Merge branch 'elinks-0.12' into elinks-0.13

Conflicts:
	src/document/dom/renderer.c (split into rss.c, source.c)

NEWS

@@ -98,7 +98,12 @@ Other changes:
 * minor bug 761: When reading bookmarks from an XBEL file, distinguish
   attribute names from attribute values.
 * enhancement: Updated ISO 8859-7, ISO 8859-16, KOI8-R, and MacRoman.
-* critical: bug 1067: crash in call_dom_stack_callbacks with RSS
+
+Bugs that should be removed from NEWS before the 0.12.0 release:
+
+* critical bug 1067: Fixed a crash in the RSS parser that ``configure
+  --enable-html-highlight'' enables.  ELinks 0.12pre1 was the first
+  release that supported RSS at all.
 
 ELinks 0.12pre2:
 ----------------

src/document/dom/rss.c

@@ -220,6 +220,10 @@ dom_rss_pop_document(struct dom_stack *stack, struct dom_node *root, void *xxx)
 
 	mem_free(rss);
 
+	/* ELinks does not provide any sort of DOM access to the RSS
+	 * document after it has been rendered.  Tell the caller to
+	 * free the document node and all of its children.  Otherwise,
+	 * they would leak.  */
 	return DOM_CODE_FREE_NODE;
 }
 

src/document/dom/source.c

@@ -408,6 +408,10 @@ render_dom_document_end(struct dom_stack *stack, struct dom_node *node, void *xx
 
 	mem_free(data);
 
+	/* It is not necessary to return DOM_CODE_FREE_NODE here.
+	 * Because the parser was created with the SGML_PARSER_STREAM
+	 * type, the stack has the DOM_STACK_FLAG_FREE_NODES flag and
+	 * implicitly frees all nodes popped from it.  */
 	return DOM_CODE_OK;
 }
 

src/dom/node.c

@@ -392,6 +392,7 @@ done_dom_node_data(struct dom_node *node)
 	union dom_node_data *data;
 
 	assert(node);
+	assert(node->type < DOM_NODES); /* unsigned comparison */
 
 	data = &node->data;
 
@@ -427,6 +428,18 @@ done_dom_node_data(struct dom_node *node)
 
 	if (node->allocated)
 		done_dom_string(&node->string);
+
+	/* call_dom_stack_callbacks() asserts that the node type is
+	 * within range.  If assertions are enabled, store an
+	 * out-of-range value there to make the assertion more likely
+	 * to fail if a callback has freed the node prematurely.
+	 * This is not entirely reliable though, because the memory
+	 * is freed below and may be allocated for some other purpose
+	 * before the assertion.  */
+#ifndef CONFIG_FASTMEM
+	node->type = -1;
+#endif
+
 	mem_free(node);
 }
 

src/dom/node.h

@@ -314,7 +314,9 @@ get_dom_node_map_entry(struct dom_node_list *node_map,
 		       enum dom_node_type type, uint16_t subtype,
 		       struct dom_string *name);
 
-/* Removes the node and all its children and free()s itself */
+/* Removes the node and all its children and free()s itself.
+ * A dom_stack_callback_T must not use this to free the node
+ * it gets as a parameter.  */
 void done_dom_node(struct dom_node *node);
 
 #ifndef DEBUG_MEMLEAK

src/dom/stack.c

@@ -139,6 +139,17 @@ call_dom_stack_callbacks(struct dom_stack *stack, struct dom_stack_state *state,
 		struct dom_stack_context *context = stack->contexts[i];
 		dom_stack_callback_T callback;
 
+		assert(state->node->type < DOM_NODES); /* unsigned comparison */
+		if_assert_failed {
+			/* The node type is out of range for the
+			 * callback arrays.  The node may have been
+			 * corrupted or already freed.  Ignore
+			 * free_node here because attempting to free
+			 * the node would probably just corrupt things
+			 * further.  */
+			return 0;
+		}
+
 		if (action == DOM_STACK_PUSH)
 			callback = context->info->push[state->node->type];
 		else

src/dom/stack.h

@@ -51,7 +51,13 @@ struct dom_stack;
 
 /** DOM stack callback
  *
- * Used by contexts, for 'hooking' into the node traversing. */
+ * Used by contexts, for 'hooking' into the node traversing.
+ *
+ * This callback must not call done_dom_node() to free the node it
+ * gets as a parameter, because call_dom_node_callbacks() may be
+ * intending to call more callbacks for the same node.  Instead, the
+ * callback can return ::DOM_CODE_FREE_NODE, and the node will then
+ * be freed after the callbacks of all contexts have been called.  */
 typedef enum dom_code
 	(*dom_stack_callback_T)(struct dom_stack *, struct dom_node *, void *);