96 lines
3.2 KiB
Plaintext
96 lines
3.2 KiB
Plaintext
$OpenBSD: patch-xpath_c,v 1.2 2011/06/01 17:31:21 gsoares Exp $
|
|
|
|
Fix for CVE-2010-4494, Libxml2 XPath Double Free Vulnerability.
|
|
Fix for SA44711, Libxml2 XPath Nodeset Processing Vulnerability.
|
|
|
|
From upstream git:
|
|
http://git.gnome.org/browse/libxml2/commit/?id=df83c17e5a2646bd923f75e5e507bc80d73c9722
|
|
http://git.gnome.org/browse/libxml2/commit/?id=d7958b21e7f8c447a26bb2436f08402b2c308be4
|
|
|
|
--- xpath.c.orig Wed Jun 1 09:57:56 2011
|
|
+++ xpath.c Wed Jun 1 09:59:58 2011
|
|
@@ -3522,13 +3522,13 @@ xmlXPathNodeSetAddNs(xmlNodeSetPtr cur, xmlNodePtr nod
|
|
} else if (cur->nodeNr == cur->nodeMax) {
|
|
xmlNodePtr *temp;
|
|
|
|
- cur->nodeMax *= 2;
|
|
- temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
|
|
+ temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
|
|
sizeof(xmlNodePtr));
|
|
if (temp == NULL) {
|
|
xmlXPathErrMemory(NULL, "growing nodeset\n");
|
|
return;
|
|
}
|
|
+ cur->nodeMax *= 2;
|
|
cur->nodeTab = temp;
|
|
}
|
|
cur->nodeTab[cur->nodeNr++] = xmlXPathNodeSetDupNs(node, ns);
|
|
@@ -3627,14 +3627,14 @@ xmlXPathNodeSetAddUnique(xmlNodeSetPtr cur, xmlNodePtr
|
|
} else if (cur->nodeNr == cur->nodeMax) {
|
|
xmlNodePtr *temp;
|
|
|
|
- cur->nodeMax *= 2;
|
|
- temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
|
|
+ temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
|
|
sizeof(xmlNodePtr));
|
|
if (temp == NULL) {
|
|
xmlXPathErrMemory(NULL, "growing nodeset\n");
|
|
return;
|
|
}
|
|
cur->nodeTab = temp;
|
|
+ cur->nodeMax *= 2;
|
|
}
|
|
if (val->type == XML_NAMESPACE_DECL) {
|
|
xmlNsPtr ns = (xmlNsPtr) val;
|
|
@@ -3738,14 +3738,14 @@ xmlXPathNodeSetMerge(xmlNodeSetPtr val1, xmlNodeSetPtr
|
|
} else if (val1->nodeNr == val1->nodeMax) {
|
|
xmlNodePtr *temp;
|
|
|
|
- val1->nodeMax *= 2;
|
|
- temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
|
|
+ temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
|
|
sizeof(xmlNodePtr));
|
|
if (temp == NULL) {
|
|
xmlXPathErrMemory(NULL, "merging nodeset\n");
|
|
return(NULL);
|
|
}
|
|
val1->nodeTab = temp;
|
|
+ val1->nodeMax *= 2;
|
|
}
|
|
if (n2->type == XML_NAMESPACE_DECL) {
|
|
xmlNsPtr ns = (xmlNsPtr) n2;
|
|
@@ -3907,14 +3907,14 @@ xmlXPathNodeSetMergeAndClear(xmlNodeSetPtr set1, xmlNo
|
|
} else if (set1->nodeNr >= set1->nodeMax) {
|
|
xmlNodePtr *temp;
|
|
|
|
- set1->nodeMax *= 2;
|
|
temp = (xmlNodePtr *) xmlRealloc(
|
|
- set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
|
|
+ set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
|
|
if (temp == NULL) {
|
|
xmlXPathErrMemory(NULL, "merging nodeset\n");
|
|
return(NULL);
|
|
}
|
|
set1->nodeTab = temp;
|
|
+ set1->nodeMax *= 2;
|
|
}
|
|
if (n2->type == XML_NAMESPACE_DECL) {
|
|
xmlNsPtr ns = (xmlNsPtr) n2;
|
|
@@ -3991,14 +3991,14 @@ xmlXPathNodeSetMergeAndClearNoDupls(xmlNodeSetPtr set1
|
|
} else if (set1->nodeNr >= set1->nodeMax) {
|
|
xmlNodePtr *temp;
|
|
|
|
- set1->nodeMax *= 2;
|
|
temp = (xmlNodePtr *) xmlRealloc(
|
|
- set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
|
|
+ set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
|
|
if (temp == NULL) {
|
|
xmlXPathErrMemory(NULL, "merging nodeset\n");
|
|
return(NULL);
|
|
}
|
|
set1->nodeTab = temp;
|
|
+ set1->nodeMax *= 2;
|
|
}
|
|
set1->nodeTab[set1->nodeNr++] = n2;
|
|
}
|