mirror of
https://github.com/openwrt/packages.git
synced 2025-12-22 02:21:19 +00:00
a5bbf27e35
Debian uses libxml2 2.9.4 in Stretch. This adds their security related fixes from 2.9.4+dfsg1-2.2+deb9u2 to LEDE's 17.01 release. Fixed CVEs: CVE-2016-4658 CVE-2016-5131 CVE-2017-0663 CVE-2017-15412 CVE-2017-7375 CVE-2017-7376 CVE-2017-9047 CVE-2017-9048 CVE-2017-9049 CVE-2017-9050 Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
54 lines
1.7 KiB
Diff
54 lines
1.7 KiB
Diff
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Sat, 25 Jun 2016 12:35:50 +0200
|
|
Subject: Fix NULL pointer deref in XPointer range-to
|
|
|
|
- Check for errors after evaluating first operand.
|
|
- Add sanity check for empty stack.
|
|
|
|
Found with afl-fuzz.
|
|
---
|
|
result/XPath/xptr/viderror | 4 ++++
|
|
test/XPath/xptr/viderror | 1 +
|
|
xpath.c | 7 ++++++-
|
|
3 files changed, 11 insertions(+), 1 deletion(-)
|
|
create mode 100644 result/XPath/xptr/viderror
|
|
create mode 100644 test/XPath/xptr/viderror
|
|
|
|
diff --git a/result/XPath/xptr/viderror b/result/XPath/xptr/viderror
|
|
new file mode 100644
|
|
index 0000000..d589882
|
|
--- /dev/null
|
|
+++ b/result/XPath/xptr/viderror
|
|
@@ -0,0 +1,4 @@
|
|
+
|
|
+========================
|
|
+Expression: xpointer(non-existing-fn()/range-to(id('chapter2')))
|
|
+Object is empty (NULL)
|
|
diff --git a/test/XPath/xptr/viderror b/test/XPath/xptr/viderror
|
|
new file mode 100644
|
|
index 0000000..da8c53b
|
|
--- /dev/null
|
|
+++ b/test/XPath/xptr/viderror
|
|
@@ -0,0 +1 @@
|
|
+xpointer(non-existing-fn()/range-to(id('chapter2')))
|
|
diff --git a/xpath.c b/xpath.c
|
|
index 113bce6..751665b 100644
|
|
--- a/xpath.c
|
|
+++ b/xpath.c
|
|
@@ -14005,9 +14005,14 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
|
|
xmlNodeSetPtr oldset;
|
|
int i, j;
|
|
|
|
- if (op->ch1 != -1)
|
|
+ if (op->ch1 != -1) {
|
|
total +=
|
|
xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);
|
|
+ CHECK_ERROR0;
|
|
+ }
|
|
+ if (ctxt->value == NULL) {
|
|
+ XP_ERROR0(XPATH_INVALID_OPERAND);
|
|
+ }
|
|
if (op->ch2 == -1)
|
|
return (total);
|
|
|