Sandro Mani
3 years ago
parent
556b043c7e
commit
1d696f0403
@ -1,36 +0,0 @@
|
|||||||
From 50f06b3efb638efb0abd95dc62dca05ae67882c2 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
||||||
Date: Fri, 7 Aug 2020 21:54:27 +0200
|
|
||||||
Subject: [PATCH] Fix out-of-bounds read with 'xmllint --htmlout'
|
|
||||||
|
|
||||||
Make sure that truncated UTF-8 sequences don't cause an out-of-bounds
|
|
||||||
array access.
|
|
||||||
|
|
||||||
Thanks to @SuhwanSong and the Agency for Defense Development (ADD) for
|
|
||||||
the report.
|
|
||||||
|
|
||||||
Fixes #178.
|
|
||||||
---
|
|
||||||
xmllint.c | 6 ++++++
|
|
||||||
1 file changed, 6 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/xmllint.c b/xmllint.c
|
|
||||||
index f6a8e463..c647486f 100644
|
|
||||||
--- a/xmllint.c
|
|
||||||
+++ b/xmllint.c
|
|
||||||
@@ -528,6 +528,12 @@ static void
|
|
||||||
xmlHTMLEncodeSend(void) {
|
|
||||||
char *result;
|
|
||||||
|
|
||||||
+ /*
|
|
||||||
+ * xmlEncodeEntitiesReentrant assumes valid UTF-8, but the buffer might
|
|
||||||
+ * end with a truncated UTF-8 sequence. This is a hack to at least avoid
|
|
||||||
+ * an out-of-bounds read.
|
|
||||||
+ */
|
|
||||||
+ memset(&buffer[sizeof(buffer)-4], 0, 4);
|
|
||||||
result = (char *) xmlEncodeEntitiesReentrant(NULL, BAD_CAST buffer);
|
|
||||||
if (result) {
|
|
||||||
xmlGenericError(xmlGenericErrorContext, "%s", result);
|
|
||||||
--
|
|
||||||
2.28.0.rc2
|
|
||||||
|
|
||||||
@ -1,41 +0,0 @@
|
|||||||
From 8e7c20a1af8776677d7890f30b7a180567701a49 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
||||||
Date: Mon, 3 Aug 2020 17:30:41 +0200
|
|
||||||
Subject: [PATCH] Fix integer overflow when comparing schema dates
|
|
||||||
|
|
||||||
Found by OSS-Fuzz.
|
|
||||||
---
|
|
||||||
xmlschemastypes.c | 10 ++++++++++
|
|
||||||
1 file changed, 10 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/xmlschemastypes.c b/xmlschemastypes.c
|
|
||||||
index 4249d700..d6b9f924 100644
|
|
||||||
--- a/xmlschemastypes.c
|
|
||||||
+++ b/xmlschemastypes.c
|
|
||||||
@@ -3691,6 +3691,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
|
|
||||||
minday = 0;
|
|
||||||
maxday = 0;
|
|
||||||
} else {
|
|
||||||
+ if (myear > LONG_MAX / 366)
|
|
||||||
+ return -2;
|
|
||||||
/* FIXME: This doesn't take leap year exceptions every 100/400 years
|
|
||||||
into account. */
|
|
||||||
maxday = 365 * myear + (myear + 3) / 4;
|
|
||||||
@@ -4079,6 +4081,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
|
|
||||||
if ((x == NULL) || (y == NULL))
|
|
||||||
return -2;
|
|
||||||
|
|
||||||
+ if ((x->value.date.year > LONG_MAX / 366) ||
|
|
||||||
+ (x->value.date.year < LONG_MIN / 366) ||
|
|
||||||
+ (y->value.date.year > LONG_MAX / 366) ||
|
|
||||||
+ (y->value.date.year < LONG_MIN / 366)) {
|
|
||||||
+ /* Possible overflow when converting to days. */
|
|
||||||
+ return -2;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
if (x->value.date.tz_flag) {
|
|
||||||
|
|
||||||
if (!y->value.date.tz_flag) {
|
|
||||||
--
|
|
||||||
2.28.0.rc2
|
|
||||||
|
|
||||||
@ -0,0 +1,31 @@
|
|||||||
|
diff -rupN --no-dereference libxml2-v2.9.12/xmlsave.c libxml2-v2.9.12-new/xmlsave.c
|
||||||
|
--- libxml2-v2.9.12/xmlsave.c 2022-02-18 21:00:14.226540564 +0100
|
||||||
|
+++ libxml2-v2.9.12-new/xmlsave.c 2022-02-18 21:00:14.229540592 +0100
|
||||||
|
@@ -890,6 +890,13 @@ xmlNodeDumpOutputInternal(xmlSaveCtxtPtr
|
||||||
|
break;
|
||||||
|
|
||||||
|
case XML_ELEMENT_NODE:
|
||||||
|
+ if ((cur != root) && (ctxt->format == 1) &&
|
||||||
|
+ (xmlIndentTreeOutput))
|
||||||
|
+ xmlOutputBufferWrite(buf, ctxt->indent_size *
|
||||||
|
+ (ctxt->level > ctxt->indent_nr ?
|
||||||
|
+ ctxt->indent_nr : ctxt->level),
|
||||||
|
+ ctxt->indent);
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* Some users like lxml are known to pass nodes with a corrupted
|
||||||
|
* tree structure. Fall back to a recursive call to handle this
|
||||||
|
@@ -900,13 +907,6 @@ xmlNodeDumpOutputInternal(xmlSaveCtxtPtr
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
- if ((ctxt->level > 0) && (ctxt->format == 1) &&
|
||||||
|
- (xmlIndentTreeOutput))
|
||||||
|
- xmlOutputBufferWrite(buf, ctxt->indent_size *
|
||||||
|
- (ctxt->level > ctxt->indent_nr ?
|
||||||
|
- ctxt->indent_nr : ctxt->level),
|
||||||
|
- ctxt->indent);
|
||||||
|
-
|
||||||
|
xmlOutputBufferWrite(buf, 1, "<");
|
||||||
|
if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) {
|
||||||
|
xmlOutputBufferWriteString(buf, (const char *)cur->ns->prefix);
|
||||||
@ -0,0 +1,188 @@
|
|||||||
|
diff -rupN --no-dereference libxml2-v2.9.12/HTMLtree.c libxml2-v2.9.12-new/HTMLtree.c
|
||||||
|
--- libxml2-v2.9.12/HTMLtree.c 2021-05-13 20:56:16.000000000 +0200
|
||||||
|
+++ libxml2-v2.9.12-new/HTMLtree.c 2022-02-18 21:00:14.021538664 +0100
|
||||||
|
@@ -744,7 +744,7 @@ void
|
||||||
|
htmlNodeDumpFormatOutput(xmlOutputBufferPtr buf, xmlDocPtr doc,
|
||||||
|
xmlNodePtr cur, const char *encoding ATTRIBUTE_UNUSED,
|
||||||
|
int format) {
|
||||||
|
- xmlNodePtr root;
|
||||||
|
+ xmlNodePtr root, parent;
|
||||||
|
xmlAttrPtr attr;
|
||||||
|
const htmlElemDesc * info;
|
||||||
|
|
||||||
|
@@ -755,6 +755,7 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
}
|
||||||
|
|
||||||
|
root = cur;
|
||||||
|
+ parent = cur->parent;
|
||||||
|
while (1) {
|
||||||
|
switch (cur->type) {
|
||||||
|
case XML_HTML_DOCUMENT_NODE:
|
||||||
|
@@ -762,7 +763,9 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
if (((xmlDocPtr) cur)->intSubset != NULL) {
|
||||||
|
htmlDtdDumpOutput(buf, (xmlDocPtr) cur, NULL);
|
||||||
|
}
|
||||||
|
- if (cur->children != NULL) {
|
||||||
|
+ /* Always validate cur->parent when descending. */
|
||||||
|
+ if ((cur->parent == parent) && (cur->children != NULL)) {
|
||||||
|
+ parent = cur;
|
||||||
|
cur = cur->children;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
@@ -770,6 +773,16 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
|
||||||
|
case XML_ELEMENT_NODE:
|
||||||
|
/*
|
||||||
|
+ * Some users like lxml are known to pass nodes with a corrupted
|
||||||
|
+ * tree structure. Fall back to a recursive call to handle this
|
||||||
|
+ * case.
|
||||||
|
+ */
|
||||||
|
+ if ((cur->parent != parent) && (cur->children != NULL)) {
|
||||||
|
+ htmlNodeDumpFormatOutput(buf, doc, cur, encoding, format);
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
* Get specific HTML info for that node.
|
||||||
|
*/
|
||||||
|
if (cur->ns == NULL)
|
||||||
|
@@ -817,6 +830,7 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
(cur->name != NULL) &&
|
||||||
|
(cur->name[0] != 'p')) /* p, pre, param */
|
||||||
|
xmlOutputBufferWriteString(buf, "\n");
|
||||||
|
+ parent = cur;
|
||||||
|
cur = cur->children;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
@@ -825,9 +839,9 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
(info != NULL) && (!info->isinline)) {
|
||||||
|
if ((cur->next->type != HTML_TEXT_NODE) &&
|
||||||
|
(cur->next->type != HTML_ENTITY_REF_NODE) &&
|
||||||
|
- (cur->parent != NULL) &&
|
||||||
|
- (cur->parent->name != NULL) &&
|
||||||
|
- (cur->parent->name[0] != 'p')) /* p, pre, param */
|
||||||
|
+ (parent != NULL) &&
|
||||||
|
+ (parent->name != NULL) &&
|
||||||
|
+ (parent->name[0] != 'p')) /* p, pre, param */
|
||||||
|
xmlOutputBufferWriteString(buf, "\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -842,9 +856,9 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
break;
|
||||||
|
if (((cur->name == (const xmlChar *)xmlStringText) ||
|
||||||
|
(cur->name != (const xmlChar *)xmlStringTextNoenc)) &&
|
||||||
|
- ((cur->parent == NULL) ||
|
||||||
|
- ((xmlStrcasecmp(cur->parent->name, BAD_CAST "script")) &&
|
||||||
|
- (xmlStrcasecmp(cur->parent->name, BAD_CAST "style"))))) {
|
||||||
|
+ ((parent == NULL) ||
|
||||||
|
+ ((xmlStrcasecmp(parent->name, BAD_CAST "script")) &&
|
||||||
|
+ (xmlStrcasecmp(parent->name, BAD_CAST "style"))))) {
|
||||||
|
xmlChar *buffer;
|
||||||
|
|
||||||
|
buffer = xmlEncodeEntitiesReentrant(doc, cur->content);
|
||||||
|
@@ -902,13 +916,9 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
- /*
|
||||||
|
- * The parent should never be NULL here but we want to handle
|
||||||
|
- * corrupted documents gracefully.
|
||||||
|
- */
|
||||||
|
- if (cur->parent == NULL)
|
||||||
|
- return;
|
||||||
|
- cur = cur->parent;
|
||||||
|
+ cur = parent;
|
||||||
|
+ /* cur->parent was validated when descending. */
|
||||||
|
+ parent = cur->parent;
|
||||||
|
|
||||||
|
if ((cur->type == XML_HTML_DOCUMENT_NODE) ||
|
||||||
|
(cur->type == XML_DOCUMENT_NODE)) {
|
||||||
|
@@ -939,9 +949,9 @@ htmlNodeDumpFormatOutput(xmlOutputBuffer
|
||||||
|
(cur->next != NULL)) {
|
||||||
|
if ((cur->next->type != HTML_TEXT_NODE) &&
|
||||||
|
(cur->next->type != HTML_ENTITY_REF_NODE) &&
|
||||||
|
- (cur->parent != NULL) &&
|
||||||
|
- (cur->parent->name != NULL) &&
|
||||||
|
- (cur->parent->name[0] != 'p')) /* p, pre, param */
|
||||||
|
+ (parent != NULL) &&
|
||||||
|
+ (parent->name != NULL) &&
|
||||||
|
+ (parent->name[0] != 'p')) /* p, pre, param */
|
||||||
|
xmlOutputBufferWriteString(buf, "\n");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
diff -rupN --no-dereference libxml2-v2.9.12/xmlsave.c libxml2-v2.9.12-new/xmlsave.c
|
||||||
|
--- libxml2-v2.9.12/xmlsave.c 2021-05-13 20:56:16.000000000 +0200
|
||||||
|
+++ libxml2-v2.9.12-new/xmlsave.c 2022-02-18 21:00:14.022538674 +0100
|
||||||
|
@@ -847,7 +847,7 @@ htmlNodeDumpOutputInternal(xmlSaveCtxtPt
|
||||||
|
static void
|
||||||
|
xmlNodeDumpOutputInternal(xmlSaveCtxtPtr ctxt, xmlNodePtr cur) {
|
||||||
|
int format = ctxt->format;
|
||||||
|
- xmlNodePtr tmp, root, unformattedNode = NULL;
|
||||||
|
+ xmlNodePtr tmp, root, unformattedNode = NULL, parent;
|
||||||
|
xmlAttrPtr attr;
|
||||||
|
xmlChar *start, *end;
|
||||||
|
xmlOutputBufferPtr buf;
|
||||||
|
@@ -856,6 +856,7 @@ xmlNodeDumpOutputInternal(xmlSaveCtxtPtr
|
||||||
|
buf = ctxt->buf;
|
||||||
|
|
||||||
|
root = cur;
|
||||||
|
+ parent = cur->parent;
|
||||||
|
while (1) {
|
||||||
|
switch (cur->type) {
|
||||||
|
case XML_DOCUMENT_NODE:
|
||||||
|
@@ -868,7 +869,9 @@ xmlNodeDumpOutputInternal(xmlSaveCtxtPtr
|
||||||
|
break;
|
||||||
|
|
||||||
|
case XML_DOCUMENT_FRAG_NODE:
|
||||||
|
- if (cur->children != NULL) {
|
||||||
|
+ /* Always validate cur->parent when descending. */
|
||||||
|
+ if ((cur->parent == parent) && (cur->children != NULL)) {
|
||||||
|
+ parent = cur;
|
||||||
|
cur = cur->children;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
@@ -887,7 +890,18 @@ xmlNodeDumpOutputInternal(xmlSaveCtxtPtr
|
||||||
|
break;
|
||||||
|
|
||||||
|
case XML_ELEMENT_NODE:
|
||||||
|
- if ((cur != root) && (ctxt->format == 1) && (xmlIndentTreeOutput))
|
||||||
|
+ /*
|
||||||
|
+ * Some users like lxml are known to pass nodes with a corrupted
|
||||||
|
+ * tree structure. Fall back to a recursive call to handle this
|
||||||
|
+ * case.
|
||||||
|
+ */
|
||||||
|
+ if ((cur->parent != parent) && (cur->children != NULL)) {
|
||||||
|
+ xmlNodeDumpOutputInternal(ctxt, cur);
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if ((ctxt->level > 0) && (ctxt->format == 1) &&
|
||||||
|
+ (xmlIndentTreeOutput))
|
||||||
|
xmlOutputBufferWrite(buf, ctxt->indent_size *
|
||||||
|
(ctxt->level > ctxt->indent_nr ?
|
||||||
|
ctxt->indent_nr : ctxt->level),
|
||||||
|
@@ -942,6 +956,7 @@ xmlNodeDumpOutputInternal(xmlSaveCtxtPtr
|
||||||
|
xmlOutputBufferWrite(buf, 1, ">");
|
||||||
|
if (ctxt->format == 1) xmlOutputBufferWrite(buf, 1, "\n");
|
||||||
|
if (ctxt->level >= 0) ctxt->level++;
|
||||||
|
+ parent = cur;
|
||||||
|
cur = cur->children;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
@@ -1058,13 +1073,9 @@ xmlNodeDumpOutputInternal(xmlSaveCtxtPtr
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
- /*
|
||||||
|
- * The parent should never be NULL here but we want to handle
|
||||||
|
- * corrupted documents gracefully.
|
||||||
|
- */
|
||||||
|
- if (cur->parent == NULL)
|
||||||
|
- return;
|
||||||
|
- cur = cur->parent;
|
||||||
|
+ cur = parent;
|
||||||
|
+ /* cur->parent was validated when descending. */
|
||||||
|
+ parent = cur->parent;
|
||||||
|
|
||||||
|
if (cur->type == XML_ELEMENT_NODE) {
|
||||||
|
if (ctxt->level > 0) ctxt->level--;
|
||||||
@ -1,24 +0,0 @@
|
|||||||
*** XML/xml2-config.in.orig 2006-06-06 16:35:56.000000000 +0200
|
|
||||||
--- XML/xml2-config.in 2006-06-06 16:36:24.000000000 +0200
|
|
||||||
***************
|
|
||||||
*** 3,9 ****
|
|
||||||
prefix=@prefix@
|
|
||||||
exec_prefix=@exec_prefix@
|
|
||||||
includedir=@includedir@
|
|
||||||
! libdir=@libdir@
|
|
||||||
|
|
||||||
usage()
|
|
||||||
{
|
|
||||||
--- 3,14 ----
|
|
||||||
prefix=@prefix@
|
|
||||||
exec_prefix=@exec_prefix@
|
|
||||||
includedir=@includedir@
|
|
||||||
! if [ "`ldd /bin/sh | grep lib64`" = "" ]
|
|
||||||
! then
|
|
||||||
! libdir=${exec_prefix}/lib
|
|
||||||
! else
|
|
||||||
! libdir=${exec_prefix}/lib64
|
|
||||||
! fi
|
|
||||||
|
|
||||||
usage()
|
|
||||||
{
|
|
||||||
@ -1,33 +0,0 @@
|
|||||||
From 6088a74bcf7d0c42e24cff4594d804e1d3c9fbca Mon Sep 17 00:00:00 2001
|
|
||||||
From: Zhipeng Xie <xiezhipeng1@huawei.com>
|
|
||||||
Date: Tue, 20 Aug 2019 16:33:06 +0800
|
|
||||||
Subject: [PATCH] Fix memory leak in xmlSchemaValidateStream
|
|
||||||
|
|
||||||
When ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
|
|
||||||
alloc a new schema for ctxt->schema and set vctxt->xsiAssemble
|
|
||||||
to 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
|
|
||||||
vctxt->xsiAssemble to 0 again which cause the alloced schema
|
|
||||||
can not be freed anymore.
|
|
||||||
|
|
||||||
Found with libFuzzer.
|
|
||||||
|
|
||||||
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
|
|
||||||
---
|
|
||||||
xmlschemas.c | 1 -
|
|
||||||
1 file changed, 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/xmlschemas.c b/xmlschemas.c
|
|
||||||
index 301c8449..39d92182 100644
|
|
||||||
--- a/xmlschemas.c
|
|
||||||
+++ b/xmlschemas.c
|
|
||||||
@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) {
|
|
||||||
vctxt->nberrors = 0;
|
|
||||||
vctxt->depth = -1;
|
|
||||||
vctxt->skipDepth = -1;
|
|
||||||
- vctxt->xsiAssemble = 0;
|
|
||||||
vctxt->hasKeyrefs = 0;
|
|
||||||
#ifdef ENABLE_IDC_NODE_TABLES_TEST
|
|
||||||
vctxt->createIDCNodeTables = 1;
|
|
||||||
--
|
|
||||||
2.24.1
|
|
||||||
|
|
||||||
@ -1,32 +0,0 @@
|
|||||||
From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Zhipeng Xie <xiezhipeng1@huawei.com>
|
|
||||||
Date: Thu, 12 Dec 2019 17:30:55 +0800
|
|
||||||
Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
|
|
||||||
|
|
||||||
When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
|
|
||||||
return NULL which cause a infinite loop in xmlStringLenDecodeEntities
|
|
||||||
|
|
||||||
Found with libFuzzer.
|
|
||||||
|
|
||||||
Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
|
|
||||||
---
|
|
||||||
parser.c | 3 ++-
|
|
||||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/parser.c b/parser.c
|
|
||||||
index d1c31963..a34bb6cd 100644
|
|
||||||
--- a/parser.c
|
|
||||||
+++ b/parser.c
|
|
||||||
@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
|
|
||||||
else
|
|
||||||
c = 0;
|
|
||||||
while ((c != 0) && (c != end) && /* non input consuming loop */
|
|
||||||
- (c != end2) && (c != end3)) {
|
|
||||||
+ (c != end2) && (c != end3) &&
|
|
||||||
+ (ctxt->instate != XML_PARSER_EOF)) {
|
|
||||||
|
|
||||||
if (c == 0) break;
|
|
||||||
if ((c == '&') && (str[1] == '#')) {
|
|
||||||
--
|
|
||||||
2.24.1
|
|
||||||
|
|
||||||
@ -1,33 +0,0 @@
|
|||||||
From 0815302dee2b78139832c2080348086a0564836b Mon Sep 17 00:00:00 2001
|
|
||||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
||||||
Date: Fri, 6 Dec 2019 12:27:29 +0100
|
|
||||||
Subject: [PATCH] Fix freeing of nested documents
|
|
||||||
|
|
||||||
Apparently, some libxslt RVTs can contain nested document nodes, see
|
|
||||||
issue #132. I'm not sure how this happens exactly but it can cause a
|
|
||||||
segfault in xmlFreeNodeList after the changes in commit 0762c9b6.
|
|
||||||
|
|
||||||
Make sure not to touch the (nonexistent) `content` member of xmlDocs.
|
|
||||||
---
|
|
||||||
tree.c | 5 +++++
|
|
||||||
1 file changed, 5 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/tree.c b/tree.c
|
|
||||||
index 070670f1..0d7fc98c 100644
|
|
||||||
--- a/tree.c
|
|
||||||
+++ b/tree.c
|
|
||||||
@@ -3708,6 +3708,11 @@ xmlFreeNodeList(xmlNodePtr cur) {
|
|
||||||
(cur->type != XML_XINCLUDE_START) &&
|
|
||||||
(cur->type != XML_XINCLUDE_END) &&
|
|
||||||
(cur->type != XML_ENTITY_REF_NODE) &&
|
|
||||||
+ (cur->type != XML_DOCUMENT_NODE) &&
|
|
||||||
+#ifdef LIBXML_DOCB_ENABLED
|
|
||||||
+ (cur->type != XML_DOCB_DOCUMENT_NODE) &&
|
|
||||||
+#endif
|
|
||||||
+ (cur->type != XML_HTML_DOCUMENT_NODE) &&
|
|
||||||
(cur->content != (xmlChar *) &(cur->properties))) {
|
|
||||||
DICT_FREE(cur->content)
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.22.0
|
|
||||||
|
|
||||||
@ -1 +1 @@
|
|||||||
SHA512 (libxml2-2.9.10.tar.gz) = 0adfd12bfde89cbd6296ba6e66b6bed4edb814a74b4265bda34d95c41d9d92c696ee7adb0c737aaf9cc6e10426a31a35079b2a23d26c074e299858da12c072ed
|
SHA512 (libxml2-v2.9.12.tar.bz2) = 7d3c6f7dcfd528102f70fd81cb109351427865fb990163cd64e90a51902077902c2329ea46ebbe8d1fe973e3e78c5f322e0611d98b84d97a0cc46bef16848008
|
||||||
|
|||||||
Loading…
Reference in new issue