aboutsummaryrefslogtreecommitdiffstats
path: root/parser.c
Commit message (Collapse)AuthorAgeFilesLines
* RESTRICT AUTOMERGE: Update libxml2 to 2.9.8HEADreplicant-6.0-0004-transitionreplicant-6.0-0004-rc6replicant-6.0-0004-rc5-transitionreplicant-6.0-0004-rc5replicant-6.0-0004-rc4replicant-6.0-0004-rc3replicant-6.0-0004-rc2replicant-6.0-0004cm-14.1cm-13.0akirilov2018-09-061-783/+527
| | | | | | | | | | | | | | Merge to pi-dev and restore Android.mk Bug: 79662501 Bug: 36809766 Bug: 36810305 Bug: 62151041 Test: manually verify functionality for regression Change-Id: Ife351c91c932eb92992656f8ea5c08724a220306 (cherry picked from commit 4e91cfdbb1a8624e5cd5a850d6e17da11d1e34a8)
* DO NOT MERGE: Add validation for eternal enitiesBrian C. Young2017-04-171-0/+8
| | | | | | | | https://bugzilla.gnome.org/show_bug.cgi?id=780691 Bug: 36556310 Change-Id: I9450743e167c3c73af5e4071f3fc85e81d061648 (cherry picked from commit bef9af3d89d241bcb518c20cba6da2a2fd9ba049)
* DO NOT MERGE: Apply upstream Chromium patch for encoding changesBrian C. Young2017-04-171-1/+8
| | | | | | | | | | | | | | | | Give up looking up interned names if the encoding changed during parsing NEXTL may process encoding changes by refilling the parser's input buffer, which makes the accumulated length 'len' inaccurate. Chromium bug: http://crbug.com/620679 Review-Url: https://codereview.chromium.org/2603933002 Cr-Commit-Position: refs/heads/master@{#442517} Bug: 36553781 Change-Id: Id3484fbee201d1e19b684b109009d6590354b1d9 (cherry picked from commit 008262d3e46b3d5aae2d2f981e26ca69c8bd2b51)
* Merge remote-tracking branch 'goog/upstream-master' into mymergeXin Li2016-08-151-39/+81
| | | | | | BUG: 29834751 Change-Id: I88fc1d4f86bcbd0ac0fe9acdbe764f3d738c5f32 (cherry picked from commit e3d78e1fe0669e9c7083a4de19f1e06171849b28)
* CVE-2015-7500 Fix memory access error due to incorrect entities boundariesDaniel Veillard2015-11-201-6/+22
| | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=756525 handle properly the case where we popped out of the current entity while processing a start tag Reported by Kostya Serebryany @ Google This slightly modifies the output of 754946 in regression tests
* Fix some loop issues embedding NEXTDaniel Veillard2015-11-201-2/+4
| | | | | Next can switch the parser back to XML_PARSER_EOF state, we need to consider those in loops consuming input
* Detect incoherency on GROWDaniel Veillard2015-11-201-1/+8
| | | | | the current pointer to the input has to be between the base and end if not stop everything we have an internal state error.
* Reuse xmlHaltParser() where it makes senseDaniel Veillard2015-11-201-20/+17
| | | | | | Unify the various place where either xmlStopParser was called (which resets the error as a side effect) and places where we used ctxt->instate = XML_PARSER_EOF to stop further processing
* Add xmlHaltParser() to stop the parserDaniel Veillard2015-11-201-5/+29
| | | | | | The problem is doing it in a consistent and safe fashion It's more complex than just setting ctxt->instate = XML_PARSER_EOF Update the public function to reuse that new internal routine
* CVE-2015-5312 Another entity expansion issueDavid Drysdale2015-11-201-0/+4
| | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=756733 It is one case where the code in place to detect entities expansions failed to exit when the situation was detected, leading to DoS Problem reported by Kostya Serebryany @ Google Patch provided by David Drysdale @ Google
* xmlStopParser reset errNoDaniel Veillard2015-11-091-0/+3
| | | | I had used it in contexts where that information ought to be preserved
* Avoid processing entities after encoding conversion failuresDaniel Veillard2015-11-091-2/+5
| | | | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=756527 and was also raised by Chromium team in the past When we hit a convwersion failure when switching encoding it is bestter to stop parsing there, this was treated as a fatal error but the parser was continuing to process to extract more errors, unfortunately that makes little sense as the data is obviously corrupt and can potentially lead to unexpected behaviour.
* Avoid extra processing of MarkupDecl when EOFHugh Davenport2015-11-031-0/+8
| | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=756263 One place where ctxt->instate == XML_PARSER_EOF whic was set up by entity detection issues doesn't get noticed, and even overrided
* Fix an error in previous Conditional section patchDaniel Veillard2015-10-271-1/+1
| | | | | | an off by one mistake in the change, led to error on correct document where the end of the included entity was exactly the end of the conditional section, leading to regtest failure
* Another variation of overflow in Conditional sectionsDaniel Veillard2015-10-231-1/+3
| | | | | | | | Which happen after the previous fix to https://bugzilla.gnome.org/show_bug.cgi?id=756456 But stopping the parser and exiting we didn't pop the intermediary entities and doing the SKIP there applies on an input which may be too small
* Add missing Null check in xmlParseExternalEntityPrivateGaurav Gupta2015-09-301-4/+6
| | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=755857 a case where we check for NULL but not everywhere
* Fix a bug in CData error handling in the push parserDaniel Veillard2015-09-181-3/+3
| | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=754947 The checking function was returning incorrect args in some cases Adds the test to teh reg suite and fix one of the existing test output
* Fix a bug on name parsing at the end of current input bufferDaniel Veillard2015-09-151-9/+20
| | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=754946 When hitting the end of the current input buffer while parsing a name we could end up loosing the beginning of the name, which led to various issues.
* Fail parsing early on if encoding conversion failedDaniel Veillard2015-06-291-1/+5
| | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=751631 If we fail conversing the current input stream while processing the encoding declaration of the XMLDecl then it's safer to just abort there and not try to report further errors.
* Do not process encoding values if the declaration if brokenDaniel Veillard2015-06-291-0/+4
| | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=751603 If the string is not properly terminated do not try to convert to the given encoding.
* Cleanup conditional section error handlingDaniel Veillard2015-02-231-0/+6
| | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=744980 The error handling of Conditional Section also need to be straightened as the structure of the document can't be guessed on a failure there and it's better to stop parsing as further errors are likely to be irrelevant.
* Stop parsing on entities boundaries errorsDaniel Veillard2015-02-231-0/+1
| | | | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=744980 There are times, like on unterminated entities that it's preferable to stop parsing, even if that means less error reporting. Entities are feeding the parser on further processing, and if they are ill defined then it's possible to get the parser to bug. Also do the same on Conditional Sections if the input is broken, as the structure of the document can't be guessed.
* Fix missing entities after CVE-2014-3660 fixDaniel Veillard2014-10-231-1/+2
| | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=738805 The fix for CVE-2014-3660 introduced a regression in some case where entity substitution is required and the entity is used first in anotther entity referenced from an attribute value
* Revert "Missing initialization for the catalog module"Daniel Veillard2014-10-171-3/+0
| | | | | | This reverts commit 054c716ea1bf001544127a4ab4f4346d1b9947e7. As this break xmlcatalog command https://bugzilla.redhat.com/show_bug.cgi?id=1153753
* Fix for CVE-2014-3660Daniel Veillard2014-10-161-4/+38
| | | | | Issues related to the billion laugh entity expansion which happened to escape the initial set of fixes
* fix memory leak xml header encoding field with XML_PARSE_IGNORE_ENCBart De Schuymer2014-10-161-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the xml parser encounters an xml encoding in an xml header while configured with option XML_PARSE_IGNORE_ENC, it fails to free memory allocated for storing the encoding. The patch below fixes this. How to reproduce: 1. Change doc/examples/parse4.c to add xmlCtxtUseOptions(ctxt, XML_PARSE_IGNORE_ENC); after the call to xmlCreatePushParserCtxt. 2. Rebuild 3. run the following command from the top libxml2 directory: LD_LIBRARY_PATH=.libs/ valgrind --leak-check=full ./doc/examples/.libs/parse4 ./test.xml , where test.xml contains following input: <?xml version="1.0" encoding="UTF-81" ?><hi/> valgrind will report: ==1964== 10 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==1964== at 0x4C272DB: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==1964== by 0x4E88497: xmlParseEncName (parser.c:10224) ==1964== by 0x4E888FE: xmlParseEncodingDecl (parser.c:10295) ==1964== by 0x4E89630: xmlParseXMLDecl (parser.c:10534) ==1964== by 0x4E8B737: xmlParseTryOrFinish (parser.c:11293) ==1964== by 0x4E8E775: xmlParseChunk (parser.c:12283) Signed-off-by: Bart De Schuymer <bart at amplidata com>
* Parser error on repeated recursive entity expansion containing &lt;Daniel Veillard2014-10-081-2/+2
| | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=736417 basically a weird side effect and a failure to properly parenthesize a boolean expression led to this bug
* parser bug on misformed namespace attributesDennis Filder2014-10-061-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=672539 Reported by Axel Miller <axel.miller@ppi.de> Consider the following start-tag: <x xmlns=""version=""> The start-tag does not conform to the rule [40] STag ::= '<' Name (S Attribute)* S? '>' since there is no whitespace in front of the attribute "version". Thus, libxml2 should reject the start-tag. But it doesn't: $ echo '<x xmlns=""version=""/>' | xmllint - <?xml version="1.0"?> <x xmlns="" version=""/> The error seems to happen only if there is a namespace declaration in front of the attribute. A missing whitespace between other attributes is handled correctly: $ echo '<x someattr=""version=""/>' | xmllint - -:1: parser error : attributes construct error <x someattr=""version=""/> ^ [...]
* wrong error column in structured error when parsing end tagJuergen Keil2014-10-061-0/+2
| | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=734283 libxml2 reports wrong error column numbers (field int2 in xmlError) in structured error handler, after parsing an end tag.
* wrong error column in structured error when parsing attribute valuesJuergen Keil2014-08-071-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=734280 libxml2 reports wrong error column numbers (field int2 in xmlError) in structured error handler, after parsing XML attribute values. Example XML: <?xml version="1.0" encoding="UTF-8"?> <root xmlns="urn:colbug">&</root> <!-- 1 2 3 4 1234567890123456789012345678901234567890 --> Expected location of the error would be line 3, column 21. The actual location of the error is line 3, column 9: $ ./xmlparse colbug2.xml colbug2.xml:3:9: xmlParseEntityRef: no name The 12 characters of the xmlns attribute value "urn:colbug" are not accounted for in the error column value.
* wrong error column in structured error when skipping whitespace in xml declJuergen Keil2014-08-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=734276 libxml2 reports wrong error column numbers (field int2 in xmlError) in structured error handler, after an XML declaration containing whitespace. Example XML: <?xml version="1.0" encoding="UTF-8" ?><root>&</root> <!-- 1 2 3 4 5 6 123456789012345678901234567890123456789012345678901234567890 --> Expected location of the error would be line 1, column 53. The actual location of the error is line 1, column 44: $ ./xmlparse colbug1.xml colbug1.xml:1:44: xmlParseEntityRef: no name
* typo in error messages "colon are forbidden from..."Daniel Veillard2014-07-261-3/+3
| | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=731511 Pointed byt vincent Lefevre
* Fix a potential NULL dereferenceDaniel Veillard2014-07-141-0/+6
| | | | | | | For https://bugzilla.gnome.org/show_bug.cgi?id=733040 xmlDictLookup() may return NULL in case of allocation error, though very unlikely it need to be checked.
* Fix regressions introduced by CVE-2014-0191 patchDaniel Veillard2014-06-111-2/+11
| | | | | | | | A number of issues have been raised after the fix, and this patch tries to correct all of them, though most were related to postvalidation. https://bugzilla.gnome.org/show_bug.cgi?id=730290 and other reports on list, off-list and on Red Hat bugzilla
* Do not fetch external parameter entitiesDaniel Veillard2014-05-061-0/+14
| | | | | Unless explicitely asked for when validating or replacing entities with their value. Problem pointed out by Daniel Berrange <berrange@redhat.com>
* Fix xmlParseInNodeContext() if node is not elementDaniel Veillard2014-03-211-1/+2
| | | | | | We really need to have ctxt->instate == XML_PARSER_CONTENT when jumping in content parsing Bug reported by Frank Gross
* Fix a portability issue on WindowsLongstreth Jon2014-02-061-2/+5
| | | | Apparently an verflow when comparing macro and unsigned long
* Missing initialization for the catalog moduleDaniel Veillard2014-01-261-0/+3
|
* adding init calls to xml and html Read parsing entry pointsDaniel Veillard2013-12-091-0/+10
| | | | | | As pointed out by "Tassyns, Bram <BramT@enfocus.com>" on the list some call had it other didn't, clean it up and add to all missing ones
* Fix incorrect spelling entites->entitiesJan Pokorný2013-11-301-1/+1
| | | | | | Partially, a follow-up of 81d7a8245cf9a31a49499a5a195c2b89e6f91180. Signed-off-by: Jan Pokorný <jpokorny@redhat.com>
* Fix a parsing bug on non-ascii element and CR/LF usageDaniel Veillard2013-05-221-1/+5
| | | | | | | | https://bugzilla.gnome.org/show_bug.cgi?id=698550 Somehow the behaviour of the internal parser routine changed slightly when encountering CR/LF, which led to a bug when parsing document with non-ascii Names
* Fix a regression in xmlGetDocCompressMode()Daniel Veillard2013-05-101-0/+4
| | | | | | | | | | | | The switch to xzlib had for consequence that the compression level of the input was not gathered anymore in ctxt->input->buf, then the parser compression flags was left to -1 and propagated to the resulting document. Fix the I/O layer to get compression detection in xzlib, then carry it in the input buffer and the resulting document This should fix https://lsbbugs.linuxfoundation.org/show_bug.cgi?id=3456
* Cast encoding name to char pointer to match arg typeNikolay Sivov2013-05-061-1/+1
|
* Fix an error in xmlCleanupParserAlexander Pastukhov2013-04-231-1/+1
| | | | | | | | https://bugzilla.gnome.org/show_bug.cgi?id=698582 xmlCleanupParser calls xmlCleanupGlobals() and then xmlResetLastError() but the later reallocate the global data freed by previous call. Just swap the two calls.
* Fix a couple of return without valueJüri Aedla2013-04-161-2/+2
| | | | Error introduced in previous commit !
* Improve handling of xmlStopParser()Daniel Veillard2013-04-111-6/+65
| | | | | Add a specific parser error Try to stop parsing as quickly as possible
* Cache presence of '<' in entities contentDaniel Veillard2013-03-111-12/+18
| | | | | slightly modify how ent->checked is used, and use the lowest bit to keep the information
* Avoid extra processing on entitiesDaniel Veillard2013-03-111-2/+6
| | | | | If an entity has already been checked for correctness no need to check it on every reference
* Detect excessive entities expansion upon replacementDaniel Veillard2013-02-191-6/+38
| | | | | | | | | If entities expansion in the XML parser is asked for, it is possble to craft relatively small input document leading to excessive on-the-fly content generation. This patch accounts for those replacement and stop parsing after a given threshold. it can be bypassed as usual with the HUGE parser option.
* Fix the flushing out of raw buffers on encoding conversionsDaniel Veillard2013-02-131-3/+7
| | | | | | | | | | | | https://bugzilla.gnome.org/show_bug.cgi?id=692915 the new set of converting functions tried to limit the encoding conversion of the raw buffer to the consumption one to work in a more progressive fashion. Unfortunately this was bad for performances and led to errors on progressive parsing when a very large chunk was close to the end of the document. Fix the new internal function and switch back to the old way of converting. Fix another bug in the process.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-01 07:04:25 +0000