diff options
Diffstat (limited to 'textproc/libxml2/patches/patch-al')
| -rw-r--r-- | textproc/libxml2/patches/patch-al | 56 |
1 files changed, 53 insertions, 3 deletions
diff --git a/textproc/libxml2/patches/patch-al b/textproc/libxml2/patches/patch-al index b2f76f5aaee..9338081eb49 100644 --- a/textproc/libxml2/patches/patch-al +++ b/textproc/libxml2/patches/patch-al @@ -1,10 +1,11 @@ -$NetBSD: patch-al,v 1.1.8.1 2012/01/13 13:10:42 tron Exp $ +$NetBSD: patch-al,v 1.1.8.2 2012/01/19 06:07:36 sbd Exp $ -from gnome git: Fix some potential problems on reallocation failures -CVE-2011-3919 -from gnome git: Fix memory corruption +-CVE-2011-3905 ---- parser.c.orig 2010-11-04 15:55:45.000000000 +0000 +--- parser.c.orig 2012-01-17 10:21:47.000000000 +0000 +++ parser.c @@ -1819,15 +1819,14 @@ namePush(xmlParserCtxtPtr ctxt, const xm @@ -33,7 +34,27 @@ $NetBSD: patch-al,v 1.1.8.1 2012/01/13 13:10:42 tron Exp $ } for (;i > 0;i--) buffer[nbchars++] = *cur++; -@@ -6992,6 +6991,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) +@@ -4949,7 +4948,8 @@ xmlParsePI(xmlParserCtxtPtr ctxt) { + (ctxt->sax->processingInstruction != NULL)) + ctxt->sax->processingInstruction(ctxt->userData, + target, NULL); +- ctxt->instate = state; ++ if (ctxt->instate != XML_PARSER_EOF) ++ ctxt->instate = state; + return; + } + buf = (xmlChar *) xmlMallocAtomic(size * sizeof(xmlChar)); +@@ -5029,7 +5029,8 @@ xmlParsePI(xmlParserCtxtPtr ctxt) { + } else { + xmlFatalErr(ctxt, XML_ERR_PI_NOT_STARTED, NULL); + } +- ctxt->instate = state; ++ if (ctxt->instate != XML_PARSER_EOF) ++ ctxt->instate = state; + } + } + +@@ -6992,6 +6993,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) ent->owner = 1; while (list != NULL) { list->parent = (xmlNodePtr) ent; @@ -41,3 +62,32 @@ $NetBSD: patch-al,v 1.1.8.1 2012/01/13 13:10:42 tron Exp $ if (list->next == NULL) ent->last = list; list = list->next; +@@ -9588,6 +9590,8 @@ xmlParseElement(xmlParserCtxtPtr ctxt) { + else + name = xmlParseStartTag(ctxt); + #endif /* LIBXML_SAX1_ENABLED */ ++ if (ctxt->instate == XML_PARSER_EOF) ++ return; + if (name == NULL) { + spacePop(ctxt); + return; +@@ -10967,6 +10971,8 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctx + else + name = xmlParseStartTag(ctxt); + #endif /* LIBXML_SAX1_ENABLED */ ++ if (ctxt->instate == XML_PARSER_EOF) ++ goto done; + if (name == NULL) { + spacePop(ctxt); + ctxt->instate = XML_PARSER_EOF; +@@ -11153,7 +11159,9 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctx + else + xmlParseEndTag1(ctxt, 0); + #endif /* LIBXML_SAX1_ENABLED */ +- if (ctxt->nameNr == 0) { ++ if (ctxt->instate == XML_PARSER_EOF) { ++ /* Nothing */ ++ } else if (ctxt->nameNr == 0) { + ctxt->instate = XML_PARSER_EPILOG; + } else { + ctxt->instate = XML_PARSER_CONTENT; |