tree 593004c2cf68719db470c7ab1124696b2cf20688
parent 178ba47be52f77f7b90c6d18f45d7f53b5ea2aff
author Brian C. Young <bcyoung@google.com> 1491248762 -0700
committer Brian C. Young <bcyoung@google.com> 1491855714 -0700

DO NOT MERGE: Fix XPointer paths beginning with range-to

The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.

The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.

Found with afl-fuzz.

Fixes CVE-2016-5131.

Bug: 36554209
Change-Id: I2bd369290a884c432d16796884d48db6285f8502