diff options
author | Brian C. Young <bcyoung@google.com> | 2017-04-03 12:54:00 -0700 |
---|---|---|
committer | MSe <mse1969@posteo.de> | 2017-06-09 15:00:33 +0200 |
commit | b1337b0398e284bea2a3ea609d59cfd54c3518e3 (patch) | |
tree | 0a015c0ee9e42ba716ad4ecd5715be1b4f0daf0d | |
parent | 7705ac9687b0c371cfd28b69aa52fd526f5714dd (diff) | |
download | android_external_libxml2-b1337b0398e284bea2a3ea609d59cfd54c3518e3.tar.gz android_external_libxml2-b1337b0398e284bea2a3ea609d59cfd54c3518e3.tar.bz2 android_external_libxml2-b1337b0398e284bea2a3ea609d59cfd54c3518e3.zip |
DO NOT MERGE: fix for the XPath nodeTab use-after-free bug from nmehta@
see https://bugs.chromium.org/p/chromium/issues/detail?id=705445
Bug: 36809819
AOSP-Change-Id: I4832550032669a8e921bd46068281d9daf594ae1
(cherry picked from commit 7f671748797331e20da23db2d95a6116bb1c6c55)
CVE-2017-5056
Change-Id: Ia110c329795b7b417322921c8937792296aa205e
-rw-r--r-- | xpath.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -4368,7 +4368,7 @@ xmlXPathNewValueTree(xmlNodePtr val) { } memset(ret, 0 , (size_t) sizeof(xmlXPathObject)); ret->type = XPATH_XSLT_TREE; - ret->boolval = 1; + ret->boolval = 0; ret->user = (void *) val; ret->nodesetval = xmlXPathNodeSetCreate(val); #ifdef XP_DEBUG_OBJ_USAGE |