|
8e7c20a1
|
2020-08-03T17:30:41
|
|
Fix integer overflow when comparing schema dates
Found by OSS-Fuzz.
|
|
|
905820a4
|
2020-07-12T22:59:39
|
|
Update fuzzing code
- Shorten timeouts
- Align options from Makefile and options files
- Add section headers to Makefile
- Skip invalid UTF-8 in regexp fuzzer
- Update regexp.dict
- Generate HTML seed corpus in correct format
|
|
|
68eadabd
|
2020-07-11T21:32:10
|
|
Fix exponential runtime in xmlFARecurseDeterminism
In order to prevent visiting a state twice, states must be marked as
visited for the whole duration of graph traversal because states might
be reached by different paths. Otherwise state graphs like the
following can lead to exponential runtime:
->O-->O-->O-->O-->O->
\ / \ / \ / \ /
O O O O
Reset the "visited" flag only after the graph was traversed.
xmlFAComputesDeterminism still has massive performance problems when
handling fuzzed input. By design, it has quadratic time complexity in
the number of reachable states. Some issues might also stem from
redundant epsilon transitions. With this fix, fuzzing regexes with a
maximum length of 100 becomes feasible at least.
Found with libFuzzer.
|
|
|
1a360c1c
|
2020-07-29T00:39:15
|
|
More *NodeDumpOutput fixes
When leaving nodes, restrict more operations to XML_ELEMENT_NODEs.
|
|
|
7b2e5172
|
2020-07-28T21:52:55
|
|
Fix *NodeDumpOutput functions
Only output end tag for elements. Should fix serialization of document
fragments.
|
|
|
dc6f0092
|
2020-07-28T19:07:19
|
|
Make xmlNodeDumpOutputInternal non-recursive
Fixes stack overflow with deeply nested documents.
|
|
|
5330153d
|
2020-07-28T18:33:50
|
|
Make xhtmlNodeDumpOutput non-recursive
Fixes stack overflow with deeply nested documents.
|
|
|
b79ab6e6
|
2020-07-28T02:42:37
|
|
Make htmlNodeDumpFormatOutput non-recursive
Fixes stack overflow with deeply nested HTML documents.
Found by OSS-Fuzz.
|
|
|
21ca8829
|
2020-07-25T17:57:29
|
|
Don't try to handle namespaces when building HTML documents
Don't try to resolve namespace in xmlSAX2StartElement when parsing
HTML documents. This useless operation could slow down the parser
considerably.
Found by OSS-Fuzz.
|
|
|
93ce33c2
|
2020-07-23T17:34:08
|
|
Fix several quadratic runtime issues in HTML push parser
Fix a few remaining cases where the HTML push parser would scan more
content during lookahead than being parsed later.
Make sure that htmlParseDocTypeDecl consumes all content up to the
final '>' in case of errors. The old comment said "We shouldn't try to
resynchronize", but ignoring invalid content is also what the HTML5
spec mandates.
Likewise, make htmlParseEndTag skip to the final '>' in invalid end
tags even if not in recovery mode. This is probably the most visible
change in practice and leads to different output for some tests but is
also more in line with HTML5.
Make sure that htmlParsePI and htmlParseComment don't abort if invalid
characters are encountered but log an error and ignore the character.
Change some other end-of-buffer checks to test for a zero byte instead
of relying on IS_CHAR.
Fix usage of IS_CHAR macro in htmlParseScript.
|
|
|
10d09472
|
2020-07-23T19:16:21
|
|
Fix .gitattributes
The files in 'test' and 'result' have mixed line endings, so disable
end-of-line conversion.
|
|
|
173a0830
|
2020-07-22T23:15:35
|
|
Fix quadratic runtime when push parsing HTML start tags
Make sure that htmlParseStartTag doesn't terminate on characters for
which IS_CHAR_CH is false like control chars.
In htmlParseTryOrFinish, only switch to START_TAG if the next character
starts a valid name. Otherwise, htmlParseStartTag might return without
consuming all characters up to the final '>'.
Found by OSS-Fuzz.
|
|
0e5c4fec
|
2020-07-13T15:20:45
|
|
Reset XML parser input before reporting errors
Apply changes to htmlParseChunk() in 13ba5b61 and 3f18e748 to
xmlParseChunk().
|
|
|
6995eed0
|
2020-07-19T13:54:52
|
|
Fix quadratic runtime when push parsing HTML entity refs
The HTML push parser would look ahead for characters in "; >/" to
terminate an entity reference but actual parsing could stop earlier,
potentially resulting in quadratic runtime.
Parse char data and references alternately in htmlParseTryOrFinish
and only look ahead once for a terminating '<' character.
Found by OSS-Fuzz.
|
|
|
8e219b15
|
2020-07-12T21:43:44
|
|
Fix HTML push parser lookahead
The parsing rules when looking for terminating chars or sequences in
the push parser differed from the actual parsing code. This could
result in the lookahead to overshoot and data being rescanned,
potentially leading to quadratic runtime.
Comments must never be handled during lookahead. Attribute values must
only be skipped for start tags and doctype declarations, not for end
tags, comments, PIs and script content.
|
|
|
e050062c
|
2020-07-15T14:38:55
|
|
Make htmlCurrentChar always translate U+0000
The general assumption is that htmlCurrentChar only returns 0 if the
end of the input buffer is reached. The UTF-8 path already logged an
error if a zero byte U+0000 was found and returned a space character
instead. Make the ASCII code path do the same.
htmlParseTryOrFinish skips zero bytes at the beginning of a buffer, so
even if 0 was returned from htmlCurrentChar, the push parser would make
progress. But rescanning the input could cause performance problems.
The pull parser would abort parsing and now handles zero bytes in ASCII
mode the same way as the push parser or as in UTF-8 mode.
It would be better to return the replacement character U+FFFD instead,
but some of the client code assumes that the UTF-8 length of input and
output matches.
|
|
|
dfd4e330
|
2020-07-15T14:22:08
|
|
Rework control flow in htmlCurrentChar
Don't call xmlCurrentChar after switching encodings. Rearrange code
blocks and fall through to normal UTF-8 handling.
|
|
|
922bebcc
|
2020-07-15T14:20:42
|
|
Make 'xmllint --html --push -' read from stdin
|
|
|
1493130e
|
2020-07-15T12:54:25
|
|
Fix UTF-8 decoder in HTML parser
Reject sequences starting with a continuation byte as well as overlong
sequences like the XML parser.
Also fixes an infinite loop in connection with previous commit 50078922
since htmlCurrentChar would return 0 even if not at the end of the
buffer.
Found by OSS-Fuzz.
|
|
|
beb7d71a
|
2020-07-13T12:41:19
|
|
Remove misleading comments in xpath.c
Fixes #169
|
|
|
50078922
|
2020-07-12T20:28:47
|
|
Fix quadratic runtime when parsing HTML script content
If htmlParseScript returns upon hitting an invalid character,
htmlParseLookupSequence will be called again with checkIndex reset to
zero, potentially resulting in quadratic runtime. Make sure that
htmlParseScript consumes all input in one go and simply skips over
invalid characters similar to htmlParseCharDataInternal.
Found by OSS-Fuzz.
|
|
d6761e70
|
2020-07-13T11:59:45
|
|
Update to Devhelp index file format version 2
Fixes #89
|
|
d514e2bd
|
2020-07-12T18:42:49
|
|
Set project language to C
|
|
|
5ddf02f2
|
2020-06-07T16:06:17
|
|
Update config.h.cmake.in
|
|
|
8bec210d
|
2020-06-04T17:37:21
|
|
Add variable for working directory of XML Conformance Test Suite
|
|
|
270e1655
|
2020-06-04T14:45:48
|
|
Add additional tests and XML Conformance Test Suite
|
|
|
e6ba4bd7
|
2020-06-04T11:58:04
|
|
Add command line option for temp directory in runtest
|
|
|
40e7ceaa
|
2020-06-04T11:57:28
|
|
Ensure LF line endings for test files
|
|
|
9ecf5ad6
|
2020-06-04T00:16:15
|
|
Enable runtests and testThreads
|
|
|
3f18e748
|
2020-07-11T14:34:57
|
|
Reset HTML parser input before reporting error
Avoid use-after-free, similar to 13ba5b61. Also make sure that
xmlBufSetInputBaseCur sets valid pointers in case of buffer errors.
Found by OSS-Fuzz.
|
|
|
3da8d947
|
2020-07-09T16:08:38
|
|
Fix more quadratic runtime issues in HTML push parser
Make sure that checkIndex is set when returning without match from
inside a comment. Also track parser state in htmlParseLookupChars.
Found by OSS-Fuzz.
|
|
|
741b0d0a
|
2020-07-07T12:54:34
|
|
Fix regression introduced with 477c7f6a
The 'inSubset' member is actually used by the SAX2 handlers. Store
extra parser state in 'hasPErefs'.
|
|
|
fc842f6e
|
2020-07-06T15:22:12
|
|
Limit regexp nesting depth
Enforce a maximum nesting depth of 50 for regular expressions. Avoids
stack overflows with deeply nested regexes.
Found by OSS-Fuzz.
|
|
|
1e41e4fa
|
2020-06-30T02:43:57
|
|
Fix return values and documentation in encoding.c
Make xmlEncInputChunk and xmlEncOutputChunk return 0 on success and
never a positive value.
Make xmlCharEncFirstLineInt, xmlCharEncFirstLineInt and
xmlCharEncOutFunc return the number of bytes written.
|
|
|
6b4717d6
|
2020-07-06T12:36:27
|
|
Add regexp regression tests
- Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup
<https://bugzilla.gnome.org/show_bug.cgi?id=757711>
- Bug 783015 - Integer-overflow in xmlFAParseQuantExact
<https://bugzilla.gnome.org/show_bug.cgi?id=783015>
(Regexptests): Add support for checking stderr output when
running regexp tests. This makes it possible to check in test
cases that fail and not see false-positive error output when
running the tests. Unlike other libxml2 test suites, if there
is no stderr output, no *.err file needs to be created.
|
|
|
477c7f6a
|
2020-06-28T15:54:23
|
|
Fix quadratic runtime in HTML parser
Commit eeb99329 removed an important optimization avoiding quadratic
runtime when repeatedly scanning the input buffer for terminating
characters in the HTML push parser. The related bug is
https://bugzilla.gnome.org/show_bug.cgi?id=444994
Make sure that ctxt->checkIndex is always written and store additional
parser state in ctxt->inSubset which is unused in the HTML parser.
Found by OSS-Fuzz.
|
|
|
f8329fdc
|
2020-07-02T11:51:31
|
|
Report error for invalid regexp quantifiers
|
|
|
13ba5b61
|
2020-06-28T13:16:46
|
|
Reset HTML parser input before reporting encoding error
If charset conversion fails, reset the input pointers before reporting
the error and bailing out. Otherwise, the input pointers are left in an
invalid state which could lead to use-after-free and other memory
errors.
Similar to f9e7997e. Found by OSS-Fuzz.
|
|
|
1e7851b5
|
2020-06-25T12:17:50
|
|
Fix integer overflow in xmlFAParseQuantExact
Found by OSS-Fuzz.
|
|
|
84bab955
|
2020-06-24T20:07:32
|
|
Fix return value of xmlC14NDocDumpMemory
Make sure to return -1 in case of buffer errors.
Fixes #174.
|
|
43a8836c
|
2020-05-31T18:46:21
|
|
Fix rebuilding docs, by hiding __attribute__((...)) behind a macro.
When enabled via `./configure --enable-rebuild-docs`,
`make -C doc libxml2-api.xml` will invoke apibuild.py
to rebuild libxml2-api.xml from the sources.
But the code added in
9fa3200cb366c726f7c8ef234282603bb9e8816d made it error out with
```
Parsing ../parser.c
Parse Error: parsing type : expecting a name
('Got token ', ('sep', '('))
('Last token: ', ('sep', '('))
('Token queue: ', [('name', 'destructor'), ('sep', ')'), ('sep', ')')])
('Line 14689 end: ', '')
```
|
|
|
9f42f6ba
|
2020-06-24T15:33:38
|
|
Don't follow next pointer on documents in xmlXPathRunStreamEval
RVTs from libxslt are document nodes which are linked using the 'next'
pointer. These pointers must never be used to navigate the document
tree. Otherwise, random content from other RVTs could be returned
when evaluating XPath expressions.
It's interesting that this seemingly long-standing bug wasn't
discovered earlier. This issue could also cause severe performance
degradation.
Fixes https://gitlab.gnome.org/GNOME/libxslt/-/issues/37
|
|
|
c0440868
|
2020-06-22T13:08:11
|
|
Copy xs:duration parser from libexslt
The duration parser in libexslt checks for integer overflows.
|
|
|
18425d3a
|
2020-06-21T19:14:23
|
|
Fix integer overflow in _xmlSchemaParseGYear
Found with libFuzzer and UBSan.
|
|
|
070d635e
|
2020-06-21T16:26:38
|
|
Fix integer overflow when parsing {min,max}Occurs
Clamp value to INT_MAX.
Found with libFuzzer and UBSan.
|
|
|
50f18830
|
2020-06-21T15:21:45
|
|
Fix another memory leak in xmlSchemaValAtomicType
Don't collapse language IDs twice.
Found with libFuzzer and ASan.
|
|
|
eac1c7e2
|
2020-06-21T14:42:00
|
|
Fuzz target for XML Schemas
This only tests the schema parser for now.
|
|
|
ffd31dbe
|
2020-06-21T12:14:19
|
|
Move entity recorder to fuzz.c
|
|
|
681f094e
|
2020-06-15T15:23:05
|
|
Fix unsigned integer overflow in htmlParseTryOrFinish
Cast to signed type before subtraction to avoid unsigned integer
overflow. Also use ptrdiff_t to avoid potential integer truncation.
Found with libFuzzer and UBSan.
|
|
|
31ca4a72
|
2020-06-15T18:47:53
|
|
Fix integer overflow in htmlParseCharRef
Fixes #115.
|
|
|
2f938203
|
2020-06-15T15:45:47
|
|
Fix undefined behavior in UTF16LEToUTF8
Don't perform arithmetic on null pointer.
Found with libFuzzer and UBSan.
|
|
|
536f421d
|
2020-06-15T12:20:54
|
|
Fuzz target for HTML parser
|
|
|
a697ed1e
|
2020-06-15T14:49:22
|
|
Fix return value of xmlCharEncOutput
Commit 407b393d introduced a regression caused by xmlCharEncOutput
returning 0 in case of success instead of the number of bytes written.
Always use its return value for nbchars in xmlOutputBufferWrite.
Fixes #166.
|
|
|
af893a58
|
2020-06-11T16:08:16
|
|
Update GitLab CI container
|
|
|
a28f7d87
|
2020-06-10T13:41:13
|
|
Never expand parameter entities in text declaration
When parsing the text declaration of external DTDs or entities, make
sure that parameter entities are not expanded. This also fixes a memory
leak in certain error cases.
The change to xmlSkipBlankChars assumes that the parser state is
maintained correctly when parsing external DTDs or parameter entities,
and might expose bugs in the code that were hidden previously.
Found by OSS-Fuzz.
|
|
|
487871b0
|
2020-06-10T13:23:43
|
|
Fix undefined behavior in xmlXPathTryStreamCompile
&NULL[0] is undefined behavior.
|
|
|
e98150d4
|
2020-06-09T13:45:31
|
|
Add options file for xml fuzzer
This will be picked up OSS-Fuzz, limiting the maximum input size to
80 KB and hopefully avoiding timeouts. Some of the timeouts seem to be
related to our suboptimal handling of excessive entity expansion.
The new fuzzers support external entities and make this problem even
more prominent.
|
|
|
2af3c2a8
|
2020-06-08T12:49:51
|
|
Fix use-after-free with validating reader
Just like IDs, IDREF attributes must be removed from the document's
refs table when they're freed by a reader. This bug is often hidden
because xmlAttr structs are reused and strings are stored in a
dictionary unless XML_PARSE_NODICT is specified.
Found by OSS-Fuzz.
|
|
|
00ed736e
|
2020-06-05T12:49:25
|
|
Add a couple of libFuzzer targets
- XML fuzzer
Currently tests the pull parser, push parser and reader, as well as
serialization. Supports splitting fuzz data into multiple documents
for things like external DTDs or entities. The seed corpus is built
from parts of the test suite.
- Regexp fuzzer
Seed corpus was statically generated from test suite.
- URI fuzzer
Tests parsing and most other functions from uri.c.
|
|
|
2e8cc66d
|
2020-05-30T15:40:08
|
|
xmlParseBalancedChunkMemory must not be called with NULL doc
There is no way to avoid memory leaks without a document to hold the
namespace list.
|
|
|
a0a8059b
|
2020-05-30T15:33:03
|
|
Revert "Fix memory leak in xmlParseBalancedChunkMemoryRecover"
This reverts commit 5a02583c7e683896d84878bd90641d8d9b0d0549.
Fixes #161.
|
|
|
ff009f99
|
2020-05-30T15:32:25
|
|
Fix memory leak in xmlXIncludeLoadDoc error path
Found by OSS-Fuzz.
|
|
a230b728
|
2020-04-10T19:22:07
|
|
win32: allow passing *FLAGS on command line
nmake is a primitive tool, so this is a primitive implementation:
append EXTRA_CFLAGS etc. variables.
Command line variables should be appended to allow overriding flags set
in the makefile.
It doesn't work to pass in CFLAGS like in make because that always
overrides the assignments in the makefile.
|
|
|
4f2aee18
|
2020-05-04T14:03:52
|
|
Make schema validation fail with multiple top-level elements
Closes #126.
|
|
106757e8
|
2020-04-10T14:52:03
|
|
Guard new calls to xmlValidatePopElement in xml_reader.c
Closes #154.
|
|
386fb276
|
2020-04-28T17:00:37
|
|
Add LIBXML_VALID_ENABLED to xmlreader
There are already LIBXML_VALID_ENABLED in this file to guard against
"--without-valid" at "./configure" step, but here they were missing.
|
|
|
e7ff2efc
|
2020-04-21T21:16:07
|
|
Configure file xmlwin32version.h.in on MSVC
|
|
|
e2f10494
|
2020-04-21T21:04:23
|
|
List headers individually
|
|
|
2a2c38f3
|
2020-04-21T00:53:12
|
|
Add CMake build files
Closes #24.
|
|
9fa3200c
|
2020-03-31T23:18:25
|
|
Call xmlCleanupParser on ELF destruction
Fixes #153.
|
|
e4fb3684
|
2020-02-28T12:48:14
|
|
Parenthesize Py<type>_Check() in ifs
In C, if expressions should be parenthesized.
PyLong_Check, PyUnicode_Check etc. happened to expand to a parenthesized
expression before, but that's not API to rely on.
Since Python 3.9.0a4 it needs to be parenthesized explicitly.
Fixes https://gitlab.gnome.org/GNOME/libxml2/issues/149
|
|
|
20c60886
|
2020-03-08T17:19:42
|
|
Fix typos
Resolves #133.
|
|
|
2a7b6684
|
2020-03-02T11:52:52
|
|
Disable LeakSanitizer
The GitLab runner doesn't run in privileged mode anymore [1], at least
for projects outside the GNOME group. Disable LeakSanitizer for now
as it needs the ptrace capability.
[1] https://gitlab.gnome.org/Infrastructure/Infrastructure/issues/251
|
|
|
c005c7a0
|
2020-02-11T16:35:20
|
|
Stop calling SAX getEntity handler from XMLReader
The getEntity handler was already invoked by xmlParseReference, so it's
useless to call it again. After the recent change, xmlSAX2GetEntity
won't load any kind of entities anyway.
|
|
|
32cb5dcc
|
2020-02-11T13:16:10
|
|
Add test case for recursive external parsed entities
|
|
|
f20daa9e
|
2020-02-11T13:13:52
|
|
Enable error tests with entity substitution
|
|
|
eddfbc38
|
2020-01-22T22:03:45
|
|
Don't load external entity from xmlSAX2GetEntity
Despite the comment, I can't see a reason why external entities must be
loaded in the SAX handler. For external entities, the handler is
typically first invoked via xmlParseReference which will later load the
entity on its own if it wasn't loaded yet.
The old code also lead to duplicated SAX events which makes it
basically impossible to reuse xmlSAX2GetEntity for a custom SAX parser.
See the change to the expected test output.
Note that xmlSAX2GetEntity was loading the entity via
xmlParseCtxtExternalEntity while xmlParseReference uses
xmlParseExternalEntityPrivate. In the previous commit, the two
functions were merged, trying to compensate for some slight differences
between the two mostly identical implementations.
But the more urgent reason for this change is that xmlParseReference
has the facility to abort early when recursive entities are detected,
avoiding what could practically amount to an infinite loop.
If you want to backport this change, note that the previous three
commits are required as well:
f9ea1a24 Fix copying of entities in xmlParseReference
5c7e0a9a Copy some XMLReader option flags to parser context
1a3e584a Merge code paths loading external entities
Found by OSS-Fuzz.
|
|
|
1a3e584a
|
2020-01-21T22:12:42
|
|
Merge code paths loading external entities
Merge xmlParseCtxtExternalEntity into xmlParseExternalEntityPrivate.
|
|
|
5c7e0a9a
|
2020-02-11T16:29:30
|
|
Copy some XMLReader option flags to parser context
The parser context stores some options both in the "options" bits and
extra members like "validate" or "replaceEntities". Which of these
are actually read is inconsistent, so make sure to also update the
bit field.
|
|
|
f9ea1a24
|
2020-02-11T16:17:34
|
|
Fix copying of entities in xmlParseReference
Before, reader mode would end up in a branch that didn't handle
entities with multiple children and failed to update ent->last, so the
hack copying the "extra" reader data wouldn't trigger. Consequently,
some empty nodes in entities are correctly detected now in the test
suite. (The detection of empty nodes in entities is still buggy,
though.)
|
|
7ffcd44d
|
2019-08-20T16:33:06
|
|
Fix memory leak in xmlSchemaValidateStream
When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
vctxt->xsiAssemble to 0 again which cause the alloced schema
can not be freed anymore.
Found with libFuzzer.
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
|
|
e45e06de
|
2020-01-31T13:16:37
|
|
Fix xmlSchemaGetCanonValue formatting for date and dateTime
Per https://www.w3.org/TR/xmlschema-2/#dateTime-lexical-representation,
the date portion is supposed to use '-' as the delimiter
|
|
|
c7c526d6
|
2020-01-13T18:49:01
|
|
Fix memory leak when shared libxml.dll is unloaded
When a multiple modules (process/plugins) all link to libxml2.dll
they will in fact share a single loaded instance of it.
It is unsafe for any of them to call xmlCleanupParser,
as this would deinitialize the shared state and break others that might
still have ongoing use.
However, on windows atexit is per-module (rather process-wide), so if used
*within* libxml2 it is possible to register a clean up when all users
are done and libxml2.dll is about to actually unload.
This allows multiple plugins to link with and share libxml2 without
a premature cleanup if one is unloaded, while still cleaning up if *all*
such callers are themselves unloaded.
|
|
|
453bdfb9
|
2020-01-13T18:28:34
|
|
Fix potentially-uninitialized critical section in Win32 DLL builds
If non-parser parts of libxml (e.g. xmlwriter) are used before a parser,
xmlOnceInit may have run (e.g. via the many paths to xmlGetGlobalState),
but not xmlInitThreads (which is called only by xmlInitParser)
Once globalkey != TLS_OUT_OF_INDEXES (which can happen in many ways),
DLLMAIN(DLL_THREAD_DETACH) may attempt to lock cleanup_helpers_cs
before it is valid. This may happen even if the thread whose exit
is triggering DllMain is from code which is not linked to libxml.
globalkey and cleanup_helpers_cs should be initialized together,
with cleanup_helpers_cs initialized first and deleted last.
|
|
|
c2e09f44
|
2020-02-11T11:32:23
|
|
Add xmlPopOutputCallbacks
Add function to pop a single set of output callbacks from the stack.
This was only implemented for input callbacks before.
Fixes #135.
|
|
|
b0725121
|
2020-01-10T15:55:07
|
|
Fix integer overflow in xmlBufferResize
Found by OSS-Fuzz.
|
|
|
3e7e75be
|
2020-01-02T15:19:57
|
|
Minor fixes to configure.js
- Semicolon coding style
- Remove duplicated option check
Found by lgtm.com
|
|
|
52649b63
|
2020-01-02T14:45:28
|
|
Check for overflow when allocating two-dimensional arrays
Found by lgtm.com
|
|
|
9bd7abfb
|
2020-01-02T14:14:48
|
|
Remove useless comparisons
Found by lgtm.com
|
|
|
c9faa292
|
2020-01-02T14:12:39
|
|
Fix overflow check in xmlNodeDump
Store return value of xmlBufNodeDump in a size_t before checking for
integer overflow.
Found by lgtm.com
|
|
8f62ac92
|
2020-01-01T19:16:10
|
|
Updated Python test reader2.py
Added all test cases that have a non-empty error in result/valid/*.xml.err
Restructured to make it easier extensible with new test cases
Added coding cookie because there is non-ASCII in the error messages
|
|
|
8c3e52eb
|
2019-12-31T21:49:58
|
|
Updated python/tests/tstLastError.py
libxml2.registerErrorHandler(None,None):
None is not acceptable as first argument
failUnlessEqual replaced by assertEqual
|
|
|
0e1a49c8
|
2019-12-12T17:30:55
|
|
Fix infinite loop in xmlStringLenDecodeEntities
When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
return NULL which cause a infinite loop in xmlStringLenDecodeEntities
Found with libFuzzer.
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
|
|
|
0815302d
|
2019-12-06T12:27:29
|
|
Fix freeing of nested documents
Apparently, some libxslt RVTs can contain nested document nodes, see
issue #132. I'm not sure how this happens exactly but it can cause a
segfault in xmlFreeNodeList after the changes in commit 0762c9b6.
Make sure not to touch the (nonexistent) `content` member of xmlDocs.
|
|
|
2c80fc91
|
2019-12-02T11:30:30
|
|
Fix more memory leaks in error paths of XPath parser
Found by OSS-Fuzz.
|
|
3c8a3e99
|
2019-11-07T12:59:10
|
|
Use random seed in xmlDictComputeFastKey
xmlDictComputeFastKey is only used for small tables, so this shouldn't
be a security problem.
|
|
|
42942066
|
2019-11-11T13:49:11
|
|
Fix memory leaks of encoding handlers in xmlsave.c
Fix leak of iconv/ICU encoding handler in xmlSaveToBuffer.
Fix leaks of iconv/ICU encoding handlers in xmlSaveTo* error paths.
Closes #127.
|
|
|
2a357ab9
|
2019-11-11T11:29:17
|
|
Fix xml2-config error code
Return an error code if called with an unknown option.
|
|
|
d5f2f74d
|
2019-11-11T11:27:40
|
|
Fix memory leak in error path of XPath expr parser
Also propagate memory errors.
Found by OSS-Fuzz.
|
|
|
bf2e9617
|
2019-11-07T12:54:01
|
|
Fix overflow handling in xmlBufBackToBuffer
Don't overwrite 'use' and 'size' members after clamping to INT_MAX.
Thanks to Ranier Vilela for pointing this out in merge request !56.
|