Permalink
Browse files

add additional checks to prevent tree corruption. fix problem copying

* tree.c: add additional checks to prevent tree corruption. fix problem
  copying attribute using xmlDocCopyNode from one document to another.
  • Loading branch information...
1 parent d4e39ae commit 19dc961ec1dfb1c1f63cd0a6664ac55d29decc90 Rob Richards committed Oct 28, 2005
Showing with 62 additions and 14 deletions.
  1. +5 −0 ChangeLog
  2. +57 −14 tree.c
View
@@ -1,3 +1,8 @@
+Fri Oct 28 12:21:39 EDT 2005 Rob Richards <rrichards@ctindustries.net>
+
+ * tree.c: add additional checks to prevent tree corruption. fix problem
+ copying attribute using xmlDocCopyNode from one document to another.
+
Fri Oct 28 17:58:13 CEST 2005 Daniel Veillard <daniel@veillard.com>
* config.h.in configure.in vms/config.vms macos/src/config-mac.h:
View
71 tree.c
@@ -2012,6 +2012,8 @@ xmlRemoveProp(xmlAttrPtr cur) {
tmp = cur->parent->properties;
if (tmp == cur) {
cur->parent->properties = cur->next;
+ if (cur->next != NULL)
+ cur->next->prev = NULL;
xmlFreeProp(cur);
return(0);
}
@@ -2831,6 +2833,14 @@ xmlAddNextSibling(xmlNodePtr cur, xmlNodePtr elem) {
return(NULL);
}
+ if (cur == elem) {
+#ifdef DEBUG_TREE
+ xmlGenericError(xmlGenericErrorContext,
+ "xmlAddNextSibling : cur == elem\n");
+#endif
+ return(NULL);
+ }
+
xmlUnlinkNode(elem);
if (elem->type == XML_TEXT_NODE) {
@@ -2854,13 +2864,16 @@ xmlAddNextSibling(xmlNodePtr cur, xmlNodePtr elem) {
/* check if an attribute with the same name exists */
xmlAttrPtr attr;
+ if (cur->type != XML_ATTRIBUTE_NODE)
+ return(NULL);
if (elem->ns == NULL)
attr = xmlHasNsProp(cur->parent, elem->name, NULL);
else
attr = xmlHasNsProp(cur->parent, elem->name, elem->ns->href);
/* elem has already been unlinked so can never be attr */
if ((attr != NULL) && (attr->type != XML_ATTRIBUTE_DECL)) {
/* different instance, destroy it (attributes must be unique) */
+ xmlUnlinkNode((xmlNodePtr) attr);
xmlFreeProp(attr);
}
}
@@ -2912,6 +2925,14 @@ xmlAddPrevSibling(xmlNodePtr cur, xmlNodePtr elem) {
return(NULL);
}
+ if (cur == elem) {
+#ifdef DEBUG_TREE
+ xmlGenericError(xmlGenericErrorContext,
+ "xmlAddPrevSibling : cur == elem\n");
+#endif
+ return(NULL);
+ }
+
xmlUnlinkNode(elem);
if (elem->type == XML_TEXT_NODE) {
@@ -2935,13 +2956,16 @@ xmlAddPrevSibling(xmlNodePtr cur, xmlNodePtr elem) {
/* check if an attribute with the same name exists */
xmlAttrPtr attr;
+ if (cur->type != XML_ATTRIBUTE_NODE)
+ return(NULL);
if (elem->ns == NULL)
attr = xmlHasNsProp(cur->parent, elem->name, NULL);
else
attr = xmlHasNsProp(cur->parent, elem->name, elem->ns->href);
/* elem has already been unlinked so can never be attr */
if ((attr != NULL) && (attr->type != XML_ATTRIBUTE_DECL)) {
/* different instance, destroy it (attributes must be unique) */
+ xmlUnlinkNode((xmlNodePtr) attr);
xmlFreeProp(attr);
}
}
@@ -3151,15 +3175,21 @@ xmlAddChild(xmlNodePtr parent, xmlNodePtr cur) {
return(NULL);
}
+ if (parent == cur) {
+#ifdef DEBUG_TREE
+ xmlGenericError(xmlGenericErrorContext,
+ "xmlAddChild : parent == cur\n");
+#endif
+ return(NULL);
+ }
/*
* If cur is a TEXT node, merge its content with adjacent TEXT nodes
* cur is then freed.
*/
if (cur->type == XML_TEXT_NODE) {
if ((parent->type == XML_TEXT_NODE) &&
(parent->content != NULL) &&
- (parent->name == cur->name) &&
- (parent != cur)) {
+ (parent->name == cur->name)) {
xmlNodeAddContent(parent, cur->content);
xmlFreeNode(cur);
return(parent);
@@ -3198,6 +3228,8 @@ xmlAddChild(xmlNodePtr parent, xmlNodePtr cur) {
return(parent);
}
if (cur->type == XML_ATTRIBUTE_NODE) {
+ if (parent->type != XML_ELEMENT_NODE)
+ return(NULL);
if (parent->properties == NULL) {
parent->properties = (xmlAttrPtr) cur;
} else {
@@ -3210,8 +3242,11 @@ xmlAddChild(xmlNodePtr parent, xmlNodePtr cur) {
lastattr = xmlHasNsProp(parent, cur->name, cur->ns->href);
if ((lastattr != NULL) && (lastattr != (xmlAttrPtr) cur) && (lastattr->type != XML_ATTRIBUTE_DECL)) {
/* different instance, destroy it (attributes must be unique) */
+ xmlUnlinkNode((xmlNodePtr) lastattr);
xmlFreeProp(lastattr);
}
+ if (lastattr == (xmlAttrPtr) cur)
+ return(cur);
/* find the end */
lastattr = parent->properties;
while (lastattr->next != NULL) {
@@ -3577,22 +3612,16 @@ xmlCopyNamespaceList(xmlNsPtr cur) {
static xmlNodePtr
xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent);
-/**
- * xmlCopyProp:
- * @target: the element where the attribute will be grafted
- * @cur: the attribute
- *
- * Do a copy of the attribute.
- *
- * Returns: a new #xmlAttrPtr, or NULL in case of error.
- */
-xmlAttrPtr
-xmlCopyProp(xmlNodePtr target, xmlAttrPtr cur) {
+
+static xmlAttrPtr
+xmlCopyPropInternal(xmlDocPtr doc, xmlNodePtr target, xmlAttrPtr cur) {
xmlAttrPtr ret;
if (cur == NULL) return(NULL);
if (target != NULL)
ret = xmlNewDocProp(target->doc, cur->name, NULL);
+ else if (doc != NULL)
+ ret = xmlNewDocProp(doc, cur->name, NULL);
else if (cur->parent != NULL)
ret = xmlNewDocProp(cur->parent->doc, cur->name, NULL);
else if (cur->children != NULL)
@@ -3681,6 +3710,20 @@ xmlCopyProp(xmlNodePtr target, xmlAttrPtr cur) {
}
/**
+ * xmlCopyProp:
+ * @target: the element where the attribute will be grafted
+ * @cur: the attribute
+ *
+ * Do a copy of the attribute.
+ *
+ * Returns: a new #xmlAttrPtr, or NULL in case of error.
+ */
+xmlAttrPtr
+xmlCopyProp(xmlNodePtr target, xmlAttrPtr cur) {
+ return xmlCopyPropInternal(NULL, target, cur);
+}
+
+/**
* xmlCopyPropList:
* @target: the element where the attributes will be grafted
* @cur: the first attribute
@@ -3748,7 +3791,7 @@ xmlStaticCopyNode(const xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent,
case XML_XINCLUDE_END:
break;
case XML_ATTRIBUTE_NODE:
- return((xmlNodePtr) xmlCopyProp(parent, (xmlAttrPtr) node));
+ return((xmlNodePtr) xmlCopyPropInternal(doc, parent, (xmlAttrPtr) node));
case XML_NAMESPACE_DECL:
return((xmlNodePtr) xmlCopyNamespaceList((xmlNsPtr) node));

0 comments on commit 19dc961

Please sign in to comment.