xmlreader.c


Log

Author Commit Date CI Message
Nick Wellnhofer f505dcae 2024-06-26T14:11:34 tree: Remove underscores from xmlRegisterCallbacks
Nick Wellnhofer 57004006 2024-06-17T14:37:54 reader: Fix xmlTextReaderReadString Regressed in commit 7cbf609a. Should fix #738.
Nick Wellnhofer fd7d9e5e 2024-06-11T14:47:03 reader: Add callbacks for resource loader
Nick Wellnhofer e75e878e 2024-05-20T13:58:22 doc: Update and fix documentation
Nick Wellnhofer 16fb1028 2024-05-10T12:00:12 reader: Fix error reporting with walker Abort earlier in xmlTextReaderRead if an error was raised.
Nick Wellnhofer 81611e06 2024-05-05T18:16:44 reader: Don't call xmlCtxtErrMemory with NULL ctxt This can happen in "walker" mode.
Nick Wellnhofer d2f623d1 2024-04-30T16:36:44 reader: Report malloc failure in xmlTextReaderConstValue
Nick Wellnhofer 7cbf609a 2024-04-18T12:57:15 reader: Make xmlTextReaderReadString non-recursive Also report malloc failures. Fixes #607.
Nick Wellnhofer f6964781 2024-04-22T12:23:39 reader: Rework xmlTextReaderRead{Inner,Outer}Xml Use an xmlOutputBuffer. Report malloc failures.
Nick Wellnhofer cdb3103b 2024-04-22T12:23:06 reader: Report malloc failures
Nick Wellnhofer d2daf33e 2024-04-16T14:53:07 reader: Fix preservation of attributes Don't use 'curnode' which might be an attribute or namespace node which doesn't have an 'extra' member.
Nick Wellnhofer 1b4bf22c 2024-03-17T15:05:42 xmlreader: Fix memory leak in xmlTextReaderFreeProp Short-lived regression.
Nick Wellnhofer d0d6174e 2024-02-29T19:38:29 valid: Rework xmlAddID
Nick Wellnhofer 84a71860 2024-02-26T15:14:28 xmlreader: Fix xmlTextReaderConstEncoding Regression from commit f1c1f5c6. Fixes #697.
Nick Wellnhofer 13962b06 2023-10-15T13:56:34 xmlreader: Clean up error handling Make sure that xmlTextReaderRead returns -1 immediately if the reader is in an error state.
Nick Wellnhofer ddda373e 2024-02-06T12:53:03 xmlreader: Make xmlTextReaderValidateEntity return an error code This makes sure that xmlTextReaderRead returns -1 if a memory allocation fails.
Nick Wellnhofer 1a66b176 2023-10-14T22:45:54 [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking Fixes a use-after-free if XML Reader if used with DTD validation and XInclude expansion. Fixes #604.
Nick Wellnhofer 12f0bb94 2024-01-05T01:14:28 parser: Synchronize more options
Nick Wellnhofer a5dcf0f4 2023-12-26T03:27:23 parser: Mark more parser context members as unused
Nick Wellnhofer 955c177f 2023-12-23T00:58:36 parser: Stop using 'directory' struct member This was only used as a pointless fallback for URI resolution.
Nick Wellnhofer c8f1f4a2 2023-12-21T17:30:38 doc: Improve documentation of error handlers
Nick Wellnhofer 23345a1c 2023-12-19T19:52:28 io: Report IO errors through xmlCtxtErrIO This is also a new public API function to be used in external entity loaders.
Nick Wellnhofer ed6596a4 2023-12-18T19:47:47 reader: Simplify error handling Only use structured error handlers for parser, Schemas and RelaxNG contexts. Also use structured error handler for XInclude context. Remove TODO macro.
Nick Wellnhofer 54c70ed5 2023-12-18T19:31:29 parser: Improve error handling Introduce xmlCtxtSetErrorHandler allowing to set a structured error for a parser context. There already was the "serror" SAX handler but this always receives the parser context as argument. Start to use xmlRaiseMemoryError. Remove useless arguments from memory error functions. Rename xmlErrMemory to xmlCtxtErrMemory. Remove a few calls to xmlGenericError. Remove support for runtime entity debugging.
Nick Wellnhofer 157df344 2023-12-10T18:23:53 xmlreader: Report malloc failures Fix many places where malloc failures aren't reported. Introduce a new API function xmlTextReaderGetLastError.
Nick Wellnhofer 5cffba83 2023-11-28T15:34:28 Rework va_copy fallback va_copy is a macro, so it can be detected without a feature test. Fallback to __va_copy or memcpy.
Nick Wellnhofer 61034116 2023-10-24T15:02:36 error: Make more xmlError structs constant Prepare for future changes, see 45470611.
Nick Wellnhofer 81741ea4 2023-09-21T16:29:28 xmlreader: Fix EOF detection in xmlTextReaderPushData
Nick Wellnhofer 4e1c13eb 2023-09-18T14:45:10 debug: Remove debugging code This is barely useful these days and only clutters the code base.
Nick Wellnhofer ed3bd052 2023-08-20T20:48:10 parser: Allow to set maximum amplification factor
Nick Wellnhofer e2ab48b9 2023-08-14T15:05:30 malloc-fail: Fix unsigned integer overflow in xmlTextReaderPushData Return immediately if xmlParserInputBufferRead fails. Found by OSS-Fuzz, see #344.
Nick Wellnhofer 320f5084 2023-04-30T18:25:09 parser: Improve handling of encoding and IO errors Make sure that xmlCharEncInput, xmlParserInputBufferPush and xmlParserInputBufferGrow set the correct error code in the xmlParserInputBuffer. Handle errors when calling these functions.
Nick Wellnhofer c266a220 2023-01-22T18:18:00 malloc-fail: Handle memory errors in xmlTextReaderEntPush Unfortunately, there's no way to properly report memory errors. Found with libFuzzer, see #344.
Nick Wellnhofer f67dc618 2022-12-17T00:14:56 xmlreader: Try to fix regression when reading from memory This reverts a change from commit 2059df53, see #462.
Nick Wellnhofer dd3569ea 2022-12-08T02:43:17 Remove XMLDECL macro from .c files
Nick Wellnhofer 2059df53 2022-11-14T22:27:58 buf: Deprecate static/immutable buffers
Nick Wellnhofer 1ca0dfec 2022-11-14T22:00:50 reader: Switch to xmlParserInputBufferCreateMem This is less efficient but can't result in input buffer overreads. Fixes #326.
Nick Wellnhofer 4955e0c9 2022-11-14T20:16:22 io: Don't shrink memory input buffers
Nick Wellnhofer eef0a739 2022-10-30T12:21:20 xinclude: Implement "streaming" mode When using xmlreader, XPointer expressions in XIncludes simply cannot work. Expressions can reference nodes which weren't parsed yet or which were already deleted. After fixing nested XIncludes, we reference includes which were parsed previously. When streaming, these nodes could have been deleted, leading to use-after-free errors. Disallow XPointer expressions and truncate the include table in streaming mode.
Nick Wellnhofer ad338ca7 2022-09-01T01:18:30 Remove explicit integer casts Remove explicit integer casts as final operation - in assignments - when passing arguments - when returning values Remove casts - to the same type - from certain range-bound values The main motivation is that these explicit casts don't change the result of operations and only render UBSan's implicit-conversion checks useless. Removing these casts allows UBSan to detect cases where truncation or sign-changes occur unexpectedly. Document some explicit casts as truncating and add a few missing ones.
Nick Wellnhofer 0f568c0b 2022-08-26T01:22:33 Consolidate private header files Private functions were previously declared - in header files in the root directory - in public headers guarded with IN_LIBXML - in libxml.h - redundantly in source files that used them. Consolidate all private header files in include/private.
David Kilzer c50196c1 2022-04-10T20:02:47 Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser When creating an xmlTextReaderPtr using xmlReaderForMemory(), there are two optional API functions that can be used: - xmlTextReaderClose() may be called prior to calling xmlFreeTextReader() to free parsing resources and close the xmlTextReaderPtr without freeing it. - xmlTextReaderCurrentDoc() may be called to return an xmlDocPtr that's owned by the caller, and must be free using xmlFreeDoc() after calling xmlFreeTextReader(). The use-after-free issues occur when calling xmlTextReaderClose() before xmlFreeTextReader(), with different issues occurring depending on whether xmlTextReaderCurrentDoc() is also called. * xmlreader.c: (xmlFreeTextReader): - Move code to xmlTextReaderClose(), remove duplicate code, and call xmlTextReaderClose() if it hasn't been called yet. (xmlTextReaderClose): - Move call to xmlFreeNode(reader->faketext) from xmlFreeTextReader() to fix a use-after-free bug when calling xmlTextReaderClose() before xmlFreeTextReader(), but not when using xmlTextReaderCurrentDoc(). The bug was introduced in 2002 by commit beb70bd39. In 2009 commit f4653dcd8 fixed the use-after-free that occurred every time xmlFreeTextReader() was called, but not the case where xmlTextReaderClose() was called first. - Move post-parsing validation code from xmlFreeTextReader() to fix a second use-after-free when calling xmlTextReaderClose() before xmlFreeTextReader(). This regressed in v2.9.10 with commit 57a3af56f.
Nick Wellnhofer d99ddd9b 2022-03-05T21:46:40 Improve buffer allocation scheme In most places, we really need the double-it scheme to avoid quadratic behavior. The hybrid scheme still can cause many reallocations and the bounded scheme doesn't seem to provide meaningful protection in xmlreader.c.
Nick Wellnhofer 4a8c71eb 2022-03-04T03:35:57 Remove DOCBparser This code has been broken and deprecated since version 2.6.0, released in 2003. Because of a bug in commit 961b535c, DOCBparser.c was never compiled since 2012. I couldn't find a Debian package using any of its symbols, so it seems safe to remove this module.
Nick Wellnhofer 776d15d3 2022-03-02T00:29:17 Don't check for standard C89 headers Don't check for - ctype.h - errno.h - float.h - limits.h - math.h - signal.h - stdarg.h - stdlib.h - string.h - time.h Stop including non-standard headers - malloc.h - strings.h
Nick Wellnhofer 346c3a93 2022-02-20T18:46:42 Remove elfgcchack.h The same optimization can be enabled with -fno-semantic-interposition since GCC 5. clang has always used this option by default.
Nick Wellnhofer 274a1b5b 2022-02-20T16:05:53 Remove unneeded code in xmlreader.c Now that no references to ID and IDREF attributes are stored in streaming validation mode, there's no need to try and remove them. Also remove xmlTextReaderFreeIDTable which was identical to xmlFreeIDTable.
Nick Wellnhofer 31c6ce3b 2020-11-09T17:55:44 Avoid call stack overflow with XML reader and recursive XIncludes Don't process XIncludes in the result of another inclusion to avoid infinite recursion resulting in a call stack overflow. This is something the XInclude engine shouldn't allow but correct handling of intra-document includes would require major changes. Found by OSS-Fuzz.
Nick Wellnhofer b215c270 2020-09-13T12:19:48 Fix cleanup of attributes in XML reader xml:id creates ID attributes even in documents without a DTD, so the check in xmlTextReaderFreeProp must be changed to avoid use after free. Found by OSS-Fuzz.
Nick Wellnhofer f0fd1b67 2020-08-26T00:16:38 Limit size of free lists in XML reader when fuzzing Keeping objects on a free list can hide memory errors. Only allow a single node on free lists used by the XML reader when fuzzing. This should hide fewer errors while still exercising the free list logic.
Nick Wellnhofer ba589adc 2020-08-25T23:50:39 Fix double free in XML reader with XIncludes An XInclude with empty fallback could lead to a double free in xmlTextReaderRead. Found by OSS-Fuzz.
Nick Wellnhofer 2af3c2a8 2020-06-08T12:49:51 Fix use-after-free with validating reader Just like IDs, IDREF attributes must be removed from the document's refs table when they're freed by a reader. This bug is often hidden because xmlAttr structs are reused and strings are stored in a dictionary unless XML_PARSE_NODICT is specified. Found by OSS-Fuzz.
Daniel Cheng 106757e8 2020-04-10T14:52:03 Guard new calls to xmlValidatePopElement in xml_reader.c Closes #154.
Łukasz Wojniłowicz 386fb276 2020-04-28T17:00:37 Add LIBXML_VALID_ENABLED to xmlreader There are already LIBXML_VALID_ENABLED in this file to guard against "--without-valid" at "./configure" step, but here they were missing.
Nick Wellnhofer 20c60886 2020-03-08T17:19:42 Fix typos Resolves #133.
Nick Wellnhofer c005c7a0 2020-02-11T16:35:20 Stop calling SAX getEntity handler from XMLReader The getEntity handler was already invoked by xmlParseReference, so it's useless to call it again. After the recent change, xmlSAX2GetEntity won't load any kind of entities anyway.
Nick Wellnhofer 5c7e0a9a 2020-02-11T16:29:30 Copy some XMLReader option flags to parser context The parser context stores some options both in the "options" bits and extra members like "validate" or "replaceEntities". Which of these are actually read is inconsistent, so make sure to also update the bit field.
Jared Yanovich 2a350ee9 2019-09-30T17:04:54 Large batch of typo fixes Closes #109.
Nick Wellnhofer 664f8810 2019-09-26T11:01:58 Fix use-after-free in xmlTextReaderFreeNodeList Recent commit 1fbcf40 caused a use-after-free read because it didn't account for the fact that xmlTextReaderFreeDoc frees entities before freeing entity references via xmlTextReaderFreeNodeList. Found by OSS-Fuzz.
Nick Wellnhofer 1fbcf409 2019-09-23T17:13:05 Make xmlTextReaderFreeNodeList non-recursive Avoid call stack overflow when freeing deeply nested documents. Found by OSS-Fuzz.
Nick Wellnhofer 6705f4d2 2019-09-16T15:45:27 Remove executable bit from non-executable files
zhouzhongyuan 0571b4e6 2019-08-09T15:39:17 Fix null deref in xmlreader buffer
Nick Wellnhofer 8161b463 2019-02-28T12:25:05 Remove debug printf in xmlreader.c Fixes #46.
Nick Wellnhofer 2c8dc715 2019-02-25T12:00:50 Fix null pointer dereference in xmlTextReaderReadOuterXml Fix a regression caused by commit 39fbfb4f. If xmlTextReaderReadOuterXml is called on a pristine xmlReader, the current node is NULL and must not be dereferenced. Move the call to xmlTextReaderExpand to the start of the function to make sure that we have a valid node. Fixes #43.
Nick Wellnhofer 26828cb3 2019-01-07T16:52:42 Fix commit "Memory leak in xmlFreeID (xmlreader.c)" The recent commit "Memory leak in xmlFreeID (xmlreader.c)" introduced a double-free.
Nick Wellnhofer 157cd3ae 2018-11-24T15:46:00 Fix NULL pointer deref in xmlTextReaderValidateEntity Found by OSS-Fuzz.
Nick Wellnhofer 57a3af56 2018-11-24T12:14:55 Memory leak in xmlFreeTextReader In error cases, there might still be elements in the vstate table. Since vstateVPop in valid.c is private, we have to pop the elements with xmlValidatePopElement. This inspects nodes of the document, so the reader doc must be freed after the clearing the vstate table. Found by OSS-Fuzz.
Nick Wellnhofer efe8c093 2018-11-24T11:39:32 Memory leak in xmlFreeID (xmlreader.c) Fix a memory leak in xmlReader's private copy of xmlFreeID. Only affects validation with NODICT. Found by OSS-Fuzz.
Nick Wellnhofer 6fc04d71 2018-11-23T22:56:03 Revert "Support xmlTextReaderNextSibling w/o preparsed doc" This reverts commit bfec41b3de1cbd35e547b57c80ae3a5101f8891c which caused problems with the XML::LibXML Perl bindings. https://mail.gnome.org/archives/xml/2018-November/msg00010.html
Mohammed Sadiq c7461f65 2018-11-03T21:19:13 reader: Fix documentation comment
Nick Wellnhofer 39fbfb4f 2018-09-25T12:57:04 Use actual doc in xmlTextReaderRead*Xml Otherwise the encoding of the document is ignored and non-ASCII characters are serialized as numeric references even if the encoding is specified as UTF-8.
Felix Bünemann bfec41b3 2018-06-23T12:14:28 Support xmlTextReaderNextSibling w/o preparsed doc This implements missing support for readers that are not based on a preparsed document in xmlTextReaderNextSibling.
Felix Bünemann d2ef114c 2018-06-23T13:08:46 Fix xmlTextReaderNext with preparsed document This fixes the traversal of parent nodes using xmlTextReaderNext() when the reader is based on a preparsed document (created using xmlReaderWalker(doc)). Without this fix the parser will abort even though there are parent nodes it should traverse to, if it is not currently on an element or attribute node. This is incorrect, since it can be for example on a text node when it needs to enter backtracking.
Nick Wellnhofer e03f0a19 2017-11-09T16:42:47 Fix hash callback signatures Make sure that all parameters and return values of hash callback functions exactly match the callback function type. This is required to pass clang's Control Flow Integrity checks and to allow compilation to asm.js with Emscripten. Fixes bug 784861.
Nick Wellnhofer 5a0ae66d 2017-06-17T23:20:38 Documentation fixes Fixes bug 347465, bug 599433, bug 624550, bug 698253.
David Kilzer 4472c3a5 2016-05-13T15:13:17 Fix some format string warnings with possible format string vulnerability For https://bugzilla.gnome.org/show_bug.cgi?id=761029 Decorate every method in libxml2 with the appropriate LIBXML_ATTR_FORMAT(fmt,args) macro and add some cleanups following the reports.
Jan Pokorný bb654feb 2016-04-13T16:56:07 Fix typos: dictio{ nn -> n }ar{y,ies} Signed-off-by: Jan Pokorný <jpokorny@redhat.com>
Daniel Veillard 213f1fe0 2015-04-14T17:41:48 CVE-2015-1819 Enforce the reader to run in constant memory One of the operation on the reader could resolve entities leading to the classic expansion issue. Make sure the buffer used for xmlreader operation is bounded. Introduce a new allocation type for the buffers for this effect.
Daniel Veillard 91309d3a 2014-10-06T20:07:19 Pointer dereferenced before null check For https://bugzilla.gnome.org/show_bug.cgi?id=707027 A few pointer dereference before NULL check fixed. Removed a useless test
Gaurav Gupta d319eb92 2014-10-06T12:24:17 Fix Enum check and missing break for https://bugzilla.gnome.org/show_bug.cgi?id=737403 In file xmlreader.c 1. An enum is checked to proper value instead of checking like a boolean. 2. Missing break statement added.
Patrick Monnerat 0f7a26d8 2013-12-12T15:04:43 Improve va_list portability Support for va_list declared as an array (cannot be referenced explicitly)
Daniel Veillard eea38159 2013-01-28T16:55:30 Cleanup on duplicate test expressions As pointed out by Thomas Jarosch <thomas.jarosch@intra2net.com> Daniel
Michael Wood fb27e2cd 2012-09-28T08:59:33 Fix spelling of "length".
Daniel Veillard f8e3db04 2012-09-11T13:26:36 Big space and tab cleanup Remove all space before tabs and space and tabs at end of lines.
Daniel Veillard 97fa5b3c 2012-08-14T11:01:07 Fix file and line report for XSD SAX and reader streaming validation Things now work correctly at the xmllint level: thinkpad:~/XML -> xmllint --sax --noout --schema test_schema.xsd test_xml.xml test_xml.xml:72721: Schemas validity error : Element 'level1': Missing child element(s). Expected is ( level2 ). test_xml.xml fails to validate thinkpad:~/XML -> xmllint --stream --schema test_schema.xsd test_xml.xml test_xml.xml:72721: Schemas validity error : Element 'level1': Missing child element(s). Expected is ( level2 ). test_xml.xml fails to validate thinkpad:~/XML -> * error.c: fix a corner case of not reporting lines when we should * include/libxml/xmlschemas.h doc/symbols.xml: had to add new entry points to set the filename on a validation context and a locator callback used to fetch the line and file from the context * xmlschemas.c: add the new entry points xmlSchemaValidateSetFilename() and xmlSchemaValidateSetLocator(), plus make sure the error reporting routine gets the information if available. Add a locator for SAX. * xmlreader.c: add and plug a locator for readers.
Daniel Veillard 3e62adbe 2012-08-09T14:24:02 Adding various checks on node type though the API Specifially checking against namespace nodes before accessing node pointers
Daniel Veillard 61551a1e 2012-07-16T16:28:47 Cleanup function xmlBufResetInput() to set input from Buffer This was scattered in a number of modules, xmlParserInputPtr have usually their base, cur and end pointer set from an xmlBuf used as input. * buf.c buf.h: add a new function implementing this setup * parser.c HTMLparser.c catalog.c parserInternals.c xmlreader.c use the new function instead of digging into the buffer in all those modules
Daniel Veillard 8aebce3e 2012-07-16T14:42:31 Convert XMLReader to the new input buffers A few direct access were replaced, and also one internal xmlBuffer structure is converted to use xmlBuf instead
Daniel Veillard c508fa3f 2012-07-18T17:39:56 Fix a failure to report xmlreader parsing failures Related to https://bugzilla.gnome.org/show_bug.cgi?id=654567 the problem is that the provided patch failed to raise an error on xmlTextReaderRead() return when an actual parsing error occured
Andy Lutomirski 9d9685ad 2012-05-15T20:10:25 xmlTextReader bails too quickly on error For https://bugzilla.gnome.org/show_bug.cgi?id=654567 I use xmlTextReader to parse failed that might be incomplete. These files are the beginning of a well-formed file, but the end is missing so the file as a whole is not well-formed. The problem is that xmlTextReader starts returning errors when it encounters the early EOF, even though I haven't finished reading all of the valid data in the file. It would be helpful if xmlTextReader kept working until the very end.
Daniel Veillard 2c437da7 2012-05-11T12:08:15 Fix a wrong return value in previous patch
Lin Yi-Li 24464be6 2012-05-10T16:14:55 Avoid memory leak if xmlParserInputBufferCreateIO fails For https://bugzilla.gnome.org/show_bug.cgi?id=643949 In case of error on an IO creation input the given context is terminated with the given close function, except if the error happened in xmlParserInputBufferCreateIO. This can lead to a resource leak which is fixed by this patch.
Noam Postavsky 15794990 2012-03-19T16:08:16 add function xmlTextReaderRelaxNGValidateCtxt() Since there is xmlTextReaderSchemaValidateCtxt() it seems like there should be an equivalent RelaxNG function. The attached patch adds it. The code is essentially the same as Schema implementation, but I'm uncertain as to how to add things to the documentation and test suite: there seems to be a lot of auto-generation going on.
Rob Richards 5b9dde3e 2010-05-05T07:59:44 xmlTextReaderReadOuterXml should handle DTD * xmlreader.c: fix description of xmlTextReaderReadOuterXml and support DTD
Daniel Veillard 76d36458 2009-09-07T11:19:33 Fixing assorted potential problems raised by scan * encoding.c parser.c relaxng.c runsuite.c tree.c xmlreader.c xmlschemas.c: nothing really serious but better safe than sorry
Daniel Veillard f4653dcd 2009-08-21T18:40:50 447899 potential double free in xmlFreeTextReader * xmlreader.c: a document may still be referenced by fakenode, just free fakenode before freeing the document.
Daniel Veillard aacc2a24 2009-08-11T18:31:42 560524 – xmlTextReaderLocalName description * xmlreader.c: document all functions returning xmlChar * that they need to free the result, and some space/tabs cleanups
Daniel Veillard 7e65fad1 2008-09-25T14:55:21 patch from Riccardo Scussat fixing custom error handlers problems. daniel * xmlreader.c: patch from Riccardo Scussat fixing custom error handlers problems. daniel svn path=/trunk/; revision=3795
Daniel Veillard bfa5cf1c 2008-08-27T15:33:28 add an --with-coverage configure option and a 'make cov' target based on * configure.in Makefile.am: add an --with-coverage configure option and a 'make cov' target based on gcc profiling and the lcov tool. Currently at 68.9% coverage out of 'make check' and runsuite executions. * xmlreader.c: remove warnings due to C++ comments Daniel svn path=/trunk/; revision=3780
Daniel Veillard aa6de47e 2008-08-25T14:53:31 applied patch from Aswin to fix tree skipping fixed a comment and added a * xmlreader.c: applied patch from Aswin to fix tree skipping * include/libxml/entities.h entities.c: fixed a comment and added a new xmlNewEntity() entry point * runtest.c: be less verbose * tree.c: space and tabs cleanups daniel svn path=/trunk/; revision=3774