Another possible solution is to check not only the "base" pointer
but the size of the input buffer as well. But this would result in
even more reparsing.)
|
|
|
07b7428b
|
2017-06-01T00:19:14
|
|
Simplify control flow in xmlParseStartTag2
Remove some goto labels and deduplicate a bit of code after handling
namespaces.
Before:
loop {
parseAttribute
if (ok) {
if (defaultNamespace) {
handleDefaultNamespace
if (error)
goto skip_default_ns;
handleDefaultNamespace
skip_default_ns:
freeAttr
nextAttr
continue;
}
if (namespace) {
handleNamespace
if (error)
goto skip_ns;
handleNamespace
skip_ns:
freeAttr
nextAttr;
continue;
}
handleAttr
} else {
freeAttr
}
nextAttr
}
After:
loop {
parseAttribute
if (!ok)
goto next_attr;
if (defaultNamespace) {
handleDefaultNamespace
if (error)
goto next_attr;
handleDefaultNamespace
} else if (namespace) {
handleNamespace
if (error)
goto next_attr;
handleNamespace
} else {
handleAttr
}
next_attr:
freeAttr
nextAttr
}
|
|
|
ac9a4560
|
2017-05-31T19:06:30
|
|
Disable LeakSanitizer when running API tests
The autogenerated API tests leak memory.
|
|
|
ff34ba3e
|
2017-05-31T18:53:45
|
|
Avoid out-of-bound array access in API tests
The API tests combine string buffers with arbitrary length values which
makes ASan detect out-of-bound array accesses. Even without ASan, this
could lead to unwanted test failures.
Add a check for "len", "size", and "start" arguments, assuming they
apply to the nearest char pointer. Skip the test if they exceed the
buffer size. This is a somewhat naive heuristic but it seems to work
well.
|
|
|
34e44567
|
2017-05-31T16:48:27
|
|
Fix undefined behavior in xmlRegExecPushStringInternal
It's stupid, but the behavior of memcpy(NULL, NULL, 0) is undefined.
|
|
|
47496724
|
2017-05-31T16:46:39
|
|
Avoid spurious UBSan errors in parser.c
If available, use a C99 flexible array member to avoid spurious UBSan
errors.
|
|
|
f4029cd4
|
2016-04-21T16:37:26
|
|
Check XPath exponents for overflow
Avoid undefined behavior and wrong results with huge exponents.
Found with afl-fuzz and UBSan.
|
|
|
a58331a6
|
2017-05-29T21:02:21
|
|
Check for overflow in xmlXPathIsPositionalPredicate
Avoid undefined behavior when casting from double to int.
Found with afl-fuzz and UBSan.
|
|
|
a851868a
|
2017-05-29T20:14:42
|
|
Parse small XPath numbers more accurately
Don't count leading zeros towards the fraction size limit. This allows
to parse numbers like
0.0000000000000000000000000000000000000000000000000000000001
which is the only standard-conformant way to represent such numbers, as
scientific notation isn't allowed in XPath 1.0. (It is allowed in XPath
2.0 and in libxml2 as an extension, though.)
Overall accuracy is still bad, see bug 783238.
|
|
|
4bebb030
|
2016-04-21T13:41:09
|
|
Rework XPath rounding functions
Use the C library's floor and ceil functions. The old code was overly
complicated for no apparent reason and could result in undefined
behavior when handling NaNs (found with afl-fuzz and UBSan).
Fix wrong comment in xmlXPathRoundFunction. The implementation was
already following the spec and rounding half up.
|
|
|
43f50f4d
|
2017-05-26T23:01:54
|
|
Fix white space in test output
Quote echoed variable to avoid newlines being converted to space.
|
|
|
40f58521
|
2017-05-26T20:16:35
|
|
Fix axis traversal from attribute and namespace nodes
When traversing the "preceding" axis from an attribute node, we must
first go up to the attribute's containing element. Otherwise, text
children of other attributes could be returned. This made it possible
to hit a code path in xmlXPathNextAncestor which contained another bug:
The attribute node was initialized with the context node instead of the
current node. Normally, this code path is only hit via
xmlXPathNextAncestorOrSelf in which case the current and context node
are the same.
The combination of the two bugs could result in an infinite loop, found
with libFuzzer.
Traversing the "following" and the "preceding" axis from namespace nodes
should be handled similarly. This wasn't supported at all previously.
|
|
|
a07a4e96
|
2017-05-27T17:04:12
|
|
Fix spurious error message
Commit c851970 introduced a spurious error message when evaluating
XPath expressions with xmlXPathCompiledEvalToBoolean.
|
|
|
aed407c1
|
2017-05-25T16:57:14
|
|
Check for trailing characters in XPath expressions earlier
Move the check for trailing characters from xmlXPathEval to
xmlXPathEvalExpr. Otherwise, a valid portion of a syntactically invalid
expression would be evaluated before returning an error.
|
|
|
c851970c
|
2017-05-27T15:26:11
|
|
Rework final handling of XPath results
Move cleanup of XPath stack to xmlXPathFreeParserContext. This avoids
memory leaks if valuePop fails in some error cases. Found with
libFuzzer and ASan.
Rework handling of the final XPath result object in
xmlXPathCompiledEvalInternal and xmlXPathEval to avoid useless error
messages.
|
|
|
640a368c
|
2017-05-27T14:59:49
|
|
Make xmlXPathEvalExpression call xmlXPathEval
Both functions are supposed to do exactly the same.
|
|
|
d6b3645f
|
2017-05-27T14:44:36
|
|
Fix memory leak in xmlCanonicPath
Found with libFuzzer and ASan.
|
|
|
cf60dbe4
|
2017-05-25T16:20:56
|
|
Fix memory leak in xmlXPathCompareNodeSetValue
Implement TODO block to free the arguments in error case.
Found with libFuzzer and ASan.
|
|
|
1f131f11
|
2017-05-24T16:36:33
|
|
Fix memory leak in pattern error path
Found with libFuzzer and ASan.
|
|
|
8627e4ed
|
2017-05-23T18:11:08
|
|
Fix memory leak in parser error path
Triggered in mixed content ELEMENT declarations if there's an invalid
name after the first valid name:
<!ELEMENT para (#PCDATA|a|<invalid>)*>
Found with libFuzzer and ASan.
|
|
|
bd1571cd
|
2017-05-22T00:33:12
|
|
Fix memory leaks in XPointer error paths
Found with libFuzzer and ASan.
|
|
|
9d08b347
|
2017-05-21T16:46:12
|
|
Fix memory leak in xmlXPathNodeSetMergeAndClear
Namespaces nodes must not be duplicated when merging.
Found with libFuzzer and ASan.
|
|
|
95a9249a
|
2017-05-21T15:18:58
|
|
Fix memory leak in XPath filter optimizations
Namespace nodes must be freed when selecting the first or last element
of a node set.
Found with libFuzzer and ASan.
|
|
|
d42a7063
|
2017-05-27T14:58:19
|
|
Fix memory leaks in XPath error paths
Found with libFuzzer and ASan.
|
|
07418011
|
2017-04-05T10:22:40
|
|
Do not leak the new CData node if adding fails
For https://bugzilla.gnome.org/show_bug.cgi?id=780918
|
|
90ccb582
|
2017-04-07T17:43:02
|
|
Prevent unwanted external entity reference
For https://bugzilla.gnome.org/show_bug.cgi?id=780691
* parser.c: add a specific check to avoid PE reference
|
|
5dca9eea
|
2017-04-07T17:13:28
|
|
Increase buffer space for port in HTTP redirect support
For https://bugzilla.gnome.org/show_bug.cgi?id=780690
nanohttp.c: the code wrongly assumed a short int port value.
|
|
23040785
|
2017-04-07T16:45:56
|
|
Add an XML_PARSE_NOXXE flag to block all entities loading even local
For https://bugzilla.gnome.org/show_bug.cgi?id=772726
* include/libxml/parser.h: Add a new parser flag XML_PARSE_NOXXE
* elfgcchack.h, xmlIO.h, xmlIO.c: associated loading routine
* include/libxml/xmlerror.h: new error raised
* xmllint.c: adds --noxxe flag to activate the option
|
|
|
e905f081
|
2016-06-26T12:38:28
|
|
Fix more NULL pointer derefs in xpointer.c
Found with afl-fuzz.
|
|
|
229d1f93
|
2016-08-22T13:21:57
|
|
Avoid function/data pointer conversion in xpath.c
Fixes a `-pedantic` compiler warning.
|
|
|
94613f64
|
2016-08-22T12:16:31
|
|
Remove unused variables
|
|
|
c2545cbb
|
2016-08-22T11:44:18
|
|
Fix format string warnings
Also fixes bug #768199:
https://bugzilla.gnome.org/show_bug.cgi?id=768199
|
|
|
c1d1f712
|
2016-06-28T18:34:52
|
|
Disallow namespace nodes in XPointer ranges
Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.
Found with afl-fuzz.
Fixes CVE-2016-4658.
|
|
|
3f8a9103
|
2016-06-28T15:55:09
|
|
Disallow namespace nodes in XPointer points
|
|
|
9ab01a27
|
2016-06-28T14:22:23
|
|
Fix XPointer paths beginning with range-to
The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.
The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.
Found with afl-fuzz.
Fixes CVE-2016-5131.
|
|
|
a0051993
|
2016-06-28T14:19:58
|
|
Fix comparison with root node in xmlXPathCmpNodes
This change has already been made in xmlXPathCmpNodesExt but not in
xmlXPathCmpNodes.
|
|
31696020
|
2016-05-26T17:38:35
|
|
Fix attribute decoding during XML schema validation
For https://bugzilla.gnome.org/show_bug.cgi?id=766834
vctxt->parserCtxt is always NULL in xmlSchemaSAXHandleStartElementNs,
so this function can't call xmlStringLenDecodeEntities to decode the
entities.
|
|
|
d8083bf7
|
2016-06-25T12:35:50
|
|
Fix NULL pointer deref in XPointer range-to
- Check for errors after evaluating first operand.
- Add sanity check for empty stack.
Found with afl-fuzz.
|
|
|
1fc55ca7
|
2016-06-25T12:35:09
|
|
Don't print generic error messages in XPath tests
|
|
d77e5fc4
|
2016-05-31T21:04:50
|
|
relaxng.c, xmlschemas.c: Fix build on pre-C99 compilers
Make sure that the variables are declared at the top of the block.
https://bugzilla.gnome.org/show_bug.cgi?id=767063
|
|
|
bdec2183
|
2016-05-23T16:04:52
|
|
Release of libxml2-2.9.4
* doc/xml.html libxml.spec.in: updated for the release
* doc/*: regenerated but no API additions
|
|
502f6a6d
|
2016-05-23T14:58:41
|
|
More format string warnings with possible format string vulnerability
For https://bugzilla.gnome.org/show_bug.cgi?id=761029
adds a new xmlEscapeFormatString() function to escape composed format
strings
|
|
|
bdd66182
|
2016-05-23T12:27:58
|
|
Avoid building recursive entities
For https://bugzilla.gnome.org/show_bug.cgi?id=762100
When we detect a recusive entity we should really not
build the associated data, moreover if someone bypass
libxml2 fatal errors and still tries to serialize a broken
entity make sure we don't risk to get ito a recursion
* parser.c: xmlParserEntityCheck() don't build if entity loop
were found and remove the associated text content
* tree.c: xmlStringGetNodeList() avoid a potential recursion
|
|
0bcd05c5
|
2016-03-01T15:18:04
|
|
Heap-based buffer overread in htmlCurrentChar
For https://bugzilla.gnome.org/show_bug.cgi?id=758606
* parserInternals.c:
(xmlNextChar): Add an test to catch other issues on ctxt->input
corruption proactively.
For non-UTF-8 charsets, xmlNextChar() failed to check for the end
of the input buffer and would continuing reading. Fix this by
pulling out the check for the end of the input buffer into common
code, and return if we reach the end of the input buffer
prematurely.
* result/HTML/758606.html: Added.
* result/HTML/758606.html.err: Added.
* result/HTML/758606.html.sax: Added.
* result/HTML/758606_2.html: Added.
* result/HTML/758606_2.html.err: Added.
* result/HTML/758606_2.html.sax: Added.
* test/HTML/758606.html: Added test case.
* test/HTML/758606_2.html: Added test case.
|
|
|
00906759
|
2016-01-26T16:57:03
|
|
Heap-based buffer-underreads due to xmlParseName
For https://bugzilla.gnome.org/show_bug.cgi?id=759573
* parser.c:
(xmlParseElementDecl): Return early on invalid input to fix
non-minimized test case (759573-2.xml). Otherwise the parser
gets into a bad state in SKIP(3) at the end of the function.
(xmlParseConditionalSections): Halt parsing when hitting invalid
input that would otherwise caused xmlParserHandlePEReference()
to recurse unexpectedly. This fixes the minimized test case
(759573.xml).
* result/errors/759573-2.xml: Add.
* result/errors/759573-2.xml.err: Add.
* result/errors/759573-2.xml.str: Add.
* result/errors/759573.xml: Add.
* result/errors/759573.xml.err: Add.
* result/errors/759573.xml.str: Add.
* test/errors/759573-2.xml: Add.
* test/errors/759573.xml: Add.
|
|
|
38eae571
|
2016-03-07T14:04:08
|
|
Heap use-after-free in xmlSAX2AttributeNs
For https://bugzilla.gnome.org/show_bug.cgi?id=759020
* parser.c:
(xmlParseStartTag2): Attribute strings are only valid if the
base does not change, so add another check where the base may
change. Make sure to set 'attvalue' to NULL after freeing it.
* result/errors/759020.xml: Added.
* result/errors/759020.xml.err: Added.
* result/errors/759020.xml.str: Added.
* test/errors/759020.xml: Added test case.
|
|
|
11ed4a7a
|
2016-03-02T15:52:24
|
|
Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral
For https://bugzilla.gnome.org/show_bug.cgi?id=760263
* HTMLparser.c: Add BASE_PTR convenience macro.
(htmlParseSystemLiteral): Store length and start position instead
of a pointer while iterating through the public identifier since
the underlying buffer may change, resulting in a stale pointer
being used.
(htmlParsePubidLiteral): Ditto.
|
|
4472c3a5
|
2016-05-13T15:13:17
|
|
Fix some format string warnings with possible format string vulnerability
For https://bugzilla.gnome.org/show_bug.cgi?id=761029
Decorate every method in libxml2 with the appropriate
LIBXML_ATTR_FORMAT(fmt,args) macro and add some cleanups
following the reports.
|
|
beca86e8
|
2016-05-04T11:23:49
|
|
Detect change of encoding when parsing HTML names
From https://bugzilla.gnome.org/show_bug.cgi?id=758518
Happens when a file has a name getting parsed, but no valid encoding
set, so libxml has to guess what the encoding is. This patch detects
when the buffer location changes, and if it does, restarts the parsing
of the name.
This slightly change a couple of regression tests output
|
|
|
b1d34de4
|
2016-03-14T17:19:44
|
|
Fix inappropriate fetch of entities content
For https://bugzilla.gnome.org/show_bug.cgi?id=761430
libfuzzer regression testing exposed another case where the parser would
fetch content of an external entity while not in validating mode.
Plug that hole
|
|
|
45752d2c
|
2016-03-03T11:50:34
|
|
Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398>
* parser.c:
(xmlParseNCNameComplex): Store start position instead of a
pointer to the name since the underlying buffer may change,
resulting in a stale pointer being used.
* result/errors/759398.xml: Added.
* result/errors/759398.xml.err: Added.
* result/errors/759398.xml.str: Added.
* test/errors/759398.xml: Added test case.
|
|
|
a820dbea
|
2016-03-01T11:34:04
|
|
Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605>
Reviewed by David Kilzer.
* HTMLparser.c:
(htmlParseName): Add bounds check.
(htmlParseNameComplex): Ditto.
* result/HTML/758605.html: Added.
* result/HTML/758605.html.err: Added.
* result/HTML/758605.html.sax: Added.
* runtest.c:
(pushParseTest): The input for the new test case was so small
(4 bytes) that htmlParseChunk() was never called after
htmlCreatePushParserCtxt(), thereby creating a false positive
test failure. Fixed by using a do-while loop so we always call
htmlParseChunk() at least once.
* test/HTML/758605.html: Added.
|
|
|
db07dd61
|
2016-02-12T09:58:29
|
|
Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588>
* parser.c:
(xmlParseEndTag2): Add bounds checks before dereferencing
ctxt->input->cur past the end of the buffer, or incrementing the
pointer past the end of the buffer.
* result/errors/758588.xml: Add test result.
* result/errors/758588.xml.err: Ditto.
* result/errors/758588.xml.str: Ditto.
* test/errors/758588.xml: Add regression test.
|
|
|
cbb27165
|
2016-03-07T06:34:26
|
|
Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711>
* xmlregexp.c:
(xmlFAParseCharRange): Only advance to the next character if
there is no error. Advancing to the next character in case of
an error while parsing regexp leads to an out of bounds access.
|
|
40fd6d2a
|
2016-01-28T14:20:09
|
|
Correct the usage of LDFLAGS
For https://bugzilla.gnome.org/show_bug.cgi?id=761252
It is no longer necessary to save system LDFLAGS when checking
lib specific LDFLAGS.
|
|
|
ebbd2b72
|
2016-05-23T13:58:24
|
|
Revert the use of SAVE_LDFLAGS in configure.ac
For https://bugzilla.gnome.org/show_bug.cgi?id=761252
This reverts commit 7dc24965092d7cc310908d6052913050e88ec072.
|
|
|
c97750d1
|
2016-05-23T13:39:13
|
|
Avoid an out of bound access when serializing malformed strings
For https://bugzilla.gnome.org/show_bug.cgi?id=766414
* xmlsave.c: xmlBufAttrSerializeTxtContent() if an attribute value
is not UTF-8 be more careful when serializing it as we may do an
out of bound access as a result.
|
|
|
886529b5
|
2016-04-05T12:05:25
|
|
Unsigned addition may overflow in xmlMallocAtomicLoc()
For https://bugzilla.gnome.org/show_bug.cgi?id=764616
This code is used only if turning memory allocation debug
in configure with --with-mem-debug, which should never happen
in real life, so not a serious issue.
* xmlmemory.c:
(MAX_SIZE_T): Macro to define maximum value of size_t.
(xmlMallocAtomicLoc): Add bounds check. Fix description and use
the correct function name in another error message.
|
|
48920055
|
2016-05-23T08:59:20
|
|
libxml2 hardcodes -L/lib in zlib/lzma tests which breaks cross-compiles
For https://bugzilla.gnome.org/show_bug.cgi?id=749416
do not use -L$Z_DIR/lib when Z_DIR isn't actually set
|
|
|
9f2416c6
|
2016-05-22T11:14:45
|
|
Add more debugging info to runtest
When there is a failure, indicates what failed instead of just
dumping the tested file name.
|
|
|
5c37382f
|
2016-05-22T09:58:30
|
|
Implement "runtest -u" mode
For https://bugzilla.gnome.org/show_bug.cgi?id=611807
Using "make tests" to add new tests is error prone.
This patch implements a "runtest -u" mode that makes it much
easier to create baselines for new tests.
|
|
|
d433ea6c
|
2016-05-18T14:52:59
|
|
Integer signed/unsigned type mismatch in xmlParserInputGrow()
For https://bugzilla.gnome.org/show_bug.cgi?id=766635
* parserInternals.c:
(xmlParserInputGrow): Change 'ret' type to 'int' to match the
return type of xmlParserInputBufferGrow().
|
|
|
8fbbf551
|
2016-03-08T17:29:00
|
|
Bug 763071: heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071>
* xmlstring.c:
(xmlStrncat): Return NULL if xmlStrlen returns a negative length.
(xmlStrncatNew): Ditto.
|
|
8f30bdff
|
2016-04-15T11:56:55
|
|
Add missing increments of recursion depth counter to XML parser.
For https://bugzilla.gnome.org/show_bug.cgi?id=765207
CVE-2016-3705
The functions xmlParserEntityCheck() and xmlParseAttValueComplex() used to call
xmlStringDecodeEntities() in a recursive context without incrementing the
'depth' counter in the parser context. Because of that omission, the parser
failed to detect attribute recursions in certain documents before running out
of stack space.
|
|
846cf015
|
2016-05-21T17:16:05
|
|
Integer overflow parsing port number in URI
For https://bugzilla.gnome.org/show_bug.cgi?id=765566
in xmlParse3986Port(), uri->port can overflow when parsing a the port number.
The type of uri->port is int, so the consequent behavior is undefined and
may differ between compilers and architectures
|
|
|
8effcb57
|
2016-05-09T10:31:09
|
|
Fix apibuild for a recently added construct
commit c71f9305a99b6aa03cb08fab31106c9c56f1be4f added __XML_EXTERNC
cpp construct which not understood by apibuild, leading to make dist
failures, ask to ignore that construct.
|
|
45f0abd4
|
2016-05-09T10:13:12
|
|
Use pkg-config to locate zlib when possible
For https://bugzilla.gnome.org/show_bug.cgi?id=765979
This fallback to direct detection if not available, but current situation
this is broken for cross compilation
|
|
|
3d75c2e8
|
2016-05-09T10:11:05
|
|
Use pkg-config to locate ICU when possible
For https://bugzilla.gnome.org/show_bug.cgi?id=765979
This fallback to icu-config if not available, but current situation
this is broken for cross compilation
|
|
|
34b35004
|
2016-05-09T09:28:38
|
|
Fix an error with regexp on nullable counted char transition
This is the first of the two issues raised by Pete Cordell
in https://mail.gnome.org/archives/xml/2016-April/msg00030.html
|
|
|
6eb0894a
|
2016-05-05T16:49:00
|
|
Fix memory leak with XPath namespace nodes
Set hasNsNodes to 1 when adding namespace nodes via XP_TEST_HIT.
|
|
|
82b73039
|
2016-04-30T17:53:10
|
|
Fix namespace axis traversal
When the namespace axis is traversed in "toBool" mode, the traversal
can exit early, before visiting all nodes. In this case, the XPath
context still contains a non-NULL tmpNsList.
This means that
- the check when to start a new traversal was wrong and
- the tmpNsList could be leaked.
Fixes bug #750037 and, by accident, bug #756075:
https://bugzilla.gnome.org/show_bug.cgi?id=750037
https://bugzilla.gnome.org/show_bug.cgi?id=756075
|
|
|
9b4b8cb3
|
2016-05-04T12:33:32
|
|
Add a make rule to rebuild for ASAN
|
|
|
b8e0fa34
|
2016-05-04T10:55:49
|
|
Fix null pointer deref in docs with no root element
From https://bugzilla.gnome.org/show_bug.cgi?id=758514
|
|
90da33ce
|
2016-05-03T21:37:52
|
|
Portability to non C99 compliant compilers
OS400 C compiler is not C99 compliant.
It only supports local variable declarations at the beginning of a block.
We loose the const as a result but portability is more important.
|
|
c71f9305
|
2016-05-02T16:21:47
|
|
dict.h: Move xmlDictPtr definition before includes to allow direct inclusion.
|
|
|
f6599c51
|
2016-05-02T22:29:59
|
|
Fix XSD validation of URIs with ampersands
For https://bugzilla.gnome.org/show_bug.cgi?id=709171
This makes xmlSchemaSAXHandleStartElementNs pass attributes through
xmlStringDecodeEntities, similar to how xmlSchemaVDocWalk passes them
through xmlNodeListGetString.
|
|
|
a1dca81d
|
2016-04-11T20:03:19
|
|
xmlschemastypes.c: accept endOfDayFrag Times set to "24:00:00" mean "end of day" and should not cause an error.
|
|
|
b2937710
|
2015-04-21T17:21:49
|
|
os400: tell about xmllint and xmlcatalog in README400.
|
|
|
c04785d5
|
2015-04-21T16:56:54
|
|
os400: properly process SGML add in XMLCATALOG command.
|
|
|
9b5a57cf
|
2015-04-21T13:56:39
|
|
os400: implement CL command XMLCATALOG.
|
|
|
d76abc7b
|
2015-04-20T15:40:00
|
|
os400: compile and install program xmlcatalog (qshell-only).
|
|
|
2137326e
|
2015-04-20T15:00:58
|
|
xmlcatalog: flush stdout before interactive shell input.
|
|
|
cad1634e
|
2015-04-17T17:26:46
|
|
os400: expand tabs in sources, strip trailing blanks.
|
|
|
26db5e7a
|
2015-04-17T17:21:14
|
|
os400: implement CL command XMLLINT.
|
|
|
b1682bdb
|
2015-04-17T17:17:58
|
|
os400: compile and install program xmllint (qshell-only).
|
|
|
1463a91d
|
2015-04-17T17:09:13
|
|
os400: initscript make_module(): Use options instead of positional parameters.
|
|
|
11e805d3
|
2015-04-17T17:02:59
|
|
xmllint: flush stdout before interactive shell input.
|
|
|
44e49f47
|
2015-04-13T14:26:55
|
|
os400: c14n.rpgle: allow *omit for nullable reference parameters.
|
|
|
ae0b2240
|
2015-04-01T19:35:39
|
|
os400: use like() for double type.
|
|
|
155faa52
|
2015-04-01T18:52:37
|
|
os400: use like() for int type.
|
|
|
26202cf9
|
2015-04-01T15:39:45
|
|
os400: use like() for unsigned int type.
|
|
|
91e2e698
|
2015-04-01T15:23:57
|
|
os400: use like() for enum types.
|