summaryrefslogtreecommitdiff
path: root/xpath.c
Commit message (Collapse)AuthorAgeFilesLines
* malloc-fail: Check for malloc failures when creating XPath stringsNick Wellnhofer2023-03-181-69/+42
| | | | | | Prevent null derefs. Found by OSS-Fuzz, see #344.
* malloc-fail: Stop using XPath stack framesNick Wellnhofer2023-03-131-53/+4
| | | | | | | | | | | | | There's too much code which assumes that if ctxt->value is non-null, a value can be successfully popped off the stack. This assumption can break with stack frames when malloc fails. Instead of trying to fix all call sites, remove the stack frame logic. It only offered very little protection against misbehaving extension functions. We already check the stack size after a function call which should be enough. Found by OSS-Fuzz.
* malloc-fail: Fix memory leak in xmlXPathRegisterNsNick Wellnhofer2023-03-091-2/+13
| | | | Found by OSS-Fuzz.
* malloc-fail: Fix memory leak in xmlXPathNameFunctionNick Wellnhofer2023-02-281-3/+2
| | | | Found with libFuzzer, see #344.
* xpath: Fix harmless integer overflow in xmlXPathTranslateFunctionNick Wellnhofer2023-02-271-1/+1
|
* Revert "xpath: Fix popping of values in xmlXPathPopNodeset"Nick Wellnhofer2023-02-271-6/+7
| | | | This reverts commit 47b0e0a620d1e0e657b858986e3ebde80d4645b4.
* malloc-fail: Fix memory leak in xmlXPathDistinctSortedNick Wellnhofer2023-02-271-3/+10
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak in xmlXPathCacheNewNodeSetNick Wellnhofer2023-02-271-6/+9
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix null deref after xmlPointerListAddSizeNick Wellnhofer2023-02-271-21/+19
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix null deref in xmlXPathCompiledEvalInternalNick Wellnhofer2023-02-271-0/+2
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix use-after-free related to xmlXPathNodeSetFilterNick Wellnhofer2023-02-261-2/+19
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak in xmlXPathEqualNodeSetFloatNick Wellnhofer2023-02-261-1/+1
| | | | Found with libFuzzer, see #344.
* Revert "malloc-fail: Avoid use-after-free after unsuccessful valuePush"Nick Wellnhofer2023-02-261-9/+1
| | | | | | | This reverts commit 6a12be77c6a94c374ab7476087edcee2ba41d9b4. There's too much code reading ctxt->value directly and making the wrong assumptions.
* xpath: Fix popping of values in xmlXPathPopNodesetNick Wellnhofer2023-02-231-7/+6
| | | | | | | After 6a12be77, valuePop can fail even if ctxt->value is non-NULL. If it turns out that too much code relies on this assumption, a better fix is needed.
* malloc-fail: Fix memory leak after calling xmlXPathNodeSetMergeNick Wellnhofer2023-02-171-41/+37
| | | | | | | Destroy the first argument in xmlXPathNodeSetMerge if the function fails. This is somewhat dangerous but matches the expectations of users. Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak after calling xmlXPathWrapStringNick Wellnhofer2023-02-171-0/+3
| | | | | | | Destroy the string in xmlXPathWrapString if the function fails. This is somewhat dangerous but matches the expectations of users. Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak in xmlXPathEqualValuesCommonNick Wellnhofer2023-02-171-2/+4
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak in xmlXPathCompareValuesNick Wellnhofer2023-02-171-2/+3
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak in xmlXPathTryStreamCompileNick Wellnhofer2023-02-171-0/+1
| | | | Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak after calling valuePushNick Wellnhofer2023-02-171-0/+4
| | | | | | | Destroy the object in valuePush if the function fails. This is somewhat dangerous but matches the expectations of users. Found with libFuzzer, see #344.
* malloc-fail: Fix memory leak after calling xmlXPathWrapNodeSetNick Wellnhofer2023-02-171-0/+5
| | | | | | | Destroy the node set in xmlXPathWrapNodeSet if the function fails. This is somewhat dangerous but matches the expectations of users. Found with libFuzzer, see #344.
* xpath: Only report the first errorNick Wellnhofer2023-02-031-0/+3
| | | | | Don't overwrite the original error code. Besides, subsequent error reports are somewhat unreliable and not really useful.
* malloc-fail: Avoid use-after-free after unsuccessful valuePushNick Wellnhofer2023-02-031-1/+9
| | | | | | | | | | | | | | | | | | In xpath.c there's a lot of code like: valuePush(ctxt, xmlCacheNewX()); ... valuePop(ctxt); If xmlCacheNewX fails, no value will be pushed on the stack. If there's no error check in between, valuePop will pop an unrelated value which can lead to use-after-free errors. Instead of trying to fix all call sites, we simply stop popping values if an error was signaled. This requires to change the CHECK_TYPE macro which is often used to determine whether a value can be safely popped. Found with libFuzzer, see #344.
* malloc-fail: Add error checks in xmlXPathEqualValuesCommonNick Wellnhofer2023-02-031-0/+2
| | | | | | Avoid null deref. Found with libFuzzer, see #344.
* malloc-fail: Add error check in xmlXPathEqualNodeSetFloatNick Wellnhofer2023-02-031-0/+1
| | | | | | Avoid null deref. Found with libFuzzer, see #344.
* malloc-fail: Fix error check in xmlXPathCompareValuesNick Wellnhofer2023-02-031-10/+2
| | | | | | Avoid null deref. Found with libFuzzer, see #344.
* malloc-fail: Record malloc failure in xmlXPathCompLiteralNick Wellnhofer2023-02-031-1/+4
| | | | | | Avoid OOB array access. Found with libFuzzer, see #344.
* malloc-fail: Check return value of xmlXPathNodeSetDupNsNick Wellnhofer2023-02-031-15/+23
| | | | | | Avoid null deref if allocation fails. Found with libFuzzer, see #344.
* xpath: number('-') should return NaNNick Wellnhofer2023-01-181-3/+3
| | | | Fixes https://gitlab.gnome.org/GNOME/libxslt/-/issues/81
* xpath: Make init function privateNick Wellnhofer2022-11-271-3/+11
|
* warnings: Remove set-but-unused variablesNick Wellnhofer2022-10-251-9/+0
| | | | Fixes compiler warnings with clang 15.
* xpath: Lower XPath recursion limit on WindowsNick Wellnhofer2022-09-071-0/+3
|
* Fix Windows compiler warnings in python/types.cNick Wellnhofer2022-09-041-2/+2
|
* Remove or annotate char castsNick Wellnhofer2022-09-011-1/+1
|
* Don't use sizeof(xmlChar) or sizeof(char)Nick Wellnhofer2022-09-011-3/+2
|
* Remove explicit integer castsNick Wellnhofer2022-09-011-37/+33
| | | | | | | | | | | | | | | | | | | | Remove explicit integer casts as final operation - in assignments - when passing arguments - when returning values Remove casts - to the same type - from certain range-bound values The main motivation is that these explicit casts don't change the result of operations and only render UBSan's implicit-conversion checks useless. Removing these casts allows UBSan to detect cases where truncation or sign-changes occur unexpectedly. Document some explicit casts as truncating and add a few missing ones.
* Remove set-but-unused variable in xmlXPathScanNameNick Wellnhofer2022-08-261-2/+1
| | | | Fix clang warning.
* Consolidate private header filesNick Wellnhofer2022-08-261-1/+2
| | | | | | | | | | | Private functions were previously declared - in header files in the root directory - in public headers guarded with IN_LIBXML - in libxml.h - redundantly in source files that used them. Consolidate all private header files in include/private.
* Make XPath depth check work with recursive invocationsNick Wellnhofer2022-07-281-6/+17
| | | | | | EXSLT functions like dyn:map or dyn:evaluate invoke xmlXPathRunEval recursively. Don't set depth to zero but keep and restore the original value to avoid stack overflows when abusing these functions.
* Use NAN/INFINITY if available to init XPath NaN/InfSergey Kosukhin2022-07-061-0/+6
|
* Add configuration flag for XPointer locations supportNick Wellnhofer2022-04-211-24/+56
| | | | | | | | | | | | | | | | | | | | | Add a new configuration flag that controls whether the outdated support for XPointer locations (ranges and points) is enabled. --with-xptr-locs # Autotools LIBXML2_WITH_XPTR_LOCS # CMake The latest spec for what it essentially an XPath extension seems to be this working draft from 2002: https://www.w3.org/TR/xptr-xpointer/ The xpointer() scheme is listed as "being reviewed" in the XPointer registry since at least 2006. libxml2 seems to be the only modern software that tries to implement this spec, but the code has many bugs and quality issues. The flag defaults to "off" and support for this extensions has to be requested explicitly. The relevant API functions are deprecated.
* Mark more static data as `const`David Kilzer2022-04-071-1/+1
| | | | | | | | | Similar to 8f5710379, mark more static data structures with `const` keyword. Also fix placement of `const` in encoding.c. Original patch by Sarah Wilkin.
* Initialize XPath floating-point globalsNick Wellnhofer2022-04-031-3/+3
| | | | Should fix #138.
* fix: xmlXPathParserContext could be double-delete in OOM case.jinsub ahn2022-03-301-1/+1
|
* Deprecate module init and cleanup functionsNick Wellnhofer2022-03-061-0/+3
| | | | | | These functions shouldn't be part of the public API. Most init functions are only thread-safe when called from xmlInitParser. Global variables should only be cleaned up by calling xmlCleanupParser.
* Normalize XPath strings in-placeNick Wellnhofer2022-03-051-36/+29
| | | | | | Simplify the code and fix a potential memory leak. Fixes #343.
* Remove DOCBparserNick Wellnhofer2022-03-041-27/+0
| | | | | | | This code has been broken and deprecated since version 2.6.0, released in 2003. Because of a bug in commit 961b535c, DOCBparser.c was never compiled since 2012. I couldn't find a Debian package using any of its symbols, so it seems safe to remove this module.
* Remove unneeded #includesNick Wellnhofer2022-03-041-4/+0
|
* Don't check for standard C89 headersNick Wellnhofer2022-03-021-12/+3
| | | | | | | | | | | | | | | | | | | | Don't check for - ctype.h - errno.h - float.h - limits.h - math.h - signal.h - stdarg.h - stdlib.h - string.h - time.h Stop including non-standard headers - malloc.h - strings.h
* Remove elfgcchack.hNick Wellnhofer2022-02-201-2/+0
| | | | | The same optimization can be enabled with -fno-semantic-interposition since GCC 5. clang has always used this option by default.
View Lorry Controller Status