kc3-lang/libxml2/result/XInclude/ns1.xml.rdr

• Show log

  Commit

• Hash : 652dd12a
  Author :
  Date : 2022-02-08T03:29:24
  

  [CVE-2022-23308] Use-after-free of ID and IDREF attributes
  
  If a document is parsed with XML_PARSE_DTDVALID and without
  XML_PARSE_NOENT, the value of ID attributes has to be normalized after
  potentially expanding entities in xmlRemoveID. Otherwise, later calls
  to xmlGetID can return a pointer to previously freed memory.
  
  ID attributes which are empty or contain only whitespace after
  entity expansion are affected in a similar way. This is fixed by
  not storing such attributes in the ID table.
  
  The test to detect streaming mode when validating against a DTD was
  broken. In connection with the defects above, this could result in a
  use-after-free when using the xmlReader interface with validation.
  Fix detection of streaming mode to avoid similar issues. (This changes
  the expected result of a test case. But as far as I can tell, using the
  XML reader with XIncludes referencing the root document never worked
  properly, anyway.)
  
  All of these issues can result in denial of service. Using xmlReader
  with validation could result in disclosure of memory via the error
  channel, typically stderr. The security impact of xmlGetID returning
  a pointer to freed memory depends on the application. The typical use
  case of calling xmlGetID on an unmodified document is not affected.
  

Download

• result/XInclude/ns1.xml.rdr

• 0 1 doc 0 0
  1 14 #text 0 1 
      
  1 1 xi:include 1 0
  1 14 #text 0 1 
      
  1 1 elem 0 0
  2 14 #text 0 1 
          
  2 1 ns:elem 1 0
  2 14 #text 0 1 
      
  1 15 elem 0 0
  1 14 #text 0 1 
      
  1 14 #text 0 1 
              
  1 1 ns:elem 1 0
  1 14 #text 0 1 
          
  1 14 #text 0 1 
  
  0 15 doc 0 0
  

Download