|
4b959ee1
|
2022-12-01T13:23:09
|
|
Remove hacky heuristic from b2dc5675e94aa6b5557ba63f7d66b0f08dd17e4d
Checking whether the context is close to the parent context by hardcoding
250 is not portable (I noticed tests were failing on Morello since the value
is 288 there due to pointers being 128 bits). Instead we should ensure
that the XML_VCTXT_USE_PCTXT flag is not set in cases where the user data
is not actually a parser context (or ideally add a separate field but that
would be an ABI break.
From what I can see in the source, the XML_VCTXT_USE_PCTXT is only set if
the userData field points to a valid context, and if this is not the case
the flag should be cleared when changing userData rather than relying on
the offset between the two. Looking at the history, I think
d7cb33cf44aa688f24215c9cd398c1a26f0d25ff fixed most of the need for this
workaround, but it looks like there are a few more locations that need
updating; This commit changes two more places to set/clear/copy the
XML_VCTXT_USE_PCTXT flag, so this heuristic should not be needed anymore.
I've also drop two = NULL assignment in xmllint since this is not needed
after a call to memset().
There was also an uninitialized vctxt.flags (and other fields) in
`xmlShellValidate()`, which I've fixed by adding a memset() call.
|
|
|
c715ded0
|
2022-12-01T12:53:15
|
|
Avoid creating an out-of-bounds pointer by rewriting a check
Creating more than one-past-the-end pointers is undefined behaviour in C
and while this code is unlikely to be miscompiled, I discovered that an
out-of-bounds pointer is being created using UBSan on a CHERI-enabled
system.
|
|
c7a9b85c
|
2022-11-30T17:11:33
|
|
html: Improve parsing of nested lists
Allow ul/ol as immediate children of ul/ol. This is more in line with
the HTML5 spec.
Fixes #447.
|
|
|
e414f825
|
2022-11-25T15:01:22
|
|
html: Fix htmlInitAutoClose documentation
|
|
|
c9367938
|
2022-11-20T19:54:34
|
|
html: Fix check for end of comment in push parser
Make sure to reset checkIndex. Handle case where "--" or "--!" is at the
end of the buffer. Fix "avail" check in htmlParseOrTryFinish.
|
|
|
68a6518c
|
2022-11-15T18:23:33
|
|
parser: Rewrite push parser boundary checks
Remove inaccurate xmlParseCheckTransition check.
Remove non-incremental xmlParseGetLasts check.
Add functions that check for several boundary constructs more
accurately, keeping track of progress in ctxt->checkIndex.
Fixes #439.
|
|
|
6843fc72
|
2022-09-01T02:58:00
|
|
Remove or annotate char casts
|
|
|
2cac6269
|
2022-09-01T03:14:13
|
|
Don't use sizeof(xmlChar) or sizeof(char)
|
|
|
ad338ca7
|
2022-09-01T01:18:30
|
|
Remove explicit integer casts
Remove explicit integer casts as final operation
- in assignments
- when passing arguments
- when returning values
Remove casts
- to the same type
- from certain range-bound values
The main motivation is that these explicit casts don't change the result
of operations and only render UBSan's implicit-conversion checks
useless. Removing these casts allows UBSan to detect cases where
truncation or sign-changes occur unexpectedly.
Document some explicit casts as truncating and add a few missing ones.
|
|
|
65dc8a63
|
2022-09-01T00:13:19
|
|
Make xmlNewSAXParserCtx take a const sax handler
Also improve documentation.
|
|
|
0f568c0b
|
2022-08-26T01:22:33
|
|
Consolidate private header files
Private functions were previously declared
- in header files in the root directory
- in public headers guarded with IN_LIBXML
- in libxml.h
- redundantly in source files that used them.
Consolidate all private header files in include/private.
|
|
|
58fc89e8
|
2022-08-25T20:57:30
|
|
Deprecate internal parser functions
|
|
|
a308c0cd
|
2022-08-25T20:18:16
|
|
Deprecate old HTML SAX API
|
|
|
9a82b94a
|
2022-08-24T04:21:58
|
|
Introduce xmlNewSAXParserCtxt and htmlNewSAXParserCtxt
Add API functions to create a parser context with a custom SAX handler
without having to mess with ctxt->sax manually.
|
|
|
0a04db19
|
2022-08-24T14:06:00
|
|
Don't mess with parser options in htmlParseDocument
Don't set ctxt->html. This member should already be initialized.
Set ctxt->linenumbers in htmlCtxtUseOptions like the XML parser does.
|
|
|
d45263a2
|
2022-08-24T14:04:35
|
|
Remove useless call to htmlDefaultSAXHandlerInit
This function is already called from xmlInitParser.
|
|
|
4b184240
|
2022-08-22T14:11:15
|
|
Remove htmlDefaultSAXHandler from non-SAX1 build
This matches long-standing behavior of the XML counterpart.
|
|
|
80bd34c3
|
2022-08-22T14:06:37
|
|
Don't initialize SAX handler in htmlReadMemory
The SAX handler is already initialized when creating the parser
context.
|
|
|
37cedc0b
|
2022-08-22T14:04:07
|
|
Fix htmlReadMemory mixing up XML and HTML functions
Also see fe6890e2.
|
|
|
920753c4
|
2022-08-22T13:46:50
|
|
Don't use default SAX handler to report unrelated errors
|
|
|
38f04779
|
2022-08-22T13:33:35
|
|
Fix HTML parser with threads and --without-legacy
If the legacy functions are disabled, the default "V1" HTML SAX handler
isn't initialized in threads other than the main thread.
htmlInitParserCtxt would later use the empty V1 SAX handler, resulting
in NULL documents.
Change htmlInitParserCtxt to initialize the HTML SAX handler by calling
xmlSAX2InitHtmlDefaultSAXHandler. This removes the ability to change the
default handler but is more in line with the XML parser which
initializes the SAX handler by calling xmlSAXVersion, ignoring the V1
default handler.
Fixes #399.
|
|
|
5b2d07a7
|
2022-08-20T17:00:50
|
|
Use xmlStrlen in *CtxtReadDoc
xmlStrlen handles buffers larger than INT_MAX more gracefully.
|
|
|
4ad71c2d
|
2022-08-20T16:19:34
|
|
Fix xmlCtxtReadDoc with encoding
xmlCtxtReadDoc used to create an input stream involving
xmlNewStringInputStream. This would create a stream without an input
buffer, causing problems with encodings (see #34).
After commit aab584dc3, an error was returned even with UTF-8 encodings
which happened to work before.
Make xmlCtxtReadDoc call xmlCtxtReadMemory which doesn't suffer from
these issues. Also fix htmlCtxtReadDoc.
Fixes #397.
|
|
|
e986d09c
|
2022-07-15T14:02:26
|
|
Skip incorrectly opened HTML comments
Commit 4fd69f3e fixed handling of '<' characters not followed by an
ASCII letter. But a '<!' sequence followed by invalid characters should
be treated as bogus comment and skipped.
Fixes #380.
|
|
|
6722d22c
|
2022-07-15T13:26:41
|
|
Reduce indentation in HTMLparser.c
No functional change.
|
|
|
a82ea25f
|
2022-07-28T21:35:17
|
|
Also reset nsNr in htmlCtxtReset
|
|
44e9118c
|
2022-04-08T12:33:17
|
|
Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars()
* HTMLparser.c:
(htmlSkipBlankChars):
* parser.c:
(xmlSkipBlankChars):
- Cap the return value at INT_MAX.
- The commit range that OSS-Fuzz listed for the fix didn't make
any changes to xmlSkipBlankChars(), so it seems like this
issue may still exist.
Found by OSS-Fuzz Issue 44803.
|
|
|
40483d0c
|
2022-03-06T13:55:48
|
|
Deprecate module init and cleanup functions
These functions shouldn't be part of the public API. Most init
functions are only thread-safe when called from xmlInitParser. Global
variables should only be cleaned up by calling xmlCleanupParser.
|
|
|
ebb17970
|
2022-03-04T02:31:59
|
|
Remove unneeded #includes
|
|
d7b287b9
|
2021-07-17T14:36:53
|
|
htmlParseComment: handle abruptly-closed comments
See guidance provided on abrutply-closed comments here:
https://html.spec.whatwg.org/multipage/parsing.html#parse-error-abrupt-closing-of-empty-comment
|
|
|
776d15d3
|
2022-03-02T00:29:17
|
|
Don't check for standard C89 headers
Don't check for
- ctype.h
- errno.h
- float.h
- limits.h
- math.h
- signal.h
- stdarg.h
- stdlib.h
- string.h
- time.h
Stop including non-standard headers
- malloc.h
- strings.h
|
|
|
4fd69f3e
|
2022-02-22T18:15:53
|
|
Fix recovery from invalid HTML start tags
Only try to parse a start tag if there's a '<' followed by an ASCII
letter. This is more in line with HTML5 and the old behavior in
recovery mode. Emit a literal '<' if the following character is
invalid.
Fixes #101.
Fixes #339.
|
|
|
346c3a93
|
2022-02-20T18:46:42
|
|
Remove elfgcchack.h
The same optimization can be enabled with -fno-semantic-interposition
since GCC 5. clang has always used this option by default.
|
|
|
d7cb33cf
|
2022-01-13T17:06:14
|
|
Rework validation context flags
Use a bitmask instead of magic values to
- keep track whether the validation context is part of a parser context
- keep track whether xmlValidateDtdFinal was called
This allows to add addtional flags later.
Note that this deliberately changes the name of a public struct member,
assuming that this was always private data never to be used by client
code.
|
|
|
96dc7f4a
|
2022-02-01T16:15:51
|
|
Also register HTML document nodes
Fixes #196.
|
|
fe6890e2
|
2021-07-27T13:20:20
|
|
Fix htmlReadFd, which was using a mix of xml and html context functions
|
|
e7d1c53a
|
2021-07-14T11:32:57
|
|
Fix memory leak in xmlFreeParserInputBuffer
Found by Coverity.
https://bugzilla.redhat.com/show_bug.cgi?id=1938806
|
|
|
798bdf13
|
2022-01-10T14:50:20
|
|
Different approach to fix quadratic behavior in HTML push parser
The old approach introduced a regression, see issue #312 and the
previous commit. Disable code that tries to recover from invalid start
tags. This only affects "recovery" mode.
Add a comment outlining a better fix in accordance with the HTML5 spec.
|
|
|
094fc08a
|
2022-01-10T14:02:10
|
|
Fix regression when parsing invalid HTML tags in push mode
Revert part of commit 173a0830 that changed behavior when parsing
malformed start tags with the push parser. This reintroduces quadratic
behavior in recovery mode which will be worked around in the next
commit.
Fixes #312.
|
|
|
2732b234
|
2022-01-10T13:32:14
|
|
Fix regression parsing public IDs literals in HTML
Fix regression introduced when reworking htmlParsePubidLiteral in
commit 93ce33c2.
Fixes #318.
|
|
|
7279d236
|
2021-05-06T10:37:07
|
|
Fix htmlTagLookup
Fix regression introduced with b25acce8. Some users like libxslt may
call the HTML output functions on documents with uppercase tag names,
so we must keep case-insensitive string comparison.
Fixes #248.
|
|
|
683de7ef
|
2021-03-04T19:06:04
|
|
Fix duplicate xmlStrEqual calls in htmlParseEndTag
|
|
|
8095365b
|
2021-03-04T18:46:11
|
|
Speed up htmlCheckAutoClose
Switch to binary search.
|
|
|
b25acce8
|
2021-03-04T17:44:45
|
|
Speed up htmlTagLookup
Switch to binary search. This is the first time bsearch is used in the
libxml2 code base. But it's a standard library function since C89 and
should be portable.
|
|
|
0fb3ae58
|
2021-02-22T17:31:05
|
|
Revert "Improve HTML fuzzer stability"
This reverts commit de1b51eddcc17fd7ed1bbcc6d5d7d529407dfbe2.
|
|
|
de1b51ed
|
2021-02-22T12:25:29
|
|
Improve HTML fuzzer stability
Call htmlInitAutoClose during fuzzer initialization to fix stability
issue. Leave a note concerning problems with this function.
|
|
|
dcb80b92
|
2021-02-20T20:30:43
|
|
Fix slow parsing of HTML with encoding errors
Under certain circumstances, the HTML parser would try to guess and
switch input encodings multiple times, leading to slow processing of
documents with encoding errors. The repeated scanning of the input
buffer when guessing encodings could even lead to quadratic behavior.
The code htmlCurrentChar probably assumed that if there's an encoding
handler, it is guaranteed to produce valid UTF-8. This holds true in
general, but if the detected encoding was "UTF-8", the UTF8ToUTF8
encoding handler simply invoked memcpy without checking for invalid
UTF-8. This still must be fixed, preferably by not using this handler
at all.
Also leave a note that switching encodings twice seems impossible to
implement correctly. Add a check when handling UTF-8 encoding errors
in htmlCurrentChar to avoid this situation, even if encoders produce
invalid UTF-8.
Found by OSS-Fuzz.
|
|
|
954696e7
|
2021-02-07T13:23:09
|
|
Fix infinite loop in HTML parser introduced with recent commits
Check for XML_PARSER_EOF to avoid an infinite loop introduced with
recent changes to the HTML push parser.
Found by OSS-Fuzz.
|
|
|
a67b63d1
|
2020-10-11T14:15:37
|
|
use new htmlParseLookupCommentEnd to find comment ends
Note that the caret in error messages generated during comment parsing
may have moved by one byte.
See guidance provided on incorrectly-closed comments here:
https://html.spec.whatwg.org/multipage/parsing.html#parse-error-incorrectly-closed-comment
|
|
|
29f5d20e
|
2020-08-03T17:36:05
|
|
htmlParseComment: treat `--!>` as if it closed the comment
See guidance provided on incorrectly-closed comments here:
https://html.spec.whatwg.org/multipage/parsing.html#parse-error-incorrectly-closed-comment
|
|
|
94c2e415
|
2020-12-06T16:38:00
|
|
Fix quadratic runtime in HTML push parser with null bytes
Null bytes in the input stream do not necessarily signal an EOF
condition. Check the stream pointers for EOF to avoid quadratic
rescanning of input data.
Note that the CUR_CHAR macro used in functions like htmlParseCharData
calls htmlCurrentChar which translates null bytes.
Found by OSS-Fuzz.
|
|
|
438e595a
|
2020-08-09T14:43:53
|
|
Stop counting nbChars in parser context
The value was inaccurate and never used.
|
|
|
f6a9541f
|
2020-08-09T14:29:35
|
|
Remove unneeded progress checks in HTML parser
The HTML parser should now be guaranteed to make progress, so the
checks became unnecessary.
|
|
|
93ce33c2
|
2020-07-23T17:34:08
|
|
Fix several quadratic runtime issues in HTML push parser
Fix a few remaining cases where the HTML push parser would scan more
content during lookahead than being parsed later.
Make sure that htmlParseDocTypeDecl consumes all content up to the
final '>' in case of errors. The old comment said "We shouldn't try to
resynchronize", but ignoring invalid content is also what the HTML5
spec mandates.
Likewise, make htmlParseEndTag skip to the final '>' in invalid end
tags even if not in recovery mode. This is probably the most visible
change in practice and leads to different output for some tests but is
also more in line with HTML5.
Make sure that htmlParsePI and htmlParseComment don't abort if invalid
characters are encountered but log an error and ignore the character.
Change some other end-of-buffer checks to test for a zero byte instead
of relying on IS_CHAR.
Fix usage of IS_CHAR macro in htmlParseScript.
|
|
|
173a0830
|
2020-07-22T23:15:35
|
|
Fix quadratic runtime when push parsing HTML start tags
Make sure that htmlParseStartTag doesn't terminate on characters for
which IS_CHAR_CH is false like control chars.
In htmlParseTryOrFinish, only switch to START_TAG if the next character
starts a valid name. Otherwise, htmlParseStartTag might return without
consuming all characters up to the final '>'.
Found by OSS-Fuzz.
|
|
|
6995eed0
|
2020-07-19T13:54:52
|
|
Fix quadratic runtime when push parsing HTML entity refs
The HTML push parser would look ahead for characters in "; >/" to
terminate an entity reference but actual parsing could stop earlier,
potentially resulting in quadratic runtime.
Parse char data and references alternately in htmlParseTryOrFinish
and only look ahead once for a terminating '<' character.
Found by OSS-Fuzz.
|
|
|
8e219b15
|
2020-07-12T21:43:44
|
|
Fix HTML push parser lookahead
The parsing rules when looking for terminating chars or sequences in
the push parser differed from the actual parsing code. This could
result in the lookahead to overshoot and data being rescanned,
potentially leading to quadratic runtime.
Comments must never be handled during lookahead. Attribute values must
only be skipped for start tags and doctype declarations, not for end
tags, comments, PIs and script content.
|
|
|
e050062c
|
2020-07-15T14:38:55
|
|
Make htmlCurrentChar always translate U+0000
The general assumption is that htmlCurrentChar only returns 0 if the
end of the input buffer is reached. The UTF-8 path already logged an
error if a zero byte U+0000 was found and returned a space character
instead. Make the ASCII code path do the same.
htmlParseTryOrFinish skips zero bytes at the beginning of a buffer, so
even if 0 was returned from htmlCurrentChar, the push parser would make
progress. But rescanning the input could cause performance problems.
The pull parser would abort parsing and now handles zero bytes in ASCII
mode the same way as the push parser or as in UTF-8 mode.
It would be better to return the replacement character U+FFFD instead,
but some of the client code assumes that the UTF-8 length of input and
output matches.
|
|
|
dfd4e330
|
2020-07-15T14:22:08
|
|
Rework control flow in htmlCurrentChar
Don't call xmlCurrentChar after switching encodings. Rearrange code
blocks and fall through to normal UTF-8 handling.
|
|
|
1493130e
|
2020-07-15T12:54:25
|
|
Fix UTF-8 decoder in HTML parser
Reject sequences starting with a continuation byte as well as overlong
sequences like the XML parser.
Also fixes an infinite loop in connection with previous commit 50078922
since htmlCurrentChar would return 0 even if not at the end of the
buffer.
Found by OSS-Fuzz.
|
|
|
50078922
|
2020-07-12T20:28:47
|
|
Fix quadratic runtime when parsing HTML script content
If htmlParseScript returns upon hitting an invalid character,
htmlParseLookupSequence will be called again with checkIndex reset to
zero, potentially resulting in quadratic runtime. Make sure that
htmlParseScript consumes all input in one go and simply skips over
invalid characters similar to htmlParseCharDataInternal.
Found by OSS-Fuzz.
|
|
|
3f18e748
|
2020-07-11T14:34:57
|
|
Reset HTML parser input before reporting error
Avoid use-after-free, similar to 13ba5b61. Also make sure that
xmlBufSetInputBaseCur sets valid pointers in case of buffer errors.
Found by OSS-Fuzz.
|
|
|
3da8d947
|
2020-07-09T16:08:38
|
|
Fix more quadratic runtime issues in HTML push parser
Make sure that checkIndex is set when returning without match from
inside a comment. Also track parser state in htmlParseLookupChars.
Found by OSS-Fuzz.
|
|
|
741b0d0a
|
2020-07-07T12:54:34
|
|
Fix regression introduced with 477c7f6a
The 'inSubset' member is actually used by the SAX2 handlers. Store
extra parser state in 'hasPErefs'.
|
|
|
477c7f6a
|
2020-06-28T15:54:23
|
|
Fix quadratic runtime in HTML parser
Commit eeb99329 removed an important optimization avoiding quadratic
runtime when repeatedly scanning the input buffer for terminating
characters in the HTML push parser. The related bug is
https://bugzilla.gnome.org/show_bug.cgi?id=444994
Make sure that ctxt->checkIndex is always written and store additional
parser state in ctxt->inSubset which is unused in the HTML parser.
Found by OSS-Fuzz.
|
|
|
13ba5b61
|
2020-06-28T13:16:46
|
|
Reset HTML parser input before reporting encoding error
If charset conversion fails, reset the input pointers before reporting
the error and bailing out. Otherwise, the input pointers are left in an
invalid state which could lead to use-after-free and other memory
errors.
Similar to f9e7997e. Found by OSS-Fuzz.
|
|
|
681f094e
|
2020-06-15T15:23:05
|
|
Fix unsigned integer overflow in htmlParseTryOrFinish
Cast to signed type before subtraction to avoid unsigned integer
overflow. Also use ptrdiff_t to avoid potential integer truncation.
Found with libFuzzer and UBSan.
|
|
|
31ca4a72
|
2020-06-15T18:47:53
|
|
Fix integer overflow in htmlParseCharRef
Fixes #115.
|
|
|
20c60886
|
2020-03-08T17:19:42
|
|
Fix typos
Resolves #133.
|
|
|
f9f8df0a
|
2019-10-03T04:15:52
|
|
Fix uninitialized memory access in HTML parser
The SAX2 character handler expects NULL-terminated buffer.
Closes #106.
Also see https://github.com/lxml/lxml/pull/288
|
|
2a350ee9
|
2019-09-30T17:04:54
|
|
Large batch of typo fixes
Closes #109.
|
|
|
dbc6b55b
|
2019-05-16T21:06:56
|
|
Fix warnings when compiling without reader or push parser
|
|
|
60173c82
|
2018-09-11T14:08:39
|
|
Reset HTML parser input pointers on encoding failure
Call xmlBufResetInput before bailing out if switching the encoding
fails. Otherwise, the input pointers could be left in an invalid state.
Similar to commit f9e7997e803457b714352c4d51a96104ae298d94 for the
XML parser.
Thanks to Yunho Kim for the report.
Closes: #27
|
|
35e83488
|
2018-04-18T15:58:42
|
|
HTML noscript should not close p
For https://bugzilla.gnome.org/show_bug.cgi?id=795343
- HTMLparser.c: noscript should not close <p> but it should close <script>
|
|
|
7a1bd7f6
|
2018-03-17T00:03:24
|
|
Revert "Change calls to xmlCharEncInput to set flush false"
This reverts commit 6e6ae5daa6cd9640c9a83c1070896273e9b30d14 which
broke decoding of larger documents with ICU.
See https://bugs.chromium.org/p/chromium/issues/detail?id=820163
|
|
6e6ae5da
|
2018-01-02T21:47:35
|
|
Change calls to xmlCharEncInput to set flush false when not final call. Having flush incorrectly set to true causes errors for ICU.
|
|
|
cb5541c9
|
2017-11-13T17:08:38
|
|
Fix libz and liblzma detection
If libz or liblzma are detected with pkg-config, AC_CHECK_HEADERS must
not be run because the correct CPPFLAGS aren't set. It is actually not
required have separate checks for LIBXML_ZLIB_ENABLED and HAVE_ZLIB_H.
Only check for LIBXML_ZLIB_ENABLED and remove HAVE_ZLIB_H macro.
Fixes bug 764657, bug 787041.
|
|
|
e03f0a19
|
2017-11-09T16:42:47
|
|
Fix hash callback signatures
Make sure that all parameters and return values of hash callback
functions exactly match the callback function type. This is required
to pass clang's Control Flow Integrity checks and to allow compilation
to asm.js with Emscripten.
Fixes bug 784861.
|
|
|
576912fa
|
2017-06-17T15:59:13
|
|
Make HTML parser functions take const pointers
The 'cur' parameter of htmlParseDoc and htmlSAXParseDoc should be
'const xmlChar *'.
Fixes bug 770650.
|
|
|
0b2d5c48
|
2017-06-12T19:10:04
|
|
Initialize keepBlanks in HTML parser
This caused failures in the HTML push tests but the fix required to
change the expected output of the HTML SAX tests.
|
|
|
9a366a37
|
2017-06-11T12:40:01
|
|
Fix compiler warning in htmlParseElementInternal
|
|
|
f39e3be0
|
2017-06-11T12:35:59
|
|
Fix sanity check in htmlParseNameComplex
- (cur - len) can overflow.
- Throw an internal error.
Fixes bug 780077.
|
|
11ed4a7a
|
2016-03-02T15:52:24
|
|
Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral
For https://bugzilla.gnome.org/show_bug.cgi?id=760263
* HTMLparser.c: Add BASE_PTR convenience macro.
(htmlParseSystemLiteral): Store length and start position instead
of a pointer while iterating through the public identifier since
the underlying buffer may change, resulting in a stale pointer
being used.
(htmlParsePubidLiteral): Ditto.
|
|
|
4472c3a5
|
2016-05-13T15:13:17
|
|
Fix some format string warnings with possible format string vulnerability
For https://bugzilla.gnome.org/show_bug.cgi?id=761029
Decorate every method in libxml2 with the appropriate
LIBXML_ATTR_FORMAT(fmt,args) macro and add some cleanups
following the reports.
|
|
beca86e8
|
2016-05-04T11:23:49
|
|
Detect change of encoding when parsing HTML names
From https://bugzilla.gnome.org/show_bug.cgi?id=758518
Happens when a file has a name getting parsed, but no valid encoding
set, so libxml has to guess what the encoding is. This patch detects
when the buffer location changes, and if it does, restarts the parsing
of the name.
This slightly change a couple of regression tests output
|
|
|
a820dbea
|
2016-03-01T11:34:04
|
|
Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605>
Reviewed by David Kilzer.
* HTMLparser.c:
(htmlParseName): Add bounds check.
(htmlParseNameComplex): Ditto.
* result/HTML/758605.html: Added.
* result/HTML/758605.html.err: Added.
* result/HTML/758605.html.sax: Added.
* runtest.c:
(pushParseTest): The input for the new test case was so small
(4 bytes) that htmlParseChunk() was never called after
htmlCreatePushParserCtxt(), thereby creating a false positive
test failure. Fixed by using a do-while loop so we always call
htmlParseChunk() at least once.
* test/HTML/758605.html: Added.
|
|
bb654feb
|
2016-04-13T16:56:07
|
|
Fix typos: dictio{ nn -> n }ar{y,ies}
Signed-off-by: Jan Pokorný <jpokorny@redhat.com>
|
|
8fb4a770
|
2015-11-20T17:16:06
|
|
CVE-2015-8242 Buffer overead with HTML parser in push mode
For https://bugzilla.gnome.org/show_bug.cgi?id=756372
Error in the code pointing to the codepoint in the stack for the
current char value instead of the pointer in the input that the SAX
callback expects
Reported and fixed by Hugh Davenport
|
|
|
e724879d
|
2015-10-30T21:14:55
|
|
Fix parsing short unclosed comment uninitialized access
For https://bugzilla.gnome.org/show_bug.cgi?id=746048
The HTML parser was too optimistic when processing comments and
didn't check for the end of the stream on the first 2 characters
|
|
|
140c251e
|
2015-06-30T11:36:28
|
|
Recover unescaped less-than character in HTML recovery parsing
As pointed by Christian Schoenebeck <schoenebeck@crudebyte.com>
on the list and based on some of his early patches, this preserve
content when unescaped opening angle brackets are not escaped in
textual content like:
<p> a < b </p>
<p> a <0 </p>
<p> a <=0 </p>
while still reporting the error.
|
|
|
292a9f29
|
2014-10-06T18:51:04
|
|
Possible overflow in HTMLParser.c
For https://bugzilla.gnome.org/show_bug.cgi?id=720615
make sure that the encoding string passed is of reasonable size
|
|
579ebbcb
|
2014-06-20T21:03:42
|
|
HTMLparser: Correctly initialise a stack allocated structure
If not initialised, the ‘node’ member remains undefined.
Coverity issue: #60466
https://bugzilla.gnome.org/show_bug.cgi?id=731990
|
|
3e0eec43
|
2014-06-13T14:45:20
|
|
Adding some missing NULL checks
in SAX2 DOM building code and in the HTML parser
|
|
|
b0c7e7e5
|
2014-02-06T10:50:35
|
|
Fix an typo 'onrest' in htmlScriptAttributes
As pointed out by "Laurent <guitarneck@free.fr>"
|
|
|
4e1476c5
|
2013-12-09T15:23:40
|
|
adding init calls to xml and html Read parsing entry points
As pointed out by "Tassyns, Bram <BramT@enfocus.com>" on the list
some call had it other didn't, clean it up and add to all missing
ones
|
|
826bc320
|
2013-11-29T14:12:12
|
|
Fix HTML push parser to accept HTML_PARSE_NODEFDTD
For https://bugzilla.gnome.org/show_bug.cgi?id=719515
fixes htmlParseTryOrFinish to interpret HTML_PARSE_NODEFDTD,
and updates xmllint to actually pass --nodefdtd to the push
version of the HTML parser
|
|
|
bf058dce
|
2013-02-13T18:19:42
|
|
Fix the flushing out of raw buffers on encoding conversions
https://bugzilla.gnome.org/show_bug.cgi?id=692915
the new set of converting functions tried to limit the encoding
conversion of the raw buffer to the consumption one to work in
a more progressive fashion. Unfortunately this was bad for
performances and led to errors on progressive parsing when
a very large chunk was close to the end of the document. Fix
the new internal function and switch back to the old way of
converting. Fix another bug in the process.
|
|
|
de0cc20c
|
2013-02-12T16:55:34
|
|
Fix some buffer conversion issues
https://bugzilla.gnome.org/show_bug.cgi?id=690202
Buffer overflow errors originating from xmlBufGetInputBase in 2.9.0
The pointers from the context input were not properly reset after
that call which can do reallocations.
|
|
|
f8e3db04
|
2012-09-11T13:26:36
|
|
Big space and tab cleanup
Remove all space before tabs and space and tabs at end of lines.
|
|
|
f933c898
|
2012-09-07T19:32:12
|
|
Keep non-significant blanks node in HTML parser
For https://bugzilla.gnome.org/show_bug.cgi?id=681822
Regardless if the option HTML_PARSE_NOBLANKS is set or not, blank nodes
are removed from a HTML document, for example:
<html>
<head>
<title>This is a test.</title>
</head>
<body>
<p>This is a test.</p>
</body>
</html>
is read as:
<html><head><title>This is a test.</title></head><body>
<p>This is a test.</p>
</body></html>
This changes the default behaviour but the old behaviour is available
as expected when using the parser flag HTML_PARSE_NOBLANKS
Based on original patch from Igor Ignatyuk <igor_ignatiouk@hotmail.com>
* HTMLparser.c: change various places in the parser where ignorable_space
SAX callback was called without checking for the parser flag preference
* xmllint.c: make sure we use the new flag even for HTML parsing
* result/HTML/*: this modifies the output of a number of tests
|