diff options
Diffstat (limited to 'dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch')
-rw-r--r-- | dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch | 57 |
1 files changed, 0 insertions, 57 deletions
diff --git a/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch b/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch deleted file mode 100644 index 2484f76e7b0b..000000000000 --- a/dev-libs/libxml2/files/libxml2-2.9.4-nullptrderef2.patch +++ /dev/null @@ -1,57 +0,0 @@ -From d8083bf77955b7879c1290f0c0a24ab8cc70f7fb Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer <wellnhofer@aevum.de> -Date: Sat, 25 Jun 2016 12:35:50 +0200 -Subject: Fix NULL pointer deref in XPointer range-to - -- Check for errors after evaluating first operand. -- Add sanity check for empty stack. - -Found with afl-fuzz. ---- - result/XPath/xptr/viderror | 4 ++++ - test/XPath/xptr/viderror | 1 + - xpath.c | 7 ++++++- - 3 files changed, 11 insertions(+), 1 deletion(-) - create mode 100644 result/XPath/xptr/viderror - create mode 100644 test/XPath/xptr/viderror - -diff --git a/result/XPath/xptr/viderror b/result/XPath/xptr/viderror -new file mode 100644 -index 0000000..d589882 ---- /dev/null -+++ b/result/XPath/xptr/viderror -@@ -0,0 +1,4 @@ -+ -+======================== -+Expression: xpointer(non-existing-fn()/range-to(id('chapter2'))) -+Object is empty (NULL) -diff --git a/test/XPath/xptr/viderror b/test/XPath/xptr/viderror -new file mode 100644 -index 0000000..da8c53b ---- /dev/null -+++ b/test/XPath/xptr/viderror -@@ -0,0 +1 @@ -+xpointer(non-existing-fn()/range-to(id('chapter2'))) -diff --git a/xpath.c b/xpath.c -index 113bce6..751665b 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -14005,9 +14005,14 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlNodeSetPtr oldset; - int i, j; - -- if (op->ch1 != -1) -+ if (op->ch1 != -1) { - total += - xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); -+ CHECK_ERROR0; -+ } -+ if (ctxt->value == NULL) { -+ XP_ERROR0(XPATH_INVALID_OPERAND); -+ } - if (op->ch2 == -1) - return (total); - --- -cgit v0.12 - |