tree 5211da30a4c7f00a72c93f835dabe7fb980ad627
parent cb49e764a467ce03c0da861c7d05fa75dcd4d915
author Brian C. Young <bcyoung@google.com> 1491248762 -0700
committer JP Sugarbroad <jpsugar@google.com> 1492113337 +0000

DO NOT MERGE: Fix XPointer paths beginning with range-to

The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.

The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.

Found with afl-fuzz.

Fixes CVE-2016-5131.

Bug: 36554209
Change-Id: I2bd369290a884c432d16796884d48db6285f8502
(cherry picked from commit 574adc92c8710e0cd2ed41dbc6d66cc00cf3f5b9)