Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / libxml2 / e875e1cd1fc92fd2daa57826024125cbd0b195c7
commite875e1cd1fc92fd2daa57826024125cbd0b195c7[log] [tgz]
authorBrian C. Young <bcyoung@google.com>Mon Apr 03 12:46:02 2017 -0700
committerBrian C. Young <bcyoung@google.com>Mon Apr 03 12:46:02 2017 -0700
treee8a5ee37b7b91310898fca763069c88fa3fbec4d
parentcde4b40a9c17aec816c6b2577250fff9354a6f3c [diff]
DO NOT MERGE: Fix XPointer paths beginning with range-to

The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.

The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.

Found with afl-fuzz.

Fixes CVE-2016-5131.

Bug: 36554209
Change-Id: I2bd369290a884c432d16796884d48db6285f8502
3 files changed
tree: e8a5ee37b7b91310898fca763069c88fa3fbec4d
  1. bakefile/
  2. doc/
  3. example/
  4. include/
  5. macos/
  6. optim/
  7. os400/
  8. python/
  9. result/
  10. test/
  11. vms/
  12. VxWorks/
  13. win32/
  14. xstc/
  15. NOTICE ⇨ Copyright
  16. .gitignore
  17. acinclude.m4
  18. Android.mk
  19. AUTHORS
  20. autogen.sh
  21. buf.c
  22. buf.h
  23. build_glob.py
  24. c14n.c
  25. catalog.c
  26. ChangeLog
  27. check-relaxng-test-suite.py
  28. check-relaxng-test-suite2.py
  29. check-xinclude-test-suite.py
  30. check-xml-test-suite.py
  31. check-xsddata-test-suite.py
  32. chvalid.c
  33. chvalid.def
  34. CleanSpec.mk
  35. config.h
  36. configure.ac
  37. Copyright
  38. dbgen.pl
  39. dbgenattr.pl
  40. debugXML.c
  41. dict.c
  42. DOCBparser.c
  43. elfgcchack.h
  44. enc.h
  45. encoding.c
  46. entities.c
  47. error.c
  48. genChRanges.py
  49. gentest.py
  50. genUnicode.py
  51. global.data
  52. globals.c
  53. HACKING
  54. hash.c
  55. INSTALL.libxml2
  56. legacy.c
  57. libxml-2.0-uninstalled.pc.in
  58. libxml-2.0.pc.in
  59. libxml.3
  60. libxml.h
  61. libxml.m4
  62. libxml.spec.in
  63. libxml2-config.cmake.in
  64. libxml2.doap
  65. libxml2.syms
  66. list.c
  67. MAINTAINERS
  68. Makefile.am
  69. Makefile.tests
  70. Makefile.win
  71. MODULE_LICENSE_MIT
  72. nanoftp.c
  73. nanohttp.c
  74. NEWS
  75. parser.c
  76. parserInternals.c
  77. pattern.c
  78. README
  79. README.cvs-commits
  80. README.tests
  81. README.version
  82. regressions.py
  83. regressions.xml
  84. relaxng.c
  85. rngparser.c
  86. runsuite.c
  87. runtest.c
  88. runxmlconf.c
  89. save.h
  90. SAX.c
  91. SAX2.c
  92. schematron.c
  93. testapi.c
  94. testAutomata.c
  95. testC14N.c
  96. testchar.c
  97. testdict.c
  98. testdso.c
  99. testHTML.c
  100. testlimits.c
  101. testModule.c
  102. testOOM.c
  103. testOOMlib.c
  104. testOOMlib.h
  105. testReader.c
  106. testrecurse.c
  107. testRegexp.c
  108. testRelax.c
  109. testSAX.c
  110. testSchemas.c
  111. testThreads.c
  112. testThreadsWin32.c
  113. testURI.c
  114. testXPath.c
  115. threads.c
  116. timsort.h
  117. TODO
  118. TODO_SCHEMAS
  119. tree.c
  120. trio.c
  121. trio.h
  122. triodef.h
  123. trionan.c
  124. trionan.h
  125. triop.h
  126. triostr.c
  127. triostr.h
  128. uri.c
  129. valid.c
  130. xinclude.c
  131. xlink.c
  132. xml2-config.1
  133. xml2-config.in
  134. xml2Conf.sh.in
  135. xmlcatalog.c
  136. xmlIO.c
  137. xmllint.c
  138. xmlmemory.c
  139. xmlmodule.c
  140. xmlreader.c
  141. xmlregexp.c
  142. xmlsave.c
  143. xmlschemas.c
  144. xmlschemastypes.c
  145. xmlstring.c
  146. xmlunicode.c
  147. xmlwriter.c
  148. xpath.c
  149. xpointer.c
  150. xzlib.c
  151. xzlib.h