diff options
| author | Pranjal Jumde <pjumde@apple.com> | 2016-03-07 14:04:08 -0800 |
|---|---|---|
| committer | Daniel Veillard <veillard@redhat.com> | 2016-05-23 15:01:07 +0800 |
| commit | 38eae571111db3b43ffdeb05487c9f60551906fb (patch) | |
| tree | 6c8c49c25884830f08d6118227d3dedb1e3ce1ce /parser.c | |
| parent | 11ed4a7a90d5ce156a18980a4ad4e53e77384852 (diff) | |
| download | libxml2-38eae571111db3b43ffdeb05487c9f60551906fb.tar.gz | |
Heap use-after-free in xmlSAX2AttributeNsCVE-2016-1835
For https://bugzilla.gnome.org/show_bug.cgi?id=759020
* parser.c:
(xmlParseStartTag2): Attribute strings are only valid if the
base does not change, so add another check where the base may
change. Make sure to set 'attvalue' to NULL after freeing it.
* result/errors/759020.xml: Added.
* result/errors/759020.xml.err: Added.
* result/errors/759020.xml.str: Added.
* test/errors/759020.xml: Added test case.
Diffstat (limited to 'parser.c')
| -rw-r--r-- | parser.c | 12 |
1 files changed, 10 insertions, 2 deletions
@@ -9488,7 +9488,10 @@ reparse: else if (nsPush(ctxt, NULL, URL) > 0) nbNs++; skip_default_ns: - if (alloc != 0) xmlFree(attvalue); + if ((attvalue != NULL) && (alloc != 0)) { + xmlFree(attvalue); + attvalue = NULL; + } if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>')))) break; if (!IS_BLANK_CH(RAW)) { @@ -9497,6 +9500,8 @@ skip_default_ns: break; } SKIP_BLANKS; + if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) + goto base_changed; continue; } if (aprefix == ctxt->str_xmlns) { @@ -9568,7 +9573,10 @@ skip_default_ns: else if (nsPush(ctxt, attname, URL) > 0) nbNs++; skip_ns: - if (alloc != 0) xmlFree(attvalue); + if ((attvalue != NULL) && (alloc != 0)) { + xmlFree(attvalue); + attvalue = NULL; + } if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>')))) break; if (!IS_BLANK_CH(RAW)) { |