Hash :
40f58521
Author :
Date :
2017-05-26T20:16:35
Fix axis traversal from attribute and namespace nodes When traversing the "preceding" axis from an attribute node, we must first go up to the attribute's containing element. Otherwise, text children of other attributes could be returned. This made it possible to hit a code path in xmlXPathNextAncestor which contained another bug: The attribute node was initialized with the context node instead of the current node. Normally, this code path is only hit via xmlXPathNextAncestorOrSelf in which case the current and context node are the same. The combination of the two bugs could result in an infinite loop, found with libFuzzer. Traversing the "following" and the "preceding" axis from namespace nodes should be handled similarly. This wasn't supported at all previously.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
========================
Expression: /doc/elem/namespace::node()/..
Object is a Node Set :
Set contains 1 nodes:
1 ELEMENT elem
namespace ns2 href=nsuri2
========================
Expression: /doc/elem/namespace::*/self::node()[true()]
Object is a Node Set :
Set contains 3 nodes:
1 namespace xml href=http://www.w3.org/XML/1998/namespace
2 namespace ns1 href=nsuri1
3 namespace ns2 href=nsuri2
========================
Expression: //*[namespace::ns1]
Object is a Node Set :
Set contains 4 nodes:
1 ELEMENT doc
namespace ns1 href=nsuri1
2 ELEMENT preceding
3 ELEMENT elem
namespace ns2 href=nsuri2
4 ELEMENT following
========================
Expression: /doc/elem/namespace::ns2/following::*
Object is a Node Set :
Set contains 1 nodes:
1 ELEMENT following
========================
Expression: /doc/elem/namespace::ns2/preceding::*
Object is a Node Set :
Set contains 1 nodes:
1 ELEMENT preceding