Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / libxml2 / d1af1e51784da0ffde51d2c05dde2a9123250ac0
commitd1af1e51784da0ffde51d2c05dde2a9123250ac0[log] [tgz]
authorBrian C. Young <bcyoung@google.com>Mon Apr 03 12:46:02 2017 -0700
committerBrian C. Young <bcyoung@google.com>Mon Apr 10 13:36:45 2017 -0700
tree7071e9c5d4835f5b45a0701c9100315623fe32ce
parent1d8878ba3247d70c3ac6fa27df0786dadc54baca [diff]
DO NOT MERGE: Fix XPointer paths beginning with range-to

The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.

The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.

Found with afl-fuzz.

Fixes CVE-2016-5131.

Bug: 36554209
Change-Id: I2bd369290a884c432d16796884d48db6285f8502
2 files changed
tree: 7071e9c5d4835f5b45a0701c9100315623fe32ce
  1. include/
  2. patches/
  3. Android.mk
  4. buf.c
  5. buf.h
  6. c14n.c
  7. catalog.c
  8. chvalid.c
  9. CleanSpec.mk
  10. config.h
  11. Copyright
  12. debugXML.c
  13. dict.c
  14. DOCBparser.c
  15. elfgcchack.h
  16. enc.h
  17. encoding.c
  18. entities.c
  19. error.c
  20. globals.c
  21. hash.c
  22. HTMLparser.c
  23. HTMLtree.c
  24. legacy.c
  25. libxml.h
  26. list.c
  27. MODULE_LICENSE_MIT
  28. nanoftp.c
  29. nanohttp.c
  30. NOTICE
  31. parser.c
  32. parserInternals.c
  33. pattern.c
  34. relaxng.c
  35. save.h
  36. SAX.c
  37. SAX2.c
  38. schematron.c
  39. testlimits.c
  40. threads.c
  41. timsort.h
  42. tree.c
  43. trio.c
  44. trio.h
  45. triodef.h
  46. trionan.c
  47. trionan.h
  48. triop.h
  49. triostr.c
  50. triostr.h
  51. uri.c
  52. valid.c
  53. xinclude.c
  54. xlink.c
  55. xmlcatalog.c
  56. xmlIO.c
  57. xmllint.c
  58. xmlmemory.c
  59. xmlmodule.c
  60. xmlreader.c
  61. xmlregexp.c
  62. xmlsave.c
  63. xmlschemas.c
  64. xmlschemastypes.c
  65. xmlstring.c
  66. xmlunicode.c
  67. xmlwriter.c
  68. xpath.c
  69. xpointer.c