-
Show log
Commit
-
Hash : 6a12be77
Author :
Date : 2023-01-31T12:46:30
malloc-fail: Avoid use-after-free after unsuccessful valuePush In xpath.c there's a lot of code like: valuePush(ctxt, xmlCacheNewX()); ... valuePop(ctxt); If xmlCacheNewX fails, no value will be pushed on the stack. If there's no error check in between, valuePop will pop an unrelated value which can lead to use-after-free errors. Instead of trying to fix all call sites, we simply stop popping values if an error was signaled. This requires to change the CHECK_TYPE macro which is often used to determine whether a value can be safely popped. Found with libFuzzer, see #344.
-
Files
- HTMLparser.h
- HTMLtree.h
- Makefile.am
- SAX.h
- SAX2.h
- c14n.h
- catalog.h
- chvalid.h
- debugXML.h
- dict.h
- encoding.h
- entities.h
- globals.h
- hash.h
- list.h
- nanoftp.h
- nanohttp.h
- parser.h
- parserInternals.h
- pattern.h
- relaxng.h
- schemasInternals.h
- schematron.h
- threads.h
- tree.h
- uri.h
- valid.h
- xinclude.h
- xlink.h
- xmlIO.h
- xmlautomata.h
- xmlerror.h
- xmlexports.h
- xmlmemory.h
- xmlmodule.h
- xmlreader.h
- xmlregexp.h
- xmlsave.h
- xmlschemas.h
- xmlschemastypes.h
- xmlstring.h
- xmlunicode.h
- xmlversion.h.in
- xmlwriter.h
- xpath.h
- xpathInternals.h
- xpointer.h
-
Properties
