File libxml2-CVE-2017-0663.patch of Package libxml2

Overview Repositories Revisions Requests Users Attributes Meta

File libxml2-CVE-2017-0663.patch of Package libxml2 (Revision 7e5def8d7c6c5d6d1c786d41e30cc51d)

Currently displaying revision 7e5def8d7c6c5d6d1c786d41e30cc51d , Show latest

From 92b9e8c8b3787068565a1820ba575d042f9eec66 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Tue, 6 Jun 2017 12:56:28 +0200
Subject: Fix type confusion in xmlValidateOneNamespace

Comment out code that casts xmlNsPtr to xmlAttrPtr. ID types on
namespace declarations make no practical sense anyway.

Fixes bug 780228.

Found with libFuzzer and ASan.
---
 valid.c | 7 +++++++
 1 file changed, 7 insertions(+)

Index: libxml2-2.9.4/valid.c
===================================================================
--- libxml2-2.9.4.orig/valid.c
+++ libxml2-2.9.4/valid.c
@@ -4627,6 +4627,12 @@ xmlNodePtr elem, const xmlChar *prefix,
 	}
     }
 
+    /*
+     * Casting ns to xmlAttrPtr is wrong. We'd need separate functions
+     * xmlAddID and xmlAddRef for namespace declarations, but it makes
+     * no practical sense to use ID types anyway.
+     */
+#if 0
     /* Validity Constraint: ID uniqueness */
     if (attrDecl->atype == XML_ATTRIBUTE_ID) {
         if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
@@ -4638,6 +4644,7 @@ xmlNodePtr elem, const xmlChar *prefix,
         if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
 	    ret = 0;
     }
+#endif
 
     /* Validity Constraint: Notation Attributes */
     if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {

Places

File libxml2-CVE-2017-0663.patch of Package libxml2 (Revision 7e5def8d7c6c5d6d1c786d41e30cc51d)

Places