7126712 xsltproc dies in xmlXPathReleaseObject with new patches
authorKevin Crowe <Kevin.Crowe@oracle.com>
Wed, 11 Jan 2012 12:38:47 -0800
changeset 651 501e808038f6
parent 650 e2fc423a4fd5
child 652 4be270de2328
7126712 xsltproc dies in xmlXPathReleaseObject with new patches
components/libxml2/patches/11.CVE-2011-2821.patch
--- a/components/libxml2/patches/11.CVE-2011-2821.patch	Wed Jan 11 11:05:09 2012 -0800
+++ b/components/libxml2/patches/11.CVE-2011-2821.patch	Wed Jan 11 12:38:47 2012 -0800
@@ -1,5 +1,8 @@
-This patch taken directly from upstream:
+The contents of this patch taken directly from upstream:
 http://git.gnome.org/browse/libxml2/commit/?id=f5048b3e71fc30ad096970b8df6e7af073bae4cb
+via copy/paste of the code changes into the source files from which I generated new
+patch diffs.  This explains the error of the missing 3 lines that are concatenated
+to the bottom of this patch.
 --- libxml2-2.7.6/xpath.c	Wed Nov 30 08:31:34 2011
 +++ libxml2-2.7.6/new.xpath.c	Wed Nov 30 08:30:31 2011
 @@ -252,6 +252,7 @@
@@ -200,3 +203,19 @@
      }
      SKIP_BLANKS;
      if (CUR == '/') {
+
+--- libxml2-2.7.6/xpath.c	Thu Jan  5 10:51:16 2012
++++ libxml2-2.7.6/xpath.c.new	Thu Jan  5 11:00:39 2012
[email protected]@ -11781,8 +11781,11 @@
+ 		xmlXPathNodeSetAddUnique(contextObj->nodesetval,
+ 		    contextNode);
+ 
++	    frame = xmlXPathSetFrame(ctxt);
+ 	    valuePush(ctxt, contextObj);
+ 	    res = xmlXPathCompOpEvalToBoolean(ctxt, exprOp, 1);
++	    tmp = valuePop(ctxt);
++	    xmlXPathPopFrame(ctxt, frame);
+ 
+ 	    if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
+ 		while (tmp != contextObj) {
+