aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBrian C. Young <bcyoung@google.com>2017-04-03 12:54:00 -0700
committerMSe <mse1969@posteo.de>2017-06-09 15:00:33 +0200
commitb1337b0398e284bea2a3ea609d59cfd54c3518e3 (patch)
tree0a015c0ee9e42ba716ad4ecd5715be1b4f0daf0d
parent7705ac9687b0c371cfd28b69aa52fd526f5714dd (diff)
downloadandroid_external_libxml2-b1337b0398e284bea2a3ea609d59cfd54c3518e3.tar.gz
android_external_libxml2-b1337b0398e284bea2a3ea609d59cfd54c3518e3.tar.bz2
android_external_libxml2-b1337b0398e284bea2a3ea609d59cfd54c3518e3.zip
DO NOT MERGE: fix for the XPath nodeTab use-after-free bug from nmehta@
see https://bugs.chromium.org/p/chromium/issues/detail?id=705445 Bug: 36809819 AOSP-Change-Id: I4832550032669a8e921bd46068281d9daf594ae1 (cherry picked from commit 7f671748797331e20da23db2d95a6116bb1c6c55) CVE-2017-5056 Change-Id: Ia110c329795b7b417322921c8937792296aa205e
-rw-r--r--xpath.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/xpath.c b/xpath.c
index 1b8206ba..862f57de 100644
--- a/xpath.c
+++ b/xpath.c
@@ -4368,7 +4368,7 @@ xmlXPathNewValueTree(xmlNodePtr val) {
}
memset(ret, 0 , (size_t) sizeof(xmlXPathObject));
ret->type = XPATH_XSLT_TREE;
- ret->boolval = 1;
+ ret->boolval = 0;
ret->user = (void *) val;
ret->nodesetval = xmlXPathNodeSetCreate(val);
#ifdef XP_DEBUG_OBJ_USAGE