Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:11.2
libxslt-python
libxslt-CVE-2012-6139.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File libxslt-CVE-2012-6139.patch of Package libxslt-python
From dc11b6b379a882418093ecc8adf11f6166682e8d Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer <wellnhofer@aevum.de> Date: Sun, 21 Oct 2012 17:02:25 +0000 Subject: Fix crash with empty xsl:key/@match attribute See https://bugzilla.gnome.org/show_bug.cgi?id=685328 Also improve some xsl:key error messages. From 6c99c519d97e5fcbec7a9537d190efb442e4e833 Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer <wellnhofer@aevum.de> Date: Wed, 10 Oct 2012 10:09:36 +0000 Subject: Crash when passing an uninitialized variable to document() https://bugzilla.gnome.org/show_bug.cgi?id=685330 Missing check for NULL --- Index: libxslt-1.1.26/libxslt/keys.c =================================================================== --- libxslt-1.1.26.orig/libxslt/keys.c 2013-03-26 11:58:20.518990106 +0100 +++ libxslt-1.1.26/libxslt/keys.c 2013-03-26 11:58:21.717026395 +0100 @@ -311,8 +311,8 @@ xsltAddKey(xsltStylesheetPtr style, cons end = skipPredicate(match, end); if (end <= 0) { xsltTransformError(NULL, style, inst, - "key pattern is malformed: %s", - key->match); + "xsl:key : 'match' pattern is malformed: %s", + key->match); if (style != NULL) style->errors++; goto error; } @@ -321,7 +321,7 @@ xsltAddKey(xsltStylesheetPtr style, cons } if (current == end) { xsltTransformError(NULL, style, inst, - "key pattern is empty\n"); + "xsl:key : 'match' pattern is empty\n"); if (style != NULL) style->errors++; goto error; } @@ -344,6 +344,12 @@ xsltAddKey(xsltStylesheetPtr style, cons } current = end; } + if (pattern == NULL) { + xsltTransformError(NULL, style, inst, + "xsl:key : 'match' pattern is empty\n"); + if (style != NULL) style->errors++; + goto error; + } #ifdef WITH_XSLT_DEBUG_KEYS xsltGenericDebug(xsltGenericDebugContext, " resulting pattern %s\n", pattern); @@ -359,14 +365,14 @@ xsltAddKey(xsltStylesheetPtr style, cons key->comp = xsltXPathCompile(style, pattern); if (key->comp == NULL) { xsltTransformError(NULL, style, inst, - "xsl:key : XPath pattern compilation failed '%s'\n", + "xsl:key : 'match' pattern compilation failed '%s'\n", pattern); if (style != NULL) style->errors++; } key->usecomp = xsltXPathCompile(style, use); if (key->usecomp == NULL) { xsltTransformError(NULL, style, inst, - "xsl:key : XPath pattern compilation failed '%s'\n", + "xsl:key : 'use' expression compilation failed '%s'\n", use); if (style != NULL) style->errors++; } Index: libxslt-1.1.26/libxslt/functions.c =================================================================== --- libxslt-1.1.26.orig/libxslt/functions.c 2013-03-26 11:58:20.519990136 +0100 +++ libxslt-1.1.26/libxslt/functions.c 2013-03-26 11:58:21.718026425 +0100 @@ -260,7 +260,7 @@ xsltDocumentFunction(xmlXPathParserConte obj = valuePop(ctxt); ret = xmlXPathNewNodeSet(NULL); - if (obj->nodesetval) { + if ((obj != NULL) && obj->nodesetval) { for (i = 0; i < obj->nodesetval->nodeNr; i++) { valuePush(ctxt, xmlXPathNewNodeSet(obj->nodesetval->nodeTab[i])); @@ -280,7 +280,8 @@ xsltDocumentFunction(xmlXPathParserConte } } - xmlXPathFreeObject(obj); + if (obj != NULL) + xmlXPathFreeObject(obj); if (obj2 != NULL) xmlXPathFreeObject(obj2); valuePush(ctxt, ret); Index: libxslt-1.1.26/tests/docs/bug-180.xml =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ libxslt-1.1.26/tests/docs/bug-180.xml 2013-03-26 11:58:21.719026455 +0100 @@ -0,0 +1,2 @@ +<doc/> + Index: libxslt-1.1.26/tests/general/bug-180.err =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ libxslt-1.1.26/tests/general/bug-180.err 2013-03-26 11:58:21.720026486 +0100 @@ -0,0 +1,4 @@ +runtime error: file ./bug-180.xsl line 4 element copy-of +Variable 'xxx' has not been declared. +XPath error : Stack usage errror +xmlXPathCompiledEval: 1 objects left on the stack. Index: libxslt-1.1.26/tests/general/bug-180.xsl =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ libxslt-1.1.26/tests/general/bug-180.xsl 2013-03-26 11:58:21.721026516 +0100 @@ -0,0 +1,8 @@ +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + + <xsl:template match="/"> + <xsl:copy-of select=" * | document($xxx) "/> + </xsl:template> + +</xsl:stylesheet> +
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor