Google Git
Sign in
android/platform/external/libxml2/583ce3c98f13a64398a9f59baa042e36998b0581
commit
583ce3c98f13a64398a9f59baa042e36998b0581
[log] [tgz]
author
Brian C. Young <bcyoung@google.com>
Mon Apr 03 12:39:04 2017 -0700
committer
android-build-team Robot <android-build-team-robot@google.com>
Wed Aug 23 19:12:43 2017 +0000
tree
4a9a4a43c7c9b1ddae4c4852e0ce489638a87a8b
parent
e5612964d8db30ee5c0586c91d608feb68252164 [diff]
DO NOT MERGE: Disallow namespace nodes in XPointer ranges

Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

Found with afl-fuzz.

Fixes CVE-2016-4658.

Bug: 36554207
Change-Id: Ie570c4a53ae8ca82ed4ca19701ab7d8ba9b0468f
(cherry picked from commit cde4b40a9c17aec816c6b2577250fff9354a6f3c)
1 file changed
tree: 4a9a4a43c7c9b1ddae4c4852e0ce489638a87a8b
  1. bakefile/
  2. doc/
  3. example/
  4. include/
  5. macos/
  6. optim/
  7. os400/
  8. python/
  9. result/
  10. test/
  11. vms/
  12. VxWorks/
  13. win32/
  14. xstc/
  15. NOTICE ⇨ Copyright
  16. .gitignore
  17. acinclude.m4
  18. Android.mk
  19. AUTHORS
  20. autogen.sh
  21. buf.c
  22. buf.h
  23. build_glob.py
  24. c14n.c
  25. catalog.c
  26. ChangeLog
  27. check-relaxng-test-suite.py
  28. check-relaxng-test-suite2.py
  29. check-xinclude-test-suite.py
  30. check-xml-test-suite.py
  31. check-xsddata-test-suite.py
  32. chvalid.c
  33. chvalid.def
  34. CleanSpec.mk
  35. config.h
  36. configure.ac
  37. Copyright
  38. dbgen.pl
  39. dbgenattr.pl
  40. debugXML.c
  41. dict.c
  42. DOCBparser.c
  43. elfgcchack.h
  44. enc.h
  45. encoding.c
  46. entities.c
  47. error.c
  48. genChRanges.py
  49. gentest.py
  50. genUnicode.py
  51. global.data
  52. globals.c
  53. HACKING
  54. hash.c
  55. INSTALL.libxml2
  56. legacy.c
  57. libxml-2.0-uninstalled.pc.in
  58. libxml-2.0.pc.in
  59. libxml.3
  60. libxml.h
  61. libxml.m4
  62. libxml.spec.in
  63. libxml2-config.cmake.in
  64. libxml2.doap
  65. libxml2.syms
  66. list.c
  67. MAINTAINERS
  68. Makefile.am
  69. Makefile.tests
  70. Makefile.win
  71. MODULE_LICENSE_MIT
  72. nanoftp.c
  73. nanohttp.c
  74. NEWS
  75. parser.c
  76. parserInternals.c
  77. pattern.c
  78. README
  79. README.cvs-commits
  80. README.tests
  81. README.version
  82. regressions.py
  83. regressions.xml
  84. relaxng.c
  85. rngparser.c
  86. runsuite.c
  87. runtest.c
  88. runxmlconf.c
  89. save.h
  90. SAX.c
  91. SAX2.c
  92. schematron.c
  93. testapi.c
  94. testAutomata.c
  95. testC14N.c
  96. testchar.c
  97. testdict.c
  98. testdso.c
  99. testHTML.c
  100. testlimits.c
  101. testModule.c
  102. testOOM.c
  103. testOOMlib.c
  104. testOOMlib.h
  105. testReader.c
  106. testrecurse.c
  107. testRegexp.c
  108. testRelax.c
  109. testSAX.c
  110. testSchemas.c
  111. testThreads.c
  112. testThreadsWin32.c
  113. testURI.c
  114. testXPath.c
  115. threads.c
  116. timsort.h
  117. TODO
  118. TODO_SCHEMAS
  119. tree.c
  120. trio.c
  121. trio.h
  122. triodef.h
  123. trionan.c
  124. trionan.h
  125. triop.h
  126. triostr.c
  127. triostr.h
  128. uri.c
  129. valid.c
  130. xinclude.c
  131. xlink.c
  132. xml2-config.1
  133. xml2-config.in
  134. xml2Conf.sh.in
  135. xmlcatalog.c
  136. xmlIO.c
  137. xmllint.c
  138. xmlmemory.c
  139. xmlmodule.c
  140. xmlreader.c
  141. xmlregexp.c
  142. xmlsave.c
  143. xmlschemas.c
  144. xmlschemastypes.c
  145. xmlstring.c
  146. xmlunicode.c
  147. xmlwriter.c
  148. xpath.c
  149. xpointer.c
  150. xzlib.c
  151. xzlib.h