Attachment 305961 Details for Bug 446809 – Patch for libxslt 1.0.15

[patch] Patch for libxslt 1.0.15

libxslt-1.0.15-CVE-2008-1767.diff (text/plain), 5.22 KB, created by Tomas Hoger on 2008-05-19 15:28:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2008-05-19 15:28:30 UTC

Size: 5.22 KB

patch

obsolete

>--- libxslt/pattern.c.orig	2002-03-25 17:59:21.000000000 +0100
>+++ libxslt/pattern.c	2008-05-19 15:51:13.000000000 +0200
>@@ -90,7 +90,7 @@ struct _xsltCompMatch {
>     int maxStep;
>     xmlNsPtr *nsList;		/* the namespaces in scope */
>     int nsNr;			/* the number of namespaces in scope */
>-    xsltStepOp steps[40];        /* ops for computation */
>+    xsltStepOpPtr steps;        /* ops for computation */
> };
> 
> typedef struct _xsltParserContext xsltParserContext;
>@@ -131,7 +131,16 @@ xsltNewCompMatch(void) {
> 	return(NULL);
>     }
>     memset(cur, 0, sizeof(xsltCompMatch));
>-    cur->maxStep = 40;
>+    cur->maxStep = 10;
>+    cur->nbStep = 0;
>+    cur-> steps = (xsltStepOpPtr) xmlMalloc(sizeof(xsltStepOp) *
>+                                            cur->maxStep);
>+    if (cur->steps == NULL) {
>+	xsltGenericError(xsltGenericErrorContext,
>+		"xsltNewCompMatch : out of memory error\n");
>+	xmlFree(cur);
>+	return(NULL);
>+    }
>     cur->nsNr = 0;
>     cur->nsList = NULL;
>     return(cur);
>@@ -169,6 +178,7 @@ xsltFreeCompMatch(xsltCompMatchPtr comp)
> 	if (op->comp != NULL)
> 	    xmlXPathFreeCompExpr(op->comp);
>     }
>+    xmlFree(comp->steps);
>     memset(comp, -1, sizeof(xsltCompMatch));
>     xmlFree(comp);
> }
>@@ -245,15 +255,26 @@ static int
> xsltCompMatchAdd(xsltParserContextPtr ctxt, xsltCompMatchPtr comp,
>                  xsltOp op, xmlChar * value, xmlChar * value2)
> {
>-    if (comp->nbStep >= 40) {
>-        xsltPrintErrorContext(NULL, NULL, NULL);        /* TODO */
>-        xsltGenericError(xsltGenericErrorContext,
>-                         "xsltCompMatchAdd: overflow\n");
>-        return (-1);
>+    if (comp->nbStep >= comp->maxStep) {
>+        xsltStepOpPtr tmp;
>+
>+	tmp = (xsltStepOpPtr) xmlRealloc(comp->steps, comp->maxStep * 2 *
>+	                                 sizeof(xsltStepOp));
>+	if (tmp == NULL) {
>+	    xsltGenericError(xsltGenericErrorContext,
>+	     "xsltCompMatchAdd: memory re-allocation failure.\n");
>+	    if (ctxt->style != NULL)
>+		ctxt->style->errors++;
>+	    return (-1);
>+	}
>+        comp->maxStep *= 2;
>+	comp->steps = tmp;
>     }
>     comp->steps[comp->nbStep].op = op;
>     comp->steps[comp->nbStep].value = value;
>     comp->steps[comp->nbStep].value2 = value2;
>+    comp->steps[comp->nbStep].value3 = NULL;
>+    comp->steps[comp->nbStep].comp = NULL;
>     if (ctxt->ctxt != NULL) {
> 	comp->steps[comp->nbStep].previousExtra =
> 	    xsltAllocateExtraCtxt(ctxt->ctxt);
>@@ -291,6 +312,7 @@ xsltSwapTopCompMatch(xsltCompMatchPtr co
> 	register xmlChar *tmp;
> 	register xsltOp op;
> 	register xmlXPathCompExprPtr expr; 
>+	register int t;
> 	i = j - 1;
> 	tmp = comp->steps[i].value;
> 	comp->steps[i].value = comp->steps[j].value;
>@@ -298,12 +320,24 @@ xsltSwapTopCompMatch(xsltCompMatchPtr co
> 	tmp = comp->steps[i].value2;
> 	comp->steps[i].value2 = comp->steps[j].value2;
> 	comp->steps[j].value2 = tmp;
>+	tmp = comp->steps[i].value3;
>+	comp->steps[i].value3 = comp->steps[j].value3;
>+	comp->steps[j].value3 = tmp;
> 	op = comp->steps[i].op;
> 	comp->steps[i].op = comp->steps[j].op;
> 	comp->steps[j].op = op;
> 	expr = comp->steps[i].comp;
> 	comp->steps[i].comp = comp->steps[j].comp;
> 	comp->steps[j].comp = expr;
>+	t = comp->steps[i].previousExtra;
>+	comp->steps[i].previousExtra = comp->steps[j].previousExtra;
>+	comp->steps[j].previousExtra = t;
>+	t = comp->steps[i].indexExtra;
>+	comp->steps[i].indexExtra = comp->steps[j].indexExtra;
>+	comp->steps[j].indexExtra = t;
>+	t = comp->steps[i].lenExtra;
>+	comp->steps[i].lenExtra = comp->steps[j].lenExtra;
>+	comp->steps[j].lenExtra = t;
>     }
> }
> 
>@@ -314,7 +348,7 @@ xsltSwapTopCompMatch(xsltCompMatchPtr co
>  * reverse all the stack of expressions
>  */
> static void
>-xsltReverseCompMatch(xsltCompMatchPtr comp) {
>+xsltReverseCompMatch(xsltParserContextPtr ctxt, xsltCompMatchPtr comp) {
>     int i = 0;
>     int j = comp->nbStep - 1;
> 
>@@ -322,22 +356,36 @@ xsltReverseCompMatch(xsltCompMatchPtr co
> 	register xmlChar *tmp;
> 	register xsltOp op;
> 	register xmlXPathCompExprPtr expr; 
>+	register int t;
>+
> 	tmp = comp->steps[i].value;
> 	comp->steps[i].value = comp->steps[j].value;
> 	comp->steps[j].value = tmp;
> 	tmp = comp->steps[i].value2;
> 	comp->steps[i].value2 = comp->steps[j].value2;
> 	comp->steps[j].value2 = tmp;
>+	tmp = comp->steps[i].value3;
>+	comp->steps[i].value3 = comp->steps[j].value3;
>+	comp->steps[j].value3 = tmp;
> 	op = comp->steps[i].op;
> 	comp->steps[i].op = comp->steps[j].op;
> 	comp->steps[j].op = op;
> 	expr = comp->steps[i].comp;
> 	comp->steps[i].comp = comp->steps[j].comp;
> 	comp->steps[j].comp = expr;
>+	t = comp->steps[i].previousExtra;
>+	comp->steps[i].previousExtra = comp->steps[j].previousExtra;
>+	comp->steps[j].previousExtra = t;
>+	t = comp->steps[i].indexExtra;
>+	comp->steps[i].indexExtra = comp->steps[j].indexExtra;
>+	comp->steps[j].indexExtra = t;
>+	t = comp->steps[i].lenExtra;
>+	comp->steps[i].lenExtra = comp->steps[j].lenExtra;
>+	comp->steps[j].lenExtra = t;
> 	j--;
> 	i++;
>     }
>-    comp->steps[comp->nbStep++].op = XSLT_OP_END;
>+    xsltCompMatchAdd(ctxt, comp, XSLT_OP_END, NULL, NULL);
> }
> 
> /************************************************************************
>@@ -1786,7 +1834,7 @@ xsltCompilePattern(const xmlChar *patter
> 	/*
> 	 * Reverse for faster interpretation.
> 	 */
>-	xsltReverseCompMatch(element);
>+	xsltReverseCompMatch(ctxt, element);
> 
> 	/*
> 	 * Set-up the priority

Actions: View | Diff

Attachments on bug 446809: 305661 | 305960 | 305961