Taken as it's from:

http://git.gnome.org/browse/libxslt/commit/?id=54977ed7966847e305a2008cb18892df26eeb065

Heap-double-free in xmlFreeNodeList

http://code.google.com/p/chromium/issues/detail?id=144799

From 54977ed7966847e305a2008cb18892df26eeb065 Mon Sep 17 00:00:00 2001

From: Chris Evans <[email protected]>

Date: Mon, 03 Sep 2012 07:50:22 +0000

Subject: Fix a dictionary string usage

Raised in chromium, but also affecting xsltproc

Also updated AUTHORS to list Chris and other contributors

---

diff --git a/AUTHORS b/AUTHORS

index 094ebbc..3a70a17 100644

--- a/AUTHORS

+++ b/AUTHORS

@@ -5,7 +5,7 @@ Daniel Veillard:

    Used to work at W3C, now Red Hat

    co-chair of W3C XML Linking WG

    invited expert on the W3C XML Core WG

-   Author of libxml upon which this library is based.

+   Author of libxml2 upon which this library is based.

 Bjorn Reese:

    [email protected]

@@ -18,3 +18,46 @@ William Brack <[email protected]>

 Thomas Broyer <[email protected]>

 Igor Zlatkovic <[email protected]> for the Windows port

+

+Patches gently provided by a multitude of people :

+

+Abhishek Arya <[email protected]>

+Ben Walton <[email protected]>

+Bjorn Reese <[email protected]>

+C. M. Sperberg-McQueen <[email protected]>

+Colin Walters <[email protected]>

+Daniel Mustieles <[email protected]>

+Daniel Richard G <[email protected]>

+Darin Adler <[email protected]>

+ÉRDI Gergo <[email protected]>

+Fatih Demir <[email protected]>

+Federico Mena Quintero <[email protected]>

+Frederic Crozat <[email protected]>

+Hao Hu <[email protected]>

+Havoc Pennington <[email protected]>

+IlyaS <[email protected]>

+jacob berkman <[email protected]>

+Jason Viers <[email protected]>

+Jérôme Carretero <[email protected]>

+Joachim Breitner <[email protected]>

+Johan Dahlin <[email protected]>

+John Fleck <[email protected]>

+Jose Maria Celorio <[email protected]>

+Julio M. Merino Vidal <[email protected]>

+Kasimier T. Buchcik <[email protected]>

+Kjartan Maraas <[email protected]>

+Laurence Rowe <[email protected]>

+Malcolm Purvis <[email protected]>

+Martin <[email protected]>

+MDT 2002 John Fleck <[email protected]>

+Michael Bonfils <[email protected]>

+money_seshu Dronamraju <[email protected]>

+Nick Wellnhofer <[email protected]>

+Nix <[email protected]>

+Pedro F. Giffuni <[email protected]>

+Peter Williams <[email protected]>

+Rob Richards <[email protected]>

+Roumen Petrov <[email protected]>

+Stefan Kost <[email protected]>

+Tomasz Kłoczko <[email protected]>

+Chris Evans <[email protected]>

diff --git a/libxslt/templates.c b/libxslt/templates.c

index 169afd9..4804682 100644

--- a/libxslt/templates.c

+++ b/libxslt/templates.c

@@ -18,6 +18,7 @@

 #include <libxml/globals.h>

 #include <libxml/xmlerror.h>

 #include <libxml/tree.h>

+#include <libxml/dict.h>

 #include <libxml/xpathInternals.h>

 #include <libxml/parserInternals.h>

 #include "xslt.h"

@@ -586,7 +587,8 @@ xsltAttrTemplateProcess(xsltTransformContextPtr ctxt, xmlNodePtr target,

 		}

 	    } else if ((ctxt->internalized) && (target != NULL) &&

 	               (target->doc != NULL) &&

-		       (target->doc->dict == ctxt->dict)) {

+		       (target->doc->dict == ctxt->dict) &&

+		       xmlDictOwns(ctxt->dict, value)) {

 		text->content = (xmlChar *) value;

 	    } else {

 		text->content = xmlStrdup(value);

@@ -772,7 +774,8 @@ xsltAttrListTemplateProcess(xsltTransformContextPtr ctxt,

 		}

 	    } else if ((ctxt->internalized) &&

 		(target->doc != NULL) &&

-		(target->doc->dict == ctxt->dict))

+		(target->doc->dict == ctxt->dict) &&

+		xmlDictOwns(ctxt->dict, value))

 	    {

 		text->content = (xmlChar *) value;

 	    } else {

--

cgit v0.9.0.2