Skip to content
This repository has been archived by the owner on Nov 8, 2023. It is now read-only.

Commit

Permalink
Upgrade libxml2 to 2.7.3 to patch some vulnerabilities.
Browse files Browse the repository at this point in the history
  • Loading branch information
Patrick Scott committed Jul 9, 2009
1 parent 0c736a3 commit 60a4c35
Show file tree
Hide file tree
Showing 56 changed files with 8,364 additions and 5,641 deletions.
94 changes: 70 additions & 24 deletions HTMLparser.c
View file
Expand Up @@ -2143,6 +2143,7 @@ htmlNewDocNoDtD(const xmlChar *URI, const xmlChar *ExternalID) {
cur->refs = NULL;
cur->_private = NULL;
cur->charset = XML_CHAR_ENCODING_UTF8;
cur->properties = XML_DOC_HTML | XML_DOC_USERBUILT;
if ((ExternalID != NULL) ||
(URI != NULL))
xmlCreateIntSubset(cur, BAD_CAST "html", ExternalID, URI);
Expand Down Expand Up @@ -2767,6 +2768,7 @@ htmlParseCharData(htmlParserCtxtPtr ctxt) {
xmlChar buf[HTML_PARSER_BIG_BUFFER_SIZE + 5];
int nbchar = 0;
int cur, l;
int chunk = 0;

SHRINK;
cur = CUR_CHAR(l);
Expand Down Expand Up @@ -2797,6 +2799,12 @@ htmlParseCharData(htmlParserCtxtPtr ctxt) {
nbchar = 0;
}
NEXTL(l);
chunk++;
if (chunk > HTML_PARSER_BUFFER_SIZE) {
chunk = 0;
SHRINK;
GROW;
}
cur = CUR_CHAR(l);
if (cur == 0) {
SHRINK;
Expand Down Expand Up @@ -3115,9 +3123,9 @@ htmlParseCharRef(htmlParserCtxtPtr ctxt) {
val = val * 16 + (CUR - 'A') + 10;
else {
htmlParseErr(ctxt, XML_ERR_INVALID_HEX_CHARREF,
"htmlParseCharRef: invalid hexadecimal value\n",
"htmlParseCharRef: missing semicolumn\n",
NULL, NULL);
return(0);
break;
}
NEXT;
}
Expand All @@ -3130,9 +3138,9 @@ htmlParseCharRef(htmlParserCtxtPtr ctxt) {
val = val * 10 + (CUR - '0');
else {
htmlParseErr(ctxt, XML_ERR_INVALID_DEC_CHARREF,
"htmlParseCharRef: invalid decimal value\n",
"htmlParseCharRef: missing semicolumn\n",
NULL, NULL);
return(0);
break;
}
NEXT;
}
Expand Down Expand Up @@ -3423,7 +3431,7 @@ htmlCheckMeta(htmlParserCtxtPtr ctxt, const xmlChar **atts) {
*
* [NS 10] EmptyElement ::= '<' QName (S Attribute)* S? '/>'
*
* Returns 0 in case of success and -1 in case of error.
* Returns 0 in case of success, -1 in case of error and 1 if discarded
*/

static int
Expand All @@ -3436,6 +3444,7 @@ htmlParseStartTag(htmlParserCtxtPtr ctxt) {
int maxatts;
int meta = 0;
int i;
int discardtag = 0;

if ((ctxt == NULL) || (ctxt->input == NULL)) {
htmlParseErr(ctxt, XML_ERR_INTERNAL_ERROR,
Expand Down Expand Up @@ -3480,14 +3489,16 @@ htmlParseStartTag(htmlParserCtxtPtr ctxt) {
htmlParseErr(ctxt, XML_HTML_STRUCURE_ERROR,
"htmlParseStartTag: misplaced <html> tag\n",
name, NULL);
return 0;
discardtag = 1;
ctxt->depth++;
}
if ((ctxt->nameNr != 1) &&
(xmlStrEqual(name, BAD_CAST"head"))) {
htmlParseErr(ctxt, XML_HTML_STRUCURE_ERROR,
"htmlParseStartTag: misplaced <head> tag\n",
name, NULL);
return 0;
discardtag = 1;
ctxt->depth++;
}
if (xmlStrEqual(name, BAD_CAST"body")) {
int indx;
Expand All @@ -3496,9 +3507,8 @@ htmlParseStartTag(htmlParserCtxtPtr ctxt) {
htmlParseErr(ctxt, XML_HTML_STRUCURE_ERROR,
"htmlParseStartTag: misplaced <body> tag\n",
name, NULL);
while ((IS_CHAR_CH(CUR)) && (CUR != '>'))
NEXT;
return 0;
discardtag = 1;
ctxt->depth++;
}
}
}
Expand Down Expand Up @@ -3597,12 +3607,14 @@ htmlParseStartTag(htmlParserCtxtPtr ctxt) {
/*
* SAX: Start of Element !
*/
htmlnamePush(ctxt, name);
if ((ctxt->sax != NULL) && (ctxt->sax->startElement != NULL)) {
if (nbatts != 0)
ctxt->sax->startElement(ctxt->userData, name, atts);
else
ctxt->sax->startElement(ctxt->userData, name, NULL);
if (!discardtag) {
htmlnamePush(ctxt, name);
if ((ctxt->sax != NULL) && (ctxt->sax->startElement != NULL)) {
if (nbatts != 0)
ctxt->sax->startElement(ctxt->userData, name, atts);
else
ctxt->sax->startElement(ctxt->userData, name, NULL);
}
}

if (atts != NULL) {
Expand All @@ -3612,7 +3624,7 @@ htmlParseStartTag(htmlParserCtxtPtr ctxt) {
}
}

return 0;
return(discardtag);
}

/**
Expand Down Expand Up @@ -3647,7 +3659,6 @@ htmlParseEndTag(htmlParserCtxtPtr ctxt)
name = htmlParseHTMLName(ctxt);
if (name == NULL)
return (0);

/*
* We should definitely be at the ending "S? '>'" part
*/
Expand All @@ -3667,6 +3678,18 @@ htmlParseEndTag(htmlParserCtxtPtr ctxt)
} else
NEXT;

/*
* if we ignored misplaced tags in htmlParseStartTag don't pop them
* out now.
*/
if ((ctxt->depth > 0) &&
(xmlStrEqual(name, BAD_CAST "html") ||
xmlStrEqual(name, BAD_CAST "body") ||
xmlStrEqual(name, BAD_CAST "head"))) {
ctxt->depth--;
return (0);
}

/*
* If the name read is not one of the element in the parsing stack
* then return, it's just an error.
Expand Down Expand Up @@ -3991,7 +4014,7 @@ htmlParseElement(htmlParserCtxtPtr ctxt) {

failed = htmlParseStartTag(ctxt);
name = ctxt->name;
if (failed || (name == NULL)) {
if ((failed == -1) || (name == NULL)) {
if (CUR == '>')
NEXT;
return;
Expand Down Expand Up @@ -4097,6 +4120,8 @@ htmlParseElement(htmlParserCtxtPtr ctxt) {

int
htmlParseDocument(htmlParserCtxtPtr ctxt) {
xmlChar start[4];
xmlCharEncoding enc;
xmlDtdPtr dtd;

xmlInitParser();
Expand All @@ -4116,6 +4141,23 @@ htmlParseDocument(htmlParserCtxtPtr ctxt) {
if ((ctxt->sax) && (ctxt->sax->setDocumentLocator))
ctxt->sax->setDocumentLocator(ctxt->userData, &xmlDefaultSAXLocator);

if ((ctxt->encoding == (const xmlChar *)XML_CHAR_ENCODING_NONE) &&
((ctxt->input->end - ctxt->input->cur) >= 4)) {
/*
* Get the 4 first bytes and decode the charset
* if enc != XML_CHAR_ENCODING_NONE
* plug some encoding conversion routines.
*/
start[0] = RAW;
start[1] = NXT(1);
start[2] = NXT(2);
start[3] = NXT(3);
enc = xmlDetectCharEncoding(&start[0], 4);
if (enc != XML_CHAR_ENCODING_NONE) {
xmlSwitchEncoding(ctxt, enc);
}
}

/*
* Wipe out everything which is before the first '<'
*/
Expand All @@ -4135,10 +4177,10 @@ htmlParseDocument(htmlParserCtxtPtr ctxt) {
while (((CUR == '<') && (NXT(1) == '!') &&
(NXT(2) == '-') && (NXT(3) == '-')) ||
((CUR == '<') && (NXT(1) == '?'))) {
htmlParseComment(ctxt);
htmlParsePI(ctxt);
htmlParseComment(ctxt);
htmlParsePI(ctxt);
SKIP_BLANKS;
}
}


/*
Expand Down Expand Up @@ -4893,7 +4935,7 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {

failed = htmlParseStartTag(ctxt);
name = ctxt->name;
if (failed ||
if ((failed == -1) ||
(name == NULL)) {
if (CUR == '>')
NEXT;
Expand Down Expand Up @@ -5957,8 +5999,12 @@ htmlDoRead(htmlParserCtxtPtr ctxt, const char *URL, const char *encoding,
xmlCharEncodingHandlerPtr hdlr;

hdlr = xmlFindCharEncodingHandler(encoding);
if (hdlr != NULL)
if (hdlr != NULL) {
xmlSwitchToEncoding(ctxt, hdlr);
if (ctxt->input->encoding != NULL)
xmlFree((xmlChar *) ctxt->input->encoding);
ctxt->input->encoding = xmlStrdup((xmlChar *)encoding);
}
}
if ((URL != NULL) && (ctxt->input != NULL) &&
(ctxt->input->filename == NULL))
Expand Down
7 changes: 6 additions & 1 deletion HTMLtree.c
View file
Expand Up @@ -316,6 +316,11 @@ htmlIsBooleanAttr(const xmlChar *name)
}

#ifdef LIBXML_OUTPUT_ENABLED
/*
* private routine exported from xmlIO.c
*/
xmlOutputBufferPtr
xmlAllocOutputBufferInternal(xmlCharEncodingHandlerPtr encoder);
/************************************************************************
* *
* Output error handlers *
Expand Down Expand Up @@ -566,7 +571,7 @@ htmlDocDumpMemoryFormat(xmlDocPtr cur, xmlChar**mem, int *size, int format) {
if (handler == NULL)
handler = xmlFindCharEncodingHandler("ascii");

buf = xmlAllocOutputBuffer(handler);
buf = xmlAllocOutputBufferInternal(handler);
if (buf == NULL) {
*mem = NULL;
*size = 0;
Expand Down
34 changes: 31 additions & 3 deletions SAX2.c
View file
Expand Up @@ -11,6 +11,7 @@
#include "libxml.h"
#include <stdlib.h>
#include <string.h>
#include <limits.h>
#include <libxml/xmlmemory.h>
#include <libxml/tree.h>
#include <libxml/parser.h>
Expand All @@ -26,6 +27,11 @@
#include <libxml/HTMLtree.h>
#include <libxml/globals.h>

/* Define SIZE_T_MAX unless defined through <limits.h>. */
#ifndef SIZE_T_MAX
# define SIZE_T_MAX ((size_t)-1)
#endif /* !SIZE_T_MAX */

/* #define DEBUG_SAX2 */
/* #define DEBUG_SAX2_TREE */

Expand Down Expand Up @@ -580,7 +586,8 @@ xmlSAX2GetEntity(void *ctx, const xmlChar *name)
return(NULL);
}
ret->owner = 1;
ret->checked = 1;
if (ret->checked == 0)
ret->checked = 1;
}
return(ret);
}
Expand Down Expand Up @@ -957,6 +964,8 @@ xmlSAX2StartDocument(void *ctx)
#ifdef LIBXML_HTML_ENABLED
if (ctxt->myDoc == NULL)
ctxt->myDoc = htmlNewDocNoDtD(NULL, NULL);
ctxt->myDoc->properties = XML_DOC_HTML;
ctxt->myDoc->parseFlags = ctxt->options;
if (ctxt->myDoc == NULL) {
xmlSAX2ErrMemory(ctxt, "xmlSAX2StartDocument");
return;
Expand All @@ -972,6 +981,10 @@ xmlSAX2StartDocument(void *ctx)
} else {
doc = ctxt->myDoc = xmlNewDoc(ctxt->version);
if (doc != NULL) {
doc->properties = 0;
if (ctxt->options & XML_PARSE_OLD10)
doc->properties |= XML_DOC_OLD10;
doc->parseFlags = ctxt->options;
if (ctxt->encoding != NULL)
doc->encoding = xmlStrdup(ctxt->encoding);
else
Expand Down Expand Up @@ -1837,6 +1850,9 @@ xmlSAX2TextNode(xmlParserCtxtPtr ctxt, const xmlChar *str, int len) {
} else
ret->content = (xmlChar *) intern;

if (ctxt->input != NULL)
ret->line = ctxt->input->line;

if ((__xmlRegisterCallbacks) && (xmlRegisterNodeDefaultValue))
xmlRegisterNodeDefaultValue(ret);
return(ret);
Expand Down Expand Up @@ -2366,7 +2382,9 @@ xmlSAX2Reference(void *ctx, const xmlChar *name)
xmlGenericError(xmlGenericErrorContext,
"add xmlSAX2Reference %s to %s \n", name, ctxt->node->name);
#endif
xmlAddChild(ctxt->node, ret);
if (xmlAddChild(ctxt->node, ret) == NULL) {
xmlFreeNode(ret);
}
}

/**
Expand Down Expand Up @@ -2443,9 +2461,19 @@ xmlSAX2Characters(void *ctx, const xmlChar *ch, int len)
(xmlDictOwns(ctxt->dict, lastChild->content))) {
lastChild->content = xmlStrdup(lastChild->content);
}
if (((size_t)ctxt->nodelen + (size_t)len > XML_MAX_TEXT_LENGTH) &&
((ctxt->options & XML_PARSE_HUGE) == 0)) {
xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters: huge text node");
return;
}
if ((size_t)ctxt->nodelen > SIZE_T_MAX - (size_t)len ||
(size_t)ctxt->nodemem + (size_t)len > SIZE_T_MAX / 2) {
xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
return;
}
if (ctxt->nodelen + len >= ctxt->nodemem) {
xmlChar *newbuf;
int size;
size_t size;

size = ctxt->nodemem + len;
size *= 2;
Expand Down
4 changes: 3 additions & 1 deletion catalog.c
View file
Expand Up @@ -2616,6 +2616,8 @@ xmlCatalogSGMLResolve(xmlCatalogPtr catal, const xmlChar *pubID,
return(ret);
if (sysID != NULL)
ret = xmlCatalogGetSGMLSystem(catal->sgml, sysID);
if (ret != NULL)
return(ret);
return(NULL);
}

Expand Down Expand Up @@ -2912,7 +2914,7 @@ xmlACatalogResolveURI(xmlCatalogPtr catal, const xmlChar *URI) {

sgml = xmlCatalogSGMLResolve(catal, NULL, URI);
if (sgml != NULL)
sgml = xmlStrdup(sgml);
ret = xmlStrdup(sgml);
}
return(ret);
}
Expand Down

0 comments on commit 60a4c35

Please sign in to comment.