tree 143c8b6a1bab7e25e0857f4b4f9991bbe0349de6
parent 095c0758605bd6b22bd60903596ed69cada4efa9
author Brian C. Young <bcyoung@google.com> 1491248762 -0700
committer gitbuildkicker <android-build@google.com> 1492625927 -0700

DO NOT MERGE: Fix XPointer paths beginning with range-to

The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.

The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.

Found with afl-fuzz.

Fixes CVE-2016-5131.

Bug: 36554209
Change-Id: I2bd369290a884c432d16796884d48db6285f8502
(cherry picked from commit e875e1cd1fc92fd2daa57826024125cbd0b195c7)