components/libxml2/patches/17.CVE-2010-4008.patch
author Petr Sumbera <petr.sumbera@oracle.com>
Mon, 23 Jul 2012 03:17:23 -0500
branchs11-sru
changeset 2313 cee15dd34514
permissions -rw-r--r--
7100337 Problem with library/libxml 7072501 Problem with library/libxml 7131703 Problem with library/libxml 7008726 Problem with library/libxml 7171310 Problem with library/libxml 7150804 Problem with library/libxml

There are 2 patches in a row to the same section of code here, they are copied/pasted
directly from:
http://git.gnome.org/browse/libxml2/patch/?id=91d19754d46acd4a639a8b9e31f50f31c78f8c9c
http://git.gnome.org/browse/libxml2/patch/?id=ea90b894146030c214a7df6d8375310174f134b9
--------------------------------------------------------------------------------------
From 91d19754d46acd4a639a8b9e31f50f31c78f8c9c Mon Sep 17 00:00:00 2001
From: Daniel Veillard <[email protected]>
Date: Fri, 15 Oct 2010 12:30:52 +0000
Subject: Fix the semantic of XPath axis for namespace/attribute context nodes

The processing of namespace and attributes nodes was not compliant
to the XPath-1.0 specification
---
diff --git a/xpath.c b/xpath.c
index b24ca69..8b77af3 100644
--- a/xpath.c
+++ b/xpath.c
@@ -8106,8 +8106,16 @@ xmlXPathNextPrecedingSibling(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
 xmlNodePtr
 xmlXPathNextFollowing(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if (cur != NULL && cur->children != NULL)
-        return cur->children ;
+    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
+	(ctxt->context->node->type == XML_NAMESPACE_DECL))
+	return(NULL);
+    if (cur != NULL) {
+        if ((cur->type == XML_ATTRIBUTE_NODE) ||
+            (cur->type == XML_NAMESPACE_DECL))
+            return(NULL);
+        if (cur->children != NULL)
+            return cur->children ;
+    }
     if (cur == NULL) cur = ctxt->context->node;
     if (cur == NULL) return(NULL) ; /* ERROR */
     if (cur->next != NULL) return(cur->next) ;
@@ -8162,6 +8170,9 @@ xmlNodePtr
 xmlXPathNextPreceding(xmlXPathParserContextPtr ctxt, xmlNodePtr cur)
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
+    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
+	(ctxt->context->node->type == XML_NAMESPACE_DECL))
+	return(NULL);
     if (cur == NULL)
         cur = ctxt->context->node;
     if (cur == NULL)
@@ -8203,12 +8214,13 @@ xmlXPathNextPrecedingInternal(xmlXPathParserContextPtr ctxt,
                               xmlNodePtr cur)
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
+    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
+	(ctxt->context->node->type == XML_NAMESPACE_DECL))
+	return(NULL);
     if (cur == NULL) {
         cur = ctxt->context->node;
         if (cur == NULL)
             return (NULL);
-	if (cur->type == XML_NAMESPACE_DECL)
-	    cur = (xmlNodePtr)((xmlNsPtr)cur)->next;
         ctxt->ancestor = cur->parent;
     }
     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
--
cgit v0.9.0.2

From ea90b894146030c214a7df6d8375310174f134b9 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <[email protected]>
Date: Fri, 22 Oct 2010 13:50:50 +0000
Subject: Fix a change of semantic on XPath preceding and following axis

This was introduced in the prevous fix, while preceding-sibling and
following sibling axis are empty for attributes and namespaces,
preceding and following axis should still work based on the parent
element. However the parent element is not available for a namespace
node, so we keep the axis empty in that case.
---
diff --git a/xpath.c b/xpath.c
index 9d47618..3352a5e 100644
--- a/xpath.c
+++ b/xpath.c
@@ -8106,17 +8106,17 @@ xmlXPathNextPrecedingSibling(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
 xmlNodePtr
 xmlXPathNextFollowing(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
-	(ctxt->context->node->type == XML_NAMESPACE_DECL))
-	return(NULL);
-    if (cur != NULL) {
-        if ((cur->type == XML_ATTRIBUTE_NODE) ||
-            (cur->type == XML_NAMESPACE_DECL))
+    if ((cur != NULL) && (cur->type  != XML_ATTRIBUTE_NODE) &&
+        (cur->type != XML_NAMESPACE_DECL) && (cur->children != NULL))
+        return(cur->children);
+
+    if (cur == NULL) {
+        cur = ctxt->context->node;
+        if (cur->type == XML_NAMESPACE_DECL)
             return(NULL);
-        if (cur->children != NULL)
-            return cur->children ;
+        if (cur->type == XML_ATTRIBUTE_NODE)
+            cur = cur->parent;
     }
-    if (cur == NULL) cur = ctxt->context->node;
     if (cur == NULL) return(NULL) ; /* ERROR */
     if (cur->next != NULL) return(cur->next) ;
     do {
@@ -8170,11 +8170,13 @@ xmlNodePtr
 xmlXPathNextPreceding(xmlXPathParserContextPtr ctxt, xmlNodePtr cur)
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
-	(ctxt->context->node->type == XML_NAMESPACE_DECL))
-	return(NULL);
-    if (cur == NULL)
+    if (cur == NULL) {
         cur = ctxt->context->node;
+        if (cur->type == XML_NAMESPACE_DECL)
+            return(NULL);
+        if (cur->type == XML_ATTRIBUTE_NODE)
+            return(cur->parent);
+    }
     if (cur == NULL)
 	return (NULL);
     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
@@ -8214,13 +8216,12 @@ xmlXPathNextPrecedingInternal(xmlXPathParserContextPtr ctxt,
                               xmlNodePtr cur)
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
-	(ctxt->context->node->type == XML_NAMESPACE_DECL))
-	return(NULL);
     if (cur == NULL) {
         cur = ctxt->context->node;
         if (cur == NULL)
             return (NULL);
+        if (cur->type == XML_NAMESPACE_DECL)
+            return (NULL);
         ctxt->ancestor = cur->parent;
     }
     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
--
cgit v0.9.0.2