forked from pool/libxml2
Pedro Monreal Gonzalez
cf7f5fa7e1
- Security fix:
* libxml2-CVE-2017-0663.patch [bsc#1044337, CVE-2017-0663]
* Fix Heap buffer overflow in xmlAddID
OBS-URL: https://build.opensuse.org/request/show/503950
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libxml2?expand=0&rev=115
41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
From 92b9e8c8b3787068565a1820ba575d042f9eec66 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Tue, 6 Jun 2017 12:56:28 +0200
|
|
Subject: Fix type confusion in xmlValidateOneNamespace
|
|
|
|
Comment out code that casts xmlNsPtr to xmlAttrPtr. ID types on
|
|
namespace declarations make no practical sense anyway.
|
|
|
|
Fixes bug 780228.
|
|
|
|
Found with libFuzzer and ASan.
|
|
---
|
|
valid.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
Index: libxml2-2.9.4/valid.c
|
|
===================================================================
|
|
--- libxml2-2.9.4.orig/valid.c
|
|
+++ libxml2-2.9.4/valid.c
|
|
@@ -4627,6 +4627,12 @@ xmlNodePtr elem, const xmlChar *prefix,
|
|
}
|
|
}
|
|
|
|
+ /*
|
|
+ * Casting ns to xmlAttrPtr is wrong. We'd need separate functions
|
|
+ * xmlAddID and xmlAddRef for namespace declarations, but it makes
|
|
+ * no practical sense to use ID types anyway.
|
|
+ */
|
|
+#if 0
|
|
/* Validity Constraint: ID uniqueness */
|
|
if (attrDecl->atype == XML_ATTRIBUTE_ID) {
|
|
if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
|
|
@@ -4638,6 +4644,7 @@ xmlNodePtr elem, const xmlChar *prefix,
|
|
if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
|
|
ret = 0;
|
|
}
|
|
+#endif
|
|
|
|
/* Validity Constraint: Notation Attributes */
|
|
if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {
|