c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Fix quadratic runtime in xi:fallback processing"

Browse Source 
This reverts commit 27119ec33c9f6b9830efa1e0da0acfa353dfa55a.

Not copying fallback children didn't fix up namespaces and could lead
to use-after-free errors.

Found by OSS-Fuzz.
This commit is contained in:
Nick Wellnhofer 2020-08-19 13:07:28 +02:00
parent d63cfeca35
commit 19cae17f5a
1 changed files with 12 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
xinclude.c
View File

@ -1984,7 +1984,8 @@ xmlXIncludeLoadFallback(xmlXIncludeCtxtPtr ctxt, xmlNodePtr fallback, int nr) {
ret = -1;
xmlXIncludeFreeContext(newctxt);
ctxt->incTab[nr]->inc = fallback->children;
ctxt->incTab[nr]->inc = xmlDocCopyNodeList(ctxt->doc,
fallback->children);
} else {
ctxt->incTab[nr]->inc = NULL;
}
@ -2240,6 +2241,12 @@ xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt, int nr) {
if (ctxt->incTab[nr]->fallback)
xmlUnsetProp(cur, BAD_CAST "href");
cur->type = XML_XINCLUDE_START;
/* Remove fallback children */
for (child = cur->children; child != NULL; child = next) {
next = child->next;
xmlUnlinkNode(child);
xmlFreeNode(child);
}
end = xmlNewDocNode(cur->doc, cur->ns, cur->name, NULL);
if (end == NULL) {
xmlXIncludeErr(ctxt, ctxt->incTab[nr]->ref,
@ -2255,17 +2262,11 @@ xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt, int nr) {
* Add the list of nodes
*/
while (list != NULL) {
next = list->next;
xmlAddPrevSibling(end, list);
list = next;
}
cur = list;
list = list->next;
/* Remove fallback node */
for (child = cur->children; child != NULL; child = next) {
next = child->next;
xmlUnlinkNode(child);
xmlFreeNode(child);
}
xmlAddPrevSibling(end, cur);
}
}