Attachment 305960 Details for Bug 446809 – Patch for libxslt 1.1.11

[patch] Patch for libxslt 1.1.11

libxslt-1.1.11-CVE-2008-1767.diff (text/plain), 5.14 KB, created by Tomas Hoger on 2008-05-19 15:27:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-05-19 15:27:53 UTC

Size: 5.14 KB

patch

obsolete

>--- libxslt/pattern.c.orig	2004-09-29 15:41:28.000000000 +0200
>+++ libxslt/pattern.c	2008-05-19 14:50:18.000000000 +0200
>@@ -90,7 +90,7 @@ struct _xsltCompMatch {
>     int maxStep;
>     xmlNsPtr *nsList;		/* the namespaces in scope */
>     int nsNr;			/* the number of namespaces in scope */
>-    xsltStepOp steps[40];        /* ops for computation */
>+    xsltStepOpPtr steps;        /* ops for computation */
> };
> 
> typedef struct _xsltParserContext xsltParserContext;
>@@ -130,7 +130,16 @@ xsltNewCompMatch(void) {
> 	return(NULL);
>     }
>     memset(cur, 0, sizeof(xsltCompMatch));
>-    cur->maxStep = 40;
>+    cur->maxStep = 10;
>+    cur->nbStep = 0;
>+    cur-> steps = (xsltStepOpPtr) xmlMalloc(sizeof(xsltStepOp) *
>+                                            cur->maxStep);
>+    if (cur->steps == NULL) {
>+	xsltTransformError(NULL, NULL, NULL,
>+		"xsltNewCompMatch : out of memory error\n");
>+	xmlFree(cur);
>+	return(NULL);
>+    }
>     cur->nsNr = 0;
>     cur->nsList = NULL;
>     return(cur);
>@@ -168,6 +177,7 @@ xsltFreeCompMatch(xsltCompMatchPtr comp)
> 	if (op->comp != NULL)
> 	    xmlXPathFreeCompExpr(op->comp);
>     }
>+    xmlFree(comp->steps);
>     memset(comp, -1, sizeof(xsltCompMatch));
>     xmlFree(comp);
> }
>@@ -265,14 +275,26 @@ static int
> xsltCompMatchAdd(xsltParserContextPtr ctxt, xsltCompMatchPtr comp,
>                  xsltOp op, xmlChar * value, xmlChar * value2)
> {
>-    if (comp->nbStep >= 40) {
>-        xsltTransformError(NULL, NULL, NULL,
>-                         "xsltCompMatchAdd: overflow\n");
>-        return (-1);
>+    if (comp->nbStep >= comp->maxStep) {
>+        xsltStepOpPtr tmp;
>+
>+	tmp = (xsltStepOpPtr) xmlRealloc(comp->steps, comp->maxStep * 2 *
>+	                                 sizeof(xsltStepOp));
>+	if (tmp == NULL) {
>+	    xsltGenericError(xsltGenericErrorContext,
>+	     "xsltCompMatchAdd: memory re-allocation failure.\n");
>+	    if (ctxt->style != NULL)
>+		ctxt->style->errors++;
>+	    return (-1);
>+	}
>+        comp->maxStep *= 2;
>+	comp->steps = tmp;
>     }
>     comp->steps[comp->nbStep].op = op;
>     comp->steps[comp->nbStep].value = value;
>     comp->steps[comp->nbStep].value2 = value2;
>+    comp->steps[comp->nbStep].value3 = NULL;
>+    comp->steps[comp->nbStep].comp = NULL;
>     if (ctxt->ctxt != NULL) {
> 	comp->steps[comp->nbStep].previousExtra =
> 	    xsltAllocateExtraCtxt(ctxt->ctxt);
>@@ -310,6 +332,7 @@ xsltSwapTopCompMatch(xsltCompMatchPtr co
> 	register xmlChar *tmp;
> 	register xsltOp op;
> 	register xmlXPathCompExprPtr expr; 
>+	register int t;
> 	i = j - 1;
> 	tmp = comp->steps[i].value;
> 	comp->steps[i].value = comp->steps[j].value;
>@@ -317,12 +340,24 @@ xsltSwapTopCompMatch(xsltCompMatchPtr co
> 	tmp = comp->steps[i].value2;
> 	comp->steps[i].value2 = comp->steps[j].value2;
> 	comp->steps[j].value2 = tmp;
>+	tmp = comp->steps[i].value3;
>+	comp->steps[i].value3 = comp->steps[j].value3;
>+	comp->steps[j].value3 = tmp;
> 	op = comp->steps[i].op;
> 	comp->steps[i].op = comp->steps[j].op;
> 	comp->steps[j].op = op;
> 	expr = comp->steps[i].comp;
> 	comp->steps[i].comp = comp->steps[j].comp;
> 	comp->steps[j].comp = expr;
>+	t = comp->steps[i].previousExtra;
>+	comp->steps[i].previousExtra = comp->steps[j].previousExtra;
>+	comp->steps[j].previousExtra = t;
>+	t = comp->steps[i].indexExtra;
>+	comp->steps[i].indexExtra = comp->steps[j].indexExtra;
>+	comp->steps[j].indexExtra = t;
>+	t = comp->steps[i].lenExtra;
>+	comp->steps[i].lenExtra = comp->steps[j].lenExtra;
>+	comp->steps[j].lenExtra = t;
>     }
> }
> 
>@@ -333,7 +368,7 @@ xsltSwapTopCompMatch(xsltCompMatchPtr co
>  * reverse all the stack of expressions
>  */
> static void
>-xsltReverseCompMatch(xsltCompMatchPtr comp) {
>+xsltReverseCompMatch(xsltParserContextPtr ctxt, xsltCompMatchPtr comp) {
>     int i = 0;
>     int j = comp->nbStep - 1;
> 
>@@ -341,22 +376,36 @@ xsltReverseCompMatch(xsltCompMatchPtr co
> 	register xmlChar *tmp;
> 	register xsltOp op;
> 	register xmlXPathCompExprPtr expr; 
>+	register int t;
>+
> 	tmp = comp->steps[i].value;
> 	comp->steps[i].value = comp->steps[j].value;
> 	comp->steps[j].value = tmp;
> 	tmp = comp->steps[i].value2;
> 	comp->steps[i].value2 = comp->steps[j].value2;
> 	comp->steps[j].value2 = tmp;
>+	tmp = comp->steps[i].value3;
>+	comp->steps[i].value3 = comp->steps[j].value3;
>+	comp->steps[j].value3 = tmp;
> 	op = comp->steps[i].op;
> 	comp->steps[i].op = comp->steps[j].op;
> 	comp->steps[j].op = op;
> 	expr = comp->steps[i].comp;
> 	comp->steps[i].comp = comp->steps[j].comp;
> 	comp->steps[j].comp = expr;
>+	t = comp->steps[i].previousExtra;
>+	comp->steps[i].previousExtra = comp->steps[j].previousExtra;
>+	comp->steps[j].previousExtra = t;
>+	t = comp->steps[i].indexExtra;
>+	comp->steps[i].indexExtra = comp->steps[j].indexExtra;
>+	comp->steps[j].indexExtra = t;
>+	t = comp->steps[i].lenExtra;
>+	comp->steps[i].lenExtra = comp->steps[j].lenExtra;
>+	comp->steps[j].lenExtra = t;
> 	j--;
> 	i++;
>     }
>-    comp->steps[comp->nbStep++].op = XSLT_OP_END;
>+    xsltCompMatchAdd(ctxt, comp, XSLT_OP_END, NULL, NULL);
> }
> 
> /************************************************************************
>@@ -1806,7 +1855,7 @@ xsltCompilePattern(const xmlChar *patter
> 	/*
> 	 * Reverse for faster interpretation.
> 	 */
>-	xsltReverseCompMatch(element);
>+	xsltReverseCompMatch(ctxt, element);
> 
> 	/*
> 	 * Set-up the priority

Actions: View | Diff

Attachments on bug 446809: 305661 | 305960 | 305961