46 lines
1.3 KiB
Diff
46 lines
1.3 KiB
Diff
From 6273df6c6d84b6be8a62a62abf1d9b79cc2035f8 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Tue, 30 May 2023 12:30:27 +0200
|
|
Subject: [PATCH] xpath: Ignore entity ref nodes when computing node hash
|
|
|
|
XPath queries only work reliably if entities are substituted.
|
|
Nevertheless, it's possible to query a document with entity reference
|
|
nodes. xmllint even deletes entities when the `--dropdtd` option is
|
|
passed, resulting in dangling pointers, so it's best to skip entity
|
|
reference nodes to avoid a use-after-free.
|
|
|
|
Fixes #550.
|
|
|
|
Reference:https://github.com/GNOME/libxml2/commit/6273df6c6d84b6be8a62a62abf1d9b79cc2035f8
|
|
Conflict:NA
|
|
|
|
---
|
|
xpath.c | 11 ++++++-----
|
|
1 file changed, 6 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/xpath.c b/xpath.c
|
|
index 3d1ca71..3128efb 100644
|
|
--- a/xpath.c
|
|
+++ b/xpath.c
|
|
@@ -6396,11 +6396,12 @@ xmlXPathNodeValHash(xmlNodePtr node) {
|
|
/*
|
|
* Skip to next node
|
|
*/
|
|
- if ((tmp->children != NULL) && (tmp->type != XML_DTD_NODE)) {
|
|
- if (tmp->children->type != XML_ENTITY_DECL) {
|
|
- tmp = tmp->children;
|
|
- continue;
|
|
- }
|
|
+ if ((tmp->children != NULL) &&
|
|
+ (tmp->type != XML_DTD_NODE) &&
|
|
+ (tmp->type != XML_ENTITY_REF_NODE) &&
|
|
+ (tmp->children->type != XML_ENTITY_DECL)) {
|
|
+ tmp = tmp->children;
|
|
+ continue;
|
|
}
|
|
if (tmp == node)
|
|
break;
|
|
--
|
|
2.27.0
|
|
|