author | Petr Sumbera <petr.sumbera@oracle.com> |
Mon, 21 Jan 2013 03:30:38 -0800 | |
branch | s11u1-sru |
changeset 2471 | b1f0e4a84df6 |
permissions | -rw-r--r-- |
2471
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
1 |
Taken as it's from: |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
2 |
|
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
3 |
http://git.gnome.org/browse/libxslt/commit/?id=4da0f7e207f14a03daad4663865c285eb27f93e9 |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
4 |
|
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
5 |
From 4da0f7e207f14a03daad4663865c285eb27f93e9 Mon Sep 17 00:00:00 2001 |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
6 |
From: Chris Evans <[email protected]> |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
7 |
Date: Mon, 03 Sep 2012 10:16:44 +0000 |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
8 |
Subject: Avoid a heap use after free error |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
9 |
|
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
10 |
For https://code.google.com/p/chromium/issues/detail?id=140368 |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
11 |
--- |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
12 |
diff --git a/libxslt/functions.c b/libxslt/functions.c |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
13 |
index 5a8eb79..fe2f1ca 100644 |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
14 |
--- a/libxslt/functions.c |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
15 |
+++ b/libxslt/functions.c |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
16 |
@@ -660,6 +660,7 @@ xsltFormatNumberFunction(xmlXPathParserContextPtr ctxt, int nargs) |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
17 |
void |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
18 |
xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){ |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
19 |
xmlNodePtr cur = NULL; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
20 |
+ xmlXPathObjectPtr obj = NULL; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
21 |
long val; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
22 |
xmlChar str[30]; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
23 |
xmlDocPtr doc; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
24 |
@@ -667,7 +668,6 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){ |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
25 |
if (nargs == 0) { |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
26 |
cur = ctxt->context->node; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
27 |
} else if (nargs == 1) { |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
28 |
- xmlXPathObjectPtr obj; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
29 |
xmlNodeSetPtr nodelist; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
30 |
int i, ret; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
31 |
|
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
32 |
@@ -690,7 +690,6 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){ |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
33 |
if (ret == -1) |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
34 |
cur = nodelist->nodeTab[i]; |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
35 |
} |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
36 |
- xmlXPathFreeObject(obj); |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
37 |
} else { |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
38 |
xsltTransformError(xsltXPathGetTransformContext(ctxt), NULL, NULL, |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
39 |
"generate-id() : invalid number of args %d\n", nargs); |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
40 |
@@ -713,6 +712,9 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){ |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
41 |
|
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
42 |
} |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
43 |
|
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
44 |
+ if (obj) |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
45 |
+ xmlXPathFreeObject(obj); |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
46 |
+ |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
47 |
val = (long)((char *)cur - (char *)doc); |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
48 |
if (val >= 0) { |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
49 |
sprintf((char *)str, "idp%ld", val); |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
50 |
-- |
b1f0e4a84df6
15807903 problem in LIBRARY/LIBXSLT
Petr Sumbera <petr.sumbera@oracle.com>
parents:
diff
changeset
|
51 |
cgit v0.9.0.2 |