DO NOT MERGE: Disallow namespace nodes in XPointer ranges

Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

Found with afl-fuzz.

Fixes CVE-2016-4658.

Bug: 36554207
Change-Id: Ie570c4a53ae8ca82ed4ca19701ab7d8ba9b0468f
(cherry picked from commit cde4b40a9c17aec816c6b2577250fff9354a6f3c)
1 file changed
tree: 4429dedea0c3e78570da6c646ed5b55e55e1771c
  1. .gitignore
  2. AUTHORS
  3. Android.mk
  4. ChangeLog
  5. CleanSpec.mk
  6. Copyright
  7. DOCBparser.c
  8. HACKING
  9. INSTALL.libxml2
  10. MAINTAINERS
  11. MODULE_LICENSE_MIT
  12. Makefile.am
  13. Makefile.tests
  14. Makefile.win
  15. NEWS
  16. README
  17. README.cvs-commits
  18. README.tests
  19. README.version
  20. SAX.c
  21. SAX2.c
  22. TODO
  23. TODO_SCHEMAS
  24. VxWorks/
  25. acinclude.m4
  26. autogen.sh
  27. bakefile/
  28. buf.c
  29. buf.h
  30. build_glob.py
  31. c14n.c
  32. catalog.c
  33. check-relaxng-test-suite.py
  34. check-relaxng-test-suite2.py
  35. check-xinclude-test-suite.py
  36. check-xml-test-suite.py
  37. check-xsddata-test-suite.py
  38. chvalid.c
  39. chvalid.def
  40. config.h
  41. configure.ac
  42. dbgen.pl
  43. dbgenattr.pl
  44. debugXML.c
  45. dict.c
  46. doc/
  47. elfgcchack.h
  48. enc.h
  49. encoding.c
  50. entities.c
  51. error.c
  52. example/
  53. genChRanges.py
  54. genUnicode.py
  55. gentest.py
  56. global.data
  57. globals.c
  58. hash.c
  59. include/
  60. legacy.c
  61. libxml-2.0-uninstalled.pc.in
  62. libxml-2.0.pc.in
  63. libxml.3
  64. libxml.h
  65. libxml.m4
  66. libxml.spec.in
  67. libxml2-config.cmake.in
  68. libxml2.doap
  69. libxml2.syms
  70. list.c
  71. macos/
  72. nanoftp.c
  73. nanohttp.c
  74. optim/
  75. os400/
  76. parser.c
  77. parserInternals.c
  78. pattern.c
  79. python/
  80. regressions.py
  81. regressions.xml
  82. relaxng.c
  83. result/
  84. rngparser.c
  85. runsuite.c
  86. runtest.c
  87. runxmlconf.c
  88. save.h
  89. schematron.c
  90. test/
  91. testAutomata.c
  92. testC14N.c
  93. testHTML.c
  94. testModule.c
  95. testOOM.c
  96. testOOMlib.c
  97. testOOMlib.h
  98. testReader.c
  99. testRegexp.c
  100. testRelax.c
  101. testSAX.c
  102. testSchemas.c
  103. testThreads.c
  104. testThreadsWin32.c
  105. testURI.c
  106. testXPath.c
  107. testapi.c
  108. testchar.c
  109. testdict.c
  110. testdso.c
  111. testlimits.c
  112. testrecurse.c
  113. threads.c
  114. timsort.h
  115. tree.c
  116. trio.c
  117. trio.h
  118. triodef.h
  119. trionan.c
  120. trionan.h
  121. triop.h
  122. triostr.c
  123. triostr.h
  124. uri.c
  125. valid.c
  126. vms/
  127. win32/
  128. xinclude.c
  129. xlink.c
  130. xml2-config.1
  131. xml2-config.in
  132. xml2Conf.sh.in
  133. xmlIO.c
  134. xmlcatalog.c
  135. xmllint.c
  136. xmlmemory.c
  137. xmlmodule.c
  138. xmlreader.c
  139. xmlregexp.c
  140. xmlsave.c
  141. xmlschemas.c
  142. xmlschemastypes.c
  143. xmlstring.c
  144. xmlunicode.c
  145. xmlwriter.c
  146. xpath.c
  147. xpointer.c
  148. xstc/
  149. xzlib.c
  150. xzlib.h