Google Git
Sign in
android / platform / external / libxml2 / 0eff71008becb7f2c2b4509708da4b79985948bb
commit0eff71008becb7f2c2b4509708da4b79985948bb[log] [tgz]
authorBrian C. Young <bcyoung@google.com>Mon Apr 03 12:46:02 2017 -0700
committergitbuildkicker <android-build@google.com>Mon Apr 17 16:24:07 2017 -0700
tree143c8b6a1bab7e25e0857f4b4f9991bbe0349de6
parent8ea80f29ea5fdf383ee3ae59ce35e55421a339f8 [diff]
DO NOT MERGE: Fix XPointer paths beginning with range-to

The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.

The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.

Found with afl-fuzz.

Fixes CVE-2016-5131.

Bug: 36554209
Change-Id: I2bd369290a884c432d16796884d48db6285f8502
(cherry picked from commit e875e1cd1fc92fd2daa57826024125cbd0b195c7)
3 files changed
tree: 143c8b6a1bab7e25e0857f4b4f9991bbe0349de6
  1. bakefile/
  2. doc/
  3. example/
  4. include/
  5. macos/
  6. optim/
  7. os400/
  8. python/
  9. result/
  10. test/
  11. vms/
  12. VxWorks/
  13. win32/
  14. xstc/
  15. NOTICE ⇨ Copyright
  16. .gitignore
  17. acinclude.m4
  18. Android.mk
  19. AUTHORS
  20. autogen.sh
  21. buf.c
  22. buf.h
  23. build_glob.py
  24. c14n.c
  25. catalog.c
  26. ChangeLog
  27. check-relaxng-test-suite.py
  28. check-relaxng-test-suite2.py
  29. check-xinclude-test-suite.py
  30. check-xml-test-suite.py
  31. check-xsddata-test-suite.py
  32. chvalid.c
  33. chvalid.def
  34. CleanSpec.mk
  35. config.h
  36. configure.ac
  37. Copyright
  38. dbgen.pl
  39. dbgenattr.pl
  40. debugXML.c
  41. dict.c
  42. DOCBparser.c
  43. elfgcchack.h
  44. enc.h
  45. encoding.c
  46. entities.c
  47. error.c
  48. genChRanges.py
  49. gentest.py
  50. genUnicode.py
  51. global.data
  52. globals.c
  53. HACKING
  54. hash.c
  55. INSTALL.libxml2
  56. legacy.c
  57. libxml-2.0-uninstalled.pc.in
  58. libxml-2.0.pc.in
  59. libxml.3
  60. libxml.h
  61. libxml.m4
  62. libxml.spec.in
  63. libxml2-config.cmake.in
  64. libxml2.doap
  65. libxml2.syms
  66. list.c
  67. MAINTAINERS
  68. Makefile.am
  69. Makefile.tests
  70. Makefile.win
  71. MODULE_LICENSE_MIT
  72. nanoftp.c
  73. nanohttp.c
  74. NEWS
  75. parser.c
  76. parserInternals.c
  77. pattern.c
  78. README
  79. README.cvs-commits
  80. README.tests
  81. README.version
  82. regressions.py
  83. regressions.xml
  84. relaxng.c
  85. rngparser.c
  86. runsuite.c
  87. runtest.c
  88. runxmlconf.c
  89. save.h
  90. SAX.c
  91. SAX2.c
  92. schematron.c
  93. testapi.c
  94. testAutomata.c
  95. testC14N.c
  96. testchar.c
  97. testdict.c
  98. testdso.c
  99. testHTML.c
  100. testlimits.c
  101. testModule.c
  102. testOOM.c
  103. testOOMlib.c
  104. testOOMlib.h
  105. testReader.c
  106. testrecurse.c
  107. testRegexp.c
  108. testRelax.c
  109. testSAX.c
  110. testSchemas.c
  111. testThreads.c
  112. testThreadsWin32.c
  113. testURI.c
  114. testXPath.c
  115. threads.c
  116. timsort.h
  117. TODO
  118. TODO_SCHEMAS
  119. tree.c
  120. trio.c
  121. trio.h
  122. triodef.h
  123. trionan.c
  124. trionan.h
  125. triop.h
  126. triostr.c
  127. triostr.h
  128. uri.c
  129. valid.c
  130. xinclude.c
  131. xlink.c
  132. xml2-config.1
  133. xml2-config.in
  134. xml2Conf.sh.in
  135. xmlcatalog.c
  136. xmlIO.c
  137. xmllint.c
  138. xmlmemory.c
  139. xmlmodule.c
  140. xmlreader.c
  141. xmlregexp.c
  142. xmlsave.c
  143. xmlschemas.c
  144. xmlschemastypes.c
  145. xmlstring.c
  146. xmlunicode.c
  147. xmlwriter.c
  148. xpath.c
  149. xpointer.c
  150. xzlib.c
  151. xzlib.h