Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / libxml2 / 178ba47be52f77f7b90c6d18f45d7f53b5ea2aff
commit178ba47be52f77f7b90c6d18f45d7f53b5ea2aff[log] [tgz]
authorBrian C. Young <bcyoung@google.com>Mon Apr 03 12:39:04 2017 -0700
committerBrian C. Young <bcyoung@google.com>Mon Apr 10 13:21:54 2017 -0700
treeacd002f00b02475c145242de74b193e6a4b199bb
parent1a54b826b810c6c8b9055c737034f752e3db4cdb [diff]
DO NOT MERGE: Disallow namespace nodes in XPointer ranges

Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

Found with afl-fuzz.

Fixes CVE-2016-4658.

Bug: 36554207
Change-Id: Ie570c4a53ae8ca82ed4ca19701ab7d8ba9b0468f
1 file changed
tree: acd002f00b02475c145242de74b193e6a4b199bb
  1. include/
  2. Android.mk
  3. AUTHORS
  4. buf.c
  5. buf.h
  6. c14n.c
  7. catalog.c
  8. chvalid.c
  9. CleanSpec.mk
  10. config.h
  11. Copyright
  12. debugXML.c
  13. dict.c
  14. DOCBparser.c
  15. elfgcchack.h
  16. enc.h
  17. encoding.c
  18. entities.c
  19. error.c
  20. globals.c
  21. HACKING
  22. hash.c
  23. HTMLparser.c
  24. HTMLtree.c
  25. legacy.c
  26. libxml.h
  27. list.c
  28. MAINTAINERS
  29. MODULE_LICENSE_MIT
  30. nanoftp.c
  31. nanohttp.c
  32. parser.c
  33. parserInternals.c
  34. pattern.c
  35. README
  36. relaxng.c
  37. save.h
  38. SAX.c
  39. SAX2.c
  40. schematron.c
  41. testlimits.c
  42. threads.c
  43. timsort.h
  44. tree.c
  45. trio.c
  46. trio.h
  47. triodef.h
  48. trionan.c
  49. trionan.h
  50. triop.h
  51. triostr.c
  52. triostr.h
  53. uri.c
  54. valid.c
  55. xinclude.c
  56. xlink.c
  57. xmlcatalog.c
  58. xmlIO.c
  59. xmllint.c
  60. xmlmemory.c
  61. xmlmodule.c
  62. xmlreader.c
  63. xmlregexp.c
  64. xmlsave.c
  65. xmlschemas.c
  66. xmlschemastypes.c
  67. xmlstring.c
  68. xmlunicode.c
  69. xmlwriter.c
  70. xpath.c
  71. xpointer.c