kmx git

Commit	Date	Message
652dd12a	2022-02-08T03:29:24	[CVE-2022-23308] Use-after-free of ID and IDREF attributes If a document is parsed with XML_PARSE_DTDVALID and without XML_PARSE_NOENT, the value of ID attributes has to be normalized after potentially expanding entities in xmlRemoveID. Otherwise, later calls to xmlGetID can return a pointer to previously freed memory. ID attributes which are empty or contain only whitespace after entity expansion are affected in a similar way. This is fixed by not storing such attributes in the ID table. The test to detect streaming mode when validating against a DTD was broken. In connection with the defects above, this could result in a use-after-free when using the xmlReader interface with validation. Fix detection of streaming mode to avoid similar issues. (This changes the expected result of a test case. But as far as I can tell, using the XML reader with XIncludes referencing the root document never worked properly, anyway.) All of these issues can result in denial of service. Using xmlReader with validation could result in disclosure of memory via the error channel, typically stderr. The security impact of xmlGetID returning a pointer to freed memory depends on the application. The typical use case of calling xmlGetID on an unmodified document is not affected.
d19bab68	2022-02-19T19:26:10	Fix fuzz/.gitignore after fixing VPATH build
f2ad86fa	2022-02-17T19:05:26	Remove SVN keyword anchors
b041d829	2022-02-16T19:55:30	Remove xmlwin32version.h This file was undocumented and never used anywhere. Maybe users were supposed to rename this file to xmlversion.h manually. These days, both CMake and win32/configure.js generate xmlversion.h from xmlversion.h.in, just like the Autotools build.
176115c6	2022-02-14T22:49:04	Fix source URL in libxml.spec.in
86266487	2022-02-14T18:06:38	Fix fuzzer test with VPATH build Also fixes make distcheck.
85a35ba0	2022-02-14T17:44:29	Support custom prefix when installing Python module Also fixes make distcheck.
46084436	2022-02-14T03:28:51	Remove Makefile.win A Makefile for Visual C++ 5.0, last changed 23 years ago.
a20a6022	2022-02-14T03:40:59	Fix distribution after README change
411f9803	2022-02-14T01:30:37	Rework README - Merge INSTALL.libxml2, CONTRIBUTING and AUTHORS into README - Convert to Markdown - Redact and update content - Update links
e16d729d	2022-02-14T01:31:47	Remove README.cvs-commits
8eb06937	2022-02-14T01:01:23	Remove outdated ChangeLog code The ChangeLog is from pre-Git times.
7fe9addc	2022-02-13T23:29:51	Remove CVS and SVN-related code
4a0c0e63	2022-02-13T22:52:14	Remove MAINTAINERS Maintainers are listed in libxml2.doap.
b0e6eb97	2022-02-13T22:51:26	Remove xmltutorial.pdf We already have an HTML version.
10891111	2022-02-13T22:52:53	Redirect links to xmlsoft.org Documentation and releases are now available on gitlab.gnome.org.
4f2693a1	2022-02-13T22:57:34	Remove README.docs This was just a partial copy of the main README.
daf2d9c3	2022-02-08T04:30:29	Fix regression in RelaxNG pattern matching XML_SCHEMAS_QNAME is not a string-derived type. Other types up to XML_SCHEMAS_ENTITIES are. Should fix #224.
d54564ea	2022-02-12T21:38:19	Remove .travis.yml
0a6a79b2	2022-02-12T21:36:27	Try again to only build GitLab Pages on main repo
a3aca203	2022-02-12T21:33:53	Try again to only build GitLab Pages on main repo
15111c82	2022-02-12T21:25:25	Only build GitLab Pages on main repo
2017cae6	2022-02-12T20:02:51	Upload documentation to GitLab pages
be889b65	2022-01-26T16:35:18	Make xmlFuzzReadString return a zero size in error case Avoids use of uninitialized memory.
57b3abd5	2022-02-07T22:09:25	Fix xmlSetTreeDoc with entity references The children member of entity reference nodes points to the entity declaration and must never be followed when traversing a tree. In the worst case, this could lead to an infinite loop. It's somewhat unclear how moving entity references to other documents should work exactly. For now we simply set the children pointer to NULL to avoid a reference to the original document. Fixes #42.
8be44aeb	2022-02-07T20:54:33	Fix "xmllint -" Short-lived regression from commit d12be00d.
9edc20c1	2022-02-07T20:38:30	Fix double counting of CRLF in comments Fixes #151.
b14649e3	2022-02-07T19:54:20	Remove old ChangeLog This was probably generated from SVN until 2009. Changes are now tracked in NEWS. Fixes #261.
fcd4c5b8	2022-02-07T19:22:45	Document how to escape XML_CATALOG_FILES Fixes #309.
ea53fc18	2022-02-07T18:24:03	Properly handle nested documents in xmlFreeNode Client code should never add document nodes as children of other nodes, but even our own XPointer code has a bug that can produce such trees. Make sure to really free nested documents. Also see commits 0815302d and 0762c9b6. Should fix #269.
96535657	2022-02-07T15:26:33	Make sure to grow input buffer in xmlParseMisc Otherwise, large amount of whitespace could lead to documents not being parsed correctly. Fixes #299.
9b8ef34d	2022-02-04T14:42:16	Fix unused function warning in testapi.c
d12be00d	2022-02-04T14:13:59	Don't ignore xmllint options after "-" There's no reason to ignore options after "-". This was probably confused with the "--" mechanism which xmllint doesn't implement. Fixes #290.
5408c10c	2022-02-04T14:00:09	Don't normalize namespace URIs in XPointer xmlns() scheme Namespace URIs should be compared without escaping or unescaping: https://www.w3.org/TR/REC-xml-names/#NSNameComparison Fixes #289.
1c7d91ab	2022-02-03T23:31:19	Fix handling of XSD with empty namespace An empty namespace means no default namespace. Fixes #303.
f480f750	2022-02-03T14:43:17	Update NewsML DTD in test suite Switch to version 1.2 which has a clearer license. Fixes #291.
247cfa27	2022-02-01T16:21:10	Fix parsing of xmllint --maxmem option Fixes #195.
96dc7f4a	2022-02-01T16:15:51	Also register HTML document nodes Fixes #196.
18d1f9d4	2022-02-01T15:56:21	Add more checks for malloc failures in xmllint.c Also fix a few of the existing checks. Fixes #197. Fixes #198.
eab86522	2022-01-31T14:45:09	Make xmllint return an error if arguments are missing Before, xmllint would only return an error code if the argument list was completely empty. Fixes #285.
6010a536	2022-01-28T16:27:12	Avoid potential integer overflow in xmlstring.c For historical reasons, the string API operates with int indices which can overflow, especially on 64-bit systems. libxml2 always made the tacit assumption that strings will be never larger than INT_MAX bytes. It should be considered a bug if any part of the code can produce larger strings, whether they are externally visible or not. Likewise, API users are expected not to supply strings larger than INT_MAX bytes. This requirement isn't documented. But even if it was, we must handle larger strings passed in by accident without causing memory errors. - xmlStrndup, xmlCharStrndup, xmlUTF8Strndup Avoid integer overflow if len == INT_MAX. - xmlStrlen, xmlUTF8Strsize, xmlUTF8Strloc Avoid integer overflow by using size_t for index. If an input string larger than INT_MAX bytes is detected, these functions now return 0 instead of a wrong and possibly negative value. - xmlCheckUTF8 Avoid integer overflow by limiting index range. - xmlStrncat, xmlStrncatNew, xmlEscapeFormatString Avoid integer overflow. Return NULL instead of producing strings larger than INT_MAX bytes.
8f5ccada	2021-07-07T19:24:36	xmlAddChild() and xmlAddNextSibling() may not attach their second argument Use the return value of xmlAddChild() and xmlAddNextSibling() instead of the second argument directly. Found by OSS-Fuzz. Fixes #316
53983804	2022-01-25T03:08:22	Run CI tests with UBSan implicit-conversion checks This enables the remaining checks from the "integer" group: - implicit-unsigned-integer-truncation - implicit-signed-integer-truncation - implicit-integer-sign-change These checks can find all kinds of bugs and only require explicit casts if integer truncation or sign change is really intended.
a647e430	2022-01-25T02:59:40	Fix casting of line numbers in SAX2.c The line member is an unsigned short. Avoids integer conversion warnings with UBSan. Also use USHRT_MAX instead of hard-coded constant.
67c2e78b	2022-01-25T02:44:37	Fix integer conversion warnings in hash.c Use unsigned long for temporary variable to avoid integer conversion warnings with UBSan. Note that this does change the computation of hash values for input bytes larger than 0x7F. Before, these bytes were first converted to a (typically) signed char with a negative value, then to a large unsigned long near ULONG_MAX. I doubt that this was intentional. Input bytes larger than 0x7F are now converted to unsigned long unchanged.
21217dd9	2022-01-25T02:34:40	Add explicit casts in runtest.c Avoids integer conversion warnings with UBSan.
7abc6e6a	2022-01-25T02:27:53	Fix integer conversion warning in xmlIconvWrapper Use size_t for return value of iconv(3) to avoid an UBSan integer conversion warning.
f4a74bf0	2022-01-25T02:21:05	Add suffix to unsigned constant in xmlmemory.c Avoids an integer conversion warning with UBSan.
5948abfe	2022-01-25T01:59:03	Add explicit casts in testchar.c Avoids integer conversion warnings with UBSan.
6f95273e	2022-01-25T01:46:59	Fix integer conversion warnings in xmlstring.c Use an int to avoid an integer conversion warning with UBSan when left-shifting a char.
0596d67d	2022-01-25T01:39:41	Add explicit cast in xmlURIUnescapeString Avoids an integer conversion warning with UBSan.
f872aa18	2022-01-25T01:16:00	Fix handling of ctxt->base in xmlXPtrEvalXPtrPart Also set ctxt->base when updating ctxt->cur. Always restore ctxt->cur on error. Avoids integer truncation and wrong column numbers in xmlXPathErr. Stop hiding modification of ctxt members behind a macro. Found with UBSan.
97fe1279	2022-01-20T16:08:35	Remove wrong tarname from AC_INIT Remove the "tarname" added in commit 7c0253aa. Having a tarname including a version number would result in tarballs named libxml2-2.9.12-2.9.12.tar.gz. This change also means that documentation will now be installed in $(datadir)/doc/libxml2 instead of $(datadir)/doc/libxml2-$(version). Having a version number in the documentation directory doesn't seem helpful. The new location also matches the default autotools $(docdir).
00e618eb	2022-01-17T21:39:27	Remove old devhelp format See #295.
d85245f9	2022-01-16T21:39:04	Fix regression with PEs in external DTD Fix a regression introduced with commit a28f7d87. In some cases, parameter entity references in external DTDs wouldn't be expanded. Fixes #306.
9f4cb84c	2022-01-16T18:39:51	Fix xmllint --maxmem xmlMemSetup must be called before initializing the parser, otherwise some data structures will be allocated with system malloc instead of our custom allocator. This throws off built-in memory debugging and sanitizers.
e4c91f74	2021-11-03T11:41:11	Fix Null-deref-in-xmlSchemaGetComponentTargetNs
9277abe2	2022-01-16T15:50:56	Fix libxml2.doap Add description. Change category to "infrastructure". Apparently, "platform" isn't allowed anymore. Add programming language.
87a99270	2021-08-26T11:50:41	Added regression tests for xmlReadFd() and htmlReadFd()
fe6890e2	2021-07-27T13:20:20	Fix htmlReadFd, which was using a mix of xml and html context functions
67953a9f	2022-01-16T15:30:02	Fix memory leak in xmlXPathCompNodeTest Found by Coverity.
1b7d4e2b	2021-07-22T14:46:48	tstmem.py: Try importing from libxmlmods.libxml2mod if needed Distutils builds place libxml2mod.pyd under the libxmlmods subdir, so try this directory if 'import libxml2mod' failed.
6e169c14	2021-03-30T16:11:13	python: Port python 3.x module to Windows On Windows, we don't have fcntl() which helps us to find out how a file was opened, so we need to resort to the Windows API NtQueryInformationFile() in ntdll.dll to help us, and compare the file access modes as appropriate to deduce the modes we want to pass into fdopen(). As all official Python 3.x releases are built against newer Windows CRTs that toughen checks on the validity of the file descriptor when we convert the fd to a native Windows File Handle using _get_osfhandle(), we need to define an empty handler so that the program does not abort if the fd that was passed in was invalid; instead, we just return NULL if _get_osfhandle() could not return us a valid Windows File Handle.
3cc64a88	2021-07-22T15:46:38	setup.py.in: Try to import setuptools This way, we can build binary wheels easily if needed
dbfe6151	2021-07-22T15:36:15	Python distutils: Make DLL packaging more flexible This updates setup.py.in to pack the DLLs according to the options we specified to configure.js or CMake (or, even configure, although autotools builds are not likely to build the libxml2 Python module via distutils). At this point, we can pack only the DLLs that libxml2 really depends on, and pack the libxslt DLLs only if we really built the libxslt Python modules. Also make the DLL filenames more easily configured
eb4c1bf8	2021-11-03T09:48:13	Fix random dropping of characters on dumping ASCII encoded XML Fix a bug in xmlCharEncOutput return value which will cause xmlNodeDumpOutput to drop characters randomly. xmlCharEncOutput returns zero if the length of the input buffer is zero but ignores the fact that it may already encoded the input buffer and the input's length is zero due to the fact that xmlEncOutputChunk returned -2 errors and underlying code tries to fix the error by encoding the input. xmlCharEncOutput is collecting the number of bytes written to the output buffer but is returning zero instead of the total number of bytes in this situation. This commit will fix this issue by returning the total number of bytes instead. So the xmlNodeDumpOutput will also continue writing and will not stop due to the fact that it mistakenly thinks the output buffer is not changed in that iteration. Fixes #314
66fb340a	2021-10-14T15:01:24	Update URL for libxml++ C++ binding Fixes #267
ae728bb8	2022-01-16T15:05:41	Fix null pointer deref in xmlStringGetNodeList Check for malloc failure to avoid null deref.
46c658b0	2021-08-06T08:48:24	move current position before possible calling of ctxt->sax->characters.
96753450	2021-07-29T12:14:03	Correctly install the HTML examples into their subdirectory. Previous to this commit, the examples where installed haphazardly within all the other html documents, also overwriting index.html, for example. Signed-off-by: Mattia Rizzolo <mattia@mapreri.org>
7c0253aa	2021-07-29T12:11:08	Refactor the settings of $docdir This is a completely noop change for this project, since before this commit nothing was using $docdir nor PROGRAM_TARNAME. Setting the fourth parameter of AC_INIT() makes it set PROGRAM_TARNAME, which then used as the last path component of the default docdir, effectively making $docdir be the same as the previous $BASE_DIR/$DOC_MODULE. Signed-off-by: Mattia Rizzolo <mattia@mapreri.org>
51c88c6f	2021-07-26T20:12:45	configure: remove unused checks for functions Nothing uses the results from these checks, so remove the checks. There are some "uses" in order to suppress macro shadowing in MSVC's implementation of `isinf` and `isnan` as macros, but those are hard-coded and do not require checks to manage.
1a013ba7	2021-07-26T20:11:56	configure: remove unused checks for libraries These libraries are queried for, but no code cares about the results, so remove the checks.
0aad075c	2021-07-26T20:10:52	cmake: remove unused checks Even the configured `config.h` did not forward the results of these checks.
9669bd68	2021-07-26T20:09:32	configure: remove unused checks for headers These headers are checked for at configure time, but the code never cares about the results of these checks, so skip them.
f8608235	2021-07-26T20:06:18	cmake: fix `ATTRIBUTE_DESTRUCTOR` definition The code expects it to be set to the attribute for `xmlDestructor`, but in CMake, it is only ever available as `1` or undefined. Instead, match the behavior or autoconf.
3ba59b93	2021-07-23T22:34:29	Generate devhelp2 index file The devhelp2 format was introduced in 2005, and the devhelp format was deprecated in 2017. Fixes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/295
91b3d3f9	2021-07-14T17:12:11	Remove duplicated code in xmlcatalog Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
d7f11fd0	2021-07-14T17:03:46	Fix leak in __xmlOutputBufferCreateFilename Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
477f6de3	2021-07-14T15:35:31	Fix memory leak in xmlRelaxNGNewDocParserCtxt Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
483de2c2	2021-07-14T15:31:55	Fix memory leak in xmlRelaxNGParseData Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
9a9dd31b	2021-07-14T15:28:56	Fix memory leak in libxml_C14NDocSaveTo Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
d68c1637	2021-07-14T15:23:11	Fix memory leak in libxml_saveNodeTo Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
328456bf	2021-07-14T14:43:59	Fix memory leak in xmlNewInputFromFile Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
fe564967	2021-07-14T14:35:17	Fix memory leak in xmlCreateIOParserCtxt Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
f0904f32	2021-07-14T14:14:34	Fix memory leak in xmlParseSGMLCatalog Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
2510f43c	2021-07-14T14:03:44	Fix memory leak in xmlParseCatalogFile Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
92bce68c	2021-07-14T11:37:07	Fix memory leak in xmlSAX2AttributeDecl Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
e7d1c53a	2021-07-14T11:32:57	Fix memory leak in xmlFreeParserInputBuffer Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806
03bb9293	2021-07-07T18:23:18	Fix parse failure when 4-byte character in UTF-16 BE is split across a chunk This makes the logic in UTF16BEToUTF8() match UTF16LEToUTF8(). * encoding.c: (UTF16LEToUTF8): - Fix comment to describe what the code does. (UTF16BEToUTF8): - Fix undefined behavior which was applied to UTF16LEToUTF8() in 2f9382033e. - Add bounds check to while() loop which was applied to UTF16LEToUTF8() in be803967db. - Do not return -2 when (in >= inend) to fix the bug. This was applied to UTF16LEToUTF8() in 496a1cf592. - Inline (<< 8) statements to match UTF16LEToUTF8(). Add the following tests and results: test/text-4-byte-UTF-16-BE-offset.xml test/text-4-byte-UTF-16-BE.xml test/text-4-byte-UTF-16-LE-offset.xml test/text-4-byte-UTF-16-LE.xml
e6adc19f	2021-07-05T13:40:54	man: Mention XML_CATALOG_FILES is space-separated Fixes: https://bugzilla.gnome.org/show_bug.cgi?id=781274
bdd482c2	2021-07-05T18:48:10	add documentaiton for xmllint exit code 10 Closes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/280
a0f9211b	2021-06-28T02:03:15	python/Makefile.am: use _LIBADD, not _LDFLAGS for LIBS This fixes over-linking in the built Python modules with various libraries. _LIBADD is intended for adding additional libraries for linking, while _LDFLAGS is for miscellaneous extra flags (possibly user-supplied). If using -Wl,-as-needed within user-supplied LDFLAGS, it is passed too late (after the library link line) and therefore has no effect. Notes: * Noticed while working on Gentoo's migration to libxcrypt because libxml2's Python modules were linking to libcrypt (and other libraries) unexpectedly. * It was suggested we could actually stop linking explicitly with all of Python's libraries / don't copy its LDFLAGS, but this resolves the original issue downstream and is a separate discussion. I couldn't find any clear documentation for/against such a change. Bug: https://bugs.gentoo.org/798942 Signed-off-by: Sam James <sam@gentoo.org>
ff05c94a	2022-01-16T13:56:17	Fix check for libtool in autogen.sh libtoolize is named glibtoolize on some macOS systems.
343bf0d3	2022-01-16T13:52:21	Add myself to maintainers Fixes #319.
c35628a2	2022-01-15T18:18:22	Revert "Make schema validation fail with multiple top-level elements" This reverts commit 4f2aee18f6e2d40e58eb224f4f7935dc2400fe25. Fixes #305.
798bdf13	2022-01-10T14:50:20	Different approach to fix quadratic behavior in HTML push parser The old approach introduced a regression, see issue #312 and the previous commit. Disable code that tries to recover from invalid start tags. This only affects "recovery" mode. Add a comment outlining a better fix in accordance with the HTML5 spec.
094fc08a	2022-01-10T14:02:10	Fix regression when parsing invalid HTML tags in push mode Revert part of commit 173a0830 that changed behavior when parsing malformed start tags with the push parser. This reintroduces quadratic behavior in recovery mode which will be worked around in the next commit. Fixes #312.
2732b234	2022-01-10T13:32:14	Fix regression parsing public IDs literals in HTML Fix regression introduced when reworking htmlParsePubidLiteral in commit 93ce33c2. Fixes #318.
dea91c97	2021-07-27T16:12:54	Fix buffering in xmlOutputBufferWrite Fix a regression introduced with commit a697ed1e which caused xmlOutputBufferWrite to flush internal buffers too late. Fixes #296.

652dd12a

2022-02-08T03:29:24

[CVE-2022-23308] Use-after-free of ID and IDREF attributes If a document is parsed with XML_PARSE_DTDVALID and without XML_PARSE_NOENT, the value of ID attributes has to be normalized after potentially expanding entities in xmlRemoveID. Otherwise, later calls to xmlGetID can return a pointer to previously freed memory. ID attributes which are empty or contain only whitespace after entity expansion are affected in a similar way. This is fixed by not storing such attributes in the ID table. The test to detect streaming mode when validating against a DTD was broken. In connection with the defects above, this could result in a use-after-free when using the xmlReader interface with validation. Fix detection of streaming mode to avoid similar issues. (This changes the expected result of a test case. But as far as I can tell, using the XML reader with XIncludes referencing the root document never worked properly, anyway.) All of these issues can result in denial of service. Using xmlReader with validation could result in disclosure of memory via the error channel, typically stderr. The security impact of xmlGetID returning a pointer to freed memory depends on the application. The typical use case of calling xmlGetID on an unmodified document is not affected.

d19bab68

2022-02-19T19:26:10

Fix fuzz/.gitignore after fixing VPATH build

f2ad86fa

2022-02-17T19:05:26

Remove SVN keyword anchors

b041d829

2022-02-16T19:55:30

Remove xmlwin32version.h This file was undocumented and never used anywhere. Maybe users were supposed to rename this file to xmlversion.h manually. These days, both CMake and win32/configure.js generate xmlversion.h from xmlversion.h.in, just like the Autotools build.

176115c6

2022-02-14T22:49:04

Fix source URL in libxml.spec.in

86266487

2022-02-14T18:06:38

Fix fuzzer test with VPATH build Also fixes make distcheck.

85a35ba0

2022-02-14T17:44:29

Support custom prefix when installing Python module Also fixes make distcheck.

46084436

2022-02-14T03:28:51

Remove Makefile.win A Makefile for Visual C++ 5.0, last changed 23 years ago.

a20a6022

2022-02-14T03:40:59

Fix distribution after README change

411f9803

2022-02-14T01:30:37

Rework README - Merge INSTALL.libxml2, CONTRIBUTING and AUTHORS into README - Convert to Markdown - Redact and update content - Update links

e16d729d

2022-02-14T01:31:47

Remove README.cvs-commits

8eb06937

2022-02-14T01:01:23

Remove outdated ChangeLog code The ChangeLog is from pre-Git times.

7fe9addc

2022-02-13T23:29:51

Remove CVS and SVN-related code

4a0c0e63

2022-02-13T22:52:14

Remove MAINTAINERS Maintainers are listed in libxml2.doap.

b0e6eb97

2022-02-13T22:51:26

Remove xmltutorial.pdf We already have an HTML version.

10891111

2022-02-13T22:52:53

Redirect links to xmlsoft.org Documentation and releases are now available on gitlab.gnome.org.

4f2693a1

2022-02-13T22:57:34

Remove README.docs This was just a partial copy of the main README.

daf2d9c3

2022-02-08T04:30:29

Fix regression in RelaxNG pattern matching XML_SCHEMAS_QNAME is not a string-derived type. Other types up to XML_SCHEMAS_ENTITIES are. Should fix #224.

d54564ea

2022-02-12T21:38:19

Remove .travis.yml

0a6a79b2

2022-02-12T21:36:27

Try again to only build GitLab Pages on main repo

a3aca203

2022-02-12T21:33:53

Try again to only build GitLab Pages on main repo

15111c82

2022-02-12T21:25:25

Only build GitLab Pages on main repo

2017cae6

2022-02-12T20:02:51

Upload documentation to GitLab pages

be889b65

2022-01-26T16:35:18

Make xmlFuzzReadString return a zero size in error case Avoids use of uninitialized memory.

57b3abd5

2022-02-07T22:09:25

Fix xmlSetTreeDoc with entity references The children member of entity reference nodes points to the entity declaration and must never be followed when traversing a tree. In the worst case, this could lead to an infinite loop. It's somewhat unclear how moving entity references to other documents should work exactly. For now we simply set the children pointer to NULL to avoid a reference to the original document. Fixes #42.

8be44aeb

2022-02-07T20:54:33

Fix "xmllint -" Short-lived regression from commit d12be00d.

9edc20c1

2022-02-07T20:38:30

Fix double counting of CRLF in comments Fixes #151.

b14649e3

2022-02-07T19:54:20

Remove old ChangeLog This was probably generated from SVN until 2009. Changes are now tracked in NEWS. Fixes #261.

fcd4c5b8

2022-02-07T19:22:45

Document how to escape XML_CATALOG_FILES Fixes #309.

ea53fc18

2022-02-07T18:24:03

Properly handle nested documents in xmlFreeNode Client code should never add document nodes as children of other nodes, but even our own XPointer code has a bug that can produce such trees. Make sure to really free nested documents. Also see commits 0815302d and 0762c9b6. Should fix #269.

96535657

2022-02-07T15:26:33

Make sure to grow input buffer in xmlParseMisc Otherwise, large amount of whitespace could lead to documents not being parsed correctly. Fixes #299.

9b8ef34d

2022-02-04T14:42:16

Fix unused function warning in testapi.c

d12be00d

2022-02-04T14:13:59

Don't ignore xmllint options after "-" There's no reason to ignore options after "-". This was probably confused with the "--" mechanism which xmllint doesn't implement. Fixes #290.

5408c10c

2022-02-04T14:00:09

Don't normalize namespace URIs in XPointer xmlns() scheme Namespace URIs should be compared without escaping or unescaping: https://www.w3.org/TR/REC-xml-names/#NSNameComparison Fixes #289.

1c7d91ab

2022-02-03T23:31:19

Fix handling of XSD with empty namespace An empty namespace means no default namespace. Fixes #303.

f480f750

2022-02-03T14:43:17

Update NewsML DTD in test suite Switch to version 1.2 which has a clearer license. Fixes #291.

247cfa27

2022-02-01T16:21:10

Fix parsing of xmllint --maxmem option Fixes #195.

96dc7f4a

2022-02-01T16:15:51

Also register HTML document nodes Fixes #196.

18d1f9d4

2022-02-01T15:56:21

Add more checks for malloc failures in xmllint.c Also fix a few of the existing checks. Fixes #197. Fixes #198.

eab86522

2022-01-31T14:45:09

Make xmllint return an error if arguments are missing Before, xmllint would only return an error code if the argument list was completely empty. Fixes #285.

6010a536

2022-01-28T16:27:12

Avoid potential integer overflow in xmlstring.c For historical reasons, the string API operates with int indices which can overflow, especially on 64-bit systems. libxml2 always made the tacit assumption that strings will be never larger than INT_MAX bytes. It should be considered a bug if any part of the code can produce larger strings, whether they are externally visible or not. Likewise, API users are expected not to supply strings larger than INT_MAX bytes. This requirement isn't documented. But even if it was, we must handle larger strings passed in by accident without causing memory errors. - xmlStrndup, xmlCharStrndup, xmlUTF8Strndup Avoid integer overflow if len == INT_MAX. - xmlStrlen, xmlUTF8Strsize, xmlUTF8Strloc Avoid integer overflow by using size_t for index. If an input string larger than INT_MAX bytes is detected, these functions now return 0 instead of a wrong and possibly negative value. - xmlCheckUTF8 Avoid integer overflow by limiting index range. - xmlStrncat, xmlStrncatNew, xmlEscapeFormatString Avoid integer overflow. Return NULL instead of producing strings larger than INT_MAX bytes.

8f5ccada

2021-07-07T19:24:36

xmlAddChild() and xmlAddNextSibling() may not attach their second argument Use the return value of xmlAddChild() and xmlAddNextSibling() instead of the second argument directly. Found by OSS-Fuzz. Fixes #316

53983804

2022-01-25T03:08:22

Run CI tests with UBSan implicit-conversion checks This enables the remaining checks from the "integer" group: - implicit-unsigned-integer-truncation - implicit-signed-integer-truncation - implicit-integer-sign-change These checks can find all kinds of bugs and only require explicit casts if integer truncation or sign change is really intended.

a647e430

2022-01-25T02:59:40

Fix casting of line numbers in SAX2.c The line member is an unsigned short. Avoids integer conversion warnings with UBSan. Also use USHRT_MAX instead of hard-coded constant.

67c2e78b

2022-01-25T02:44:37

Fix integer conversion warnings in hash.c Use unsigned long for temporary variable to avoid integer conversion warnings with UBSan. Note that this does change the computation of hash values for input bytes larger than 0x7F. Before, these bytes were first converted to a (typically) signed char with a negative value, then to a large unsigned long near ULONG_MAX. I doubt that this was intentional. Input bytes larger than 0x7F are now converted to unsigned long unchanged.

21217dd9

2022-01-25T02:34:40

Add explicit casts in runtest.c Avoids integer conversion warnings with UBSan.

7abc6e6a

2022-01-25T02:27:53

Fix integer conversion warning in xmlIconvWrapper Use size_t for return value of iconv(3) to avoid an UBSan integer conversion warning.

f4a74bf0

2022-01-25T02:21:05

Add suffix to unsigned constant in xmlmemory.c Avoids an integer conversion warning with UBSan.

5948abfe

2022-01-25T01:59:03

Add explicit casts in testchar.c Avoids integer conversion warnings with UBSan.

6f95273e

2022-01-25T01:46:59

Fix integer conversion warnings in xmlstring.c Use an int to avoid an integer conversion warning with UBSan when left-shifting a char.

0596d67d

2022-01-25T01:39:41

Add explicit cast in xmlURIUnescapeString Avoids an integer conversion warning with UBSan.

f872aa18

2022-01-25T01:16:00

Fix handling of ctxt->base in xmlXPtrEvalXPtrPart Also set ctxt->base when updating ctxt->cur. Always restore ctxt->cur on error. Avoids integer truncation and wrong column numbers in xmlXPathErr. Stop hiding modification of ctxt members behind a macro. Found with UBSan.

97fe1279

2022-01-20T16:08:35

Remove wrong tarname from AC_INIT Remove the "tarname" added in commit 7c0253aa. Having a tarname including a version number would result in tarballs named libxml2-2.9.12-2.9.12.tar.gz. This change also means that documentation will now be installed in $(datadir)/doc/libxml2 instead of $(datadir)/doc/libxml2-$(version). Having a version number in the documentation directory doesn't seem helpful. The new location also matches the default autotools $(docdir).

00e618eb

2022-01-17T21:39:27

Remove old devhelp format See #295.

d85245f9

2022-01-16T21:39:04

Fix regression with PEs in external DTD Fix a regression introduced with commit a28f7d87. In some cases, parameter entity references in external DTDs wouldn't be expanded. Fixes #306.

9f4cb84c

2022-01-16T18:39:51

Fix xmllint --maxmem xmlMemSetup must be called before initializing the parser, otherwise some data structures will be allocated with system malloc instead of our custom allocator. This throws off built-in memory debugging and sanitizers.

e4c91f74

2021-11-03T11:41:11

Fix Null-deref-in-xmlSchemaGetComponentTargetNs

9277abe2

2022-01-16T15:50:56

Fix libxml2.doap Add description. Change category to "infrastructure". Apparently, "platform" isn't allowed anymore. Add programming language.

87a99270

2021-08-26T11:50:41

Added regression tests for xmlReadFd() and htmlReadFd()

fe6890e2

2021-07-27T13:20:20

Fix htmlReadFd, which was using a mix of xml and html context functions

67953a9f

2022-01-16T15:30:02

Fix memory leak in xmlXPathCompNodeTest Found by Coverity.

1b7d4e2b

2021-07-22T14:46:48

tstmem.py: Try importing from libxmlmods.libxml2mod if needed Distutils builds place libxml2mod.pyd under the libxmlmods subdir, so try this directory if 'import libxml2mod' failed.

6e169c14

2021-03-30T16:11:13

python: Port python 3.x module to Windows On Windows, we don't have fcntl() which helps us to find out how a file was opened, so we need to resort to the Windows API NtQueryInformationFile() in ntdll.dll to help us, and compare the file access modes as appropriate to deduce the modes we want to pass into fdopen(). As all official Python 3.x releases are built against newer Windows CRTs that toughen checks on the validity of the file descriptor when we convert the fd to a native Windows File Handle using _get_osfhandle(), we need to define an empty handler so that the program does not abort if the fd that was passed in was invalid; instead, we just return NULL if _get_osfhandle() could not return us a valid Windows File Handle.

3cc64a88

2021-07-22T15:46:38

setup.py.in: Try to import setuptools This way, we can build binary wheels easily if needed

dbfe6151

2021-07-22T15:36:15

Python distutils: Make DLL packaging more flexible This updates setup.py.in to pack the DLLs according to the options we specified to configure.js or CMake (or, even configure, although autotools builds are not likely to build the libxml2 Python module via distutils). At this point, we can pack only the DLLs that libxml2 really depends on, and pack the libxslt DLLs only if we really built the libxslt Python modules. Also make the DLL filenames more easily configured

eb4c1bf8

2021-11-03T09:48:13

Fix random dropping of characters on dumping ASCII encoded XML Fix a bug in xmlCharEncOutput return value which will cause xmlNodeDumpOutput to drop characters randomly. xmlCharEncOutput returns zero if the length of the input buffer is zero but ignores the fact that it may already encoded the input buffer and the input's length is zero due to the fact that xmlEncOutputChunk returned -2 errors and underlying code tries to fix the error by encoding the input. xmlCharEncOutput is collecting the number of bytes written to the output buffer but is returning zero instead of the total number of bytes in this situation. This commit will fix this issue by returning the total number of bytes instead. So the xmlNodeDumpOutput will also continue writing and will not stop due to the fact that it mistakenly thinks the output buffer is not changed in that iteration. Fixes #314

66fb340a

2021-10-14T15:01:24

Update URL for libxml++ C++ binding Fixes #267

ae728bb8

2022-01-16T15:05:41

Fix null pointer deref in xmlStringGetNodeList Check for malloc failure to avoid null deref.

46c658b0

2021-08-06T08:48:24

move current position before possible calling of ctxt->sax->characters.

96753450

2021-07-29T12:14:03

Correctly install the HTML examples into their subdirectory. Previous to this commit, the examples where installed haphazardly within all the other html documents, also overwriting index.html, for example. Signed-off-by: Mattia Rizzolo <mattia@mapreri.org>

7c0253aa

2021-07-29T12:11:08

Refactor the settings of $docdir This is a completely noop change for this project, since before this commit nothing was using $docdir nor PROGRAM_TARNAME. Setting the fourth parameter of AC_INIT() makes it set PROGRAM_TARNAME, which then used as the last path component of the default docdir, effectively making $docdir be the same as the previous $BASE_DIR/$DOC_MODULE. Signed-off-by: Mattia Rizzolo <mattia@mapreri.org>

51c88c6f

2021-07-26T20:12:45

configure: remove unused checks for functions Nothing uses the results from these checks, so remove the checks. There are some "uses" in order to suppress macro shadowing in MSVC's implementation of `isinf` and `isnan` as macros, but those are hard-coded and do not require checks to manage.

1a013ba7

2021-07-26T20:11:56

configure: remove unused checks for libraries These libraries are queried for, but no code cares about the results, so remove the checks.

0aad075c

2021-07-26T20:10:52

cmake: remove unused checks Even the configured `config.h` did not forward the results of these checks.

9669bd68

2021-07-26T20:09:32

configure: remove unused checks for headers These headers are checked for at configure time, but the code never cares about the results of these checks, so skip them.

f8608235

2021-07-26T20:06:18

cmake: fix `ATTRIBUTE_DESTRUCTOR` definition The code expects it to be set to the attribute for `xmlDestructor`, but in CMake, it is only ever available as `1` or undefined. Instead, match the behavior or autoconf.

3ba59b93

2021-07-23T22:34:29

Generate devhelp2 index file The devhelp2 format was introduced in 2005, and the devhelp format was deprecated in 2017. Fixes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/295

91b3d3f9

2021-07-14T17:12:11

Remove duplicated code in xmlcatalog Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

d7f11fd0

2021-07-14T17:03:46

Fix leak in __xmlOutputBufferCreateFilename Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

477f6de3

2021-07-14T15:35:31

Fix memory leak in xmlRelaxNGNewDocParserCtxt Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

483de2c2

2021-07-14T15:31:55

Fix memory leak in xmlRelaxNGParseData Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

9a9dd31b

2021-07-14T15:28:56

Fix memory leak in libxml_C14NDocSaveTo Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

d68c1637

2021-07-14T15:23:11

Fix memory leak in libxml_saveNodeTo Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

328456bf

2021-07-14T14:43:59

Fix memory leak in xmlNewInputFromFile Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

fe564967

2021-07-14T14:35:17

Fix memory leak in xmlCreateIOParserCtxt Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

f0904f32

2021-07-14T14:14:34

Fix memory leak in xmlParseSGMLCatalog Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

2510f43c

2021-07-14T14:03:44

Fix memory leak in xmlParseCatalogFile Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

92bce68c

2021-07-14T11:37:07

Fix memory leak in xmlSAX2AttributeDecl Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

e7d1c53a

2021-07-14T11:32:57

Fix memory leak in xmlFreeParserInputBuffer Found by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=1938806

03bb9293

2021-07-07T18:23:18

Fix parse failure when 4-byte character in UTF-16 BE is split across a chunk This makes the logic in UTF16BEToUTF8() match UTF16LEToUTF8(). * encoding.c: (UTF16LEToUTF8): - Fix comment to describe what the code does. (UTF16BEToUTF8): - Fix undefined behavior which was applied to UTF16LEToUTF8() in 2f9382033e. - Add bounds check to while() loop which was applied to UTF16LEToUTF8() in be803967db. - Do not return -2 when (in >= inend) to fix the bug. This was applied to UTF16LEToUTF8() in 496a1cf592. - Inline (<< 8) statements to match UTF16LEToUTF8(). Add the following tests and results: test/text-4-byte-UTF-16-BE-offset.xml test/text-4-byte-UTF-16-BE.xml test/text-4-byte-UTF-16-LE-offset.xml test/text-4-byte-UTF-16-LE.xml

e6adc19f

2021-07-05T13:40:54

man: Mention XML_CATALOG_FILES is space-separated Fixes: https://bugzilla.gnome.org/show_bug.cgi?id=781274

bdd482c2

2021-07-05T18:48:10

add documentaiton for xmllint exit code 10 Closes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/280

a0f9211b

2021-06-28T02:03:15

python/Makefile.am: use *_LIBADD, not *_LDFLAGS for LIBS This fixes over-linking in the built Python modules with various libraries. *_LIBADD is intended for adding additional libraries for linking, while *_LDFLAGS is for miscellaneous extra flags (possibly user-supplied). If using -Wl,-as-needed within user-supplied LDFLAGS, it is passed too late (after the library link line) and therefore has no effect. Notes: * Noticed while working on Gentoo's migration to libxcrypt because libxml2's Python modules were linking to libcrypt (and other libraries) unexpectedly. * It was suggested we could actually stop linking explicitly with all of Python's libraries / don't copy its LDFLAGS, but this resolves the original issue downstream and is a separate discussion. I couldn't find any clear documentation for/against such a change. Bug: https://bugs.gentoo.org/798942 Signed-off-by: Sam James <sam@gentoo.org>

ff05c94a

2022-01-16T13:56:17

Fix check for libtool in autogen.sh libtoolize is named glibtoolize on some macOS systems.

343bf0d3

2022-01-16T13:52:21

Add myself to maintainers Fixes #319.

c35628a2

2022-01-15T18:18:22

Revert "Make schema validation fail with multiple top-level elements" This reverts commit 4f2aee18f6e2d40e58eb224f4f7935dc2400fe25. Fixes #305.

798bdf13

2022-01-10T14:50:20

Different approach to fix quadratic behavior in HTML push parser The old approach introduced a regression, see issue #312 and the previous commit. Disable code that tries to recover from invalid start tags. This only affects "recovery" mode. Add a comment outlining a better fix in accordance with the HTML5 spec.

094fc08a

2022-01-10T14:02:10

Fix regression when parsing invalid HTML tags in push mode Revert part of commit 173a0830 that changed behavior when parsing malformed start tags with the push parser. This reintroduces quadratic behavior in recovery mode which will be worked around in the next commit. Fixes #312.

2732b234

2022-01-10T13:32:14

Fix regression parsing public IDs literals in HTML Fix regression introduced when reworking htmlParsePubidLiteral in commit 93ce33c2. Fixes #318.

dea91c97

2021-07-27T16:12:54

Fix buffering in xmlOutputBufferWrite Fix a regression introduced with commit a697ed1e which caused xmlOutputBufferWrite to flush internal buffers too late. Fixes #296.

kc3-lang/libxml2

Log