Skip to content

GitLab

L
libxslt
Commit 21c7999f authored by Vladimir Bashkirtsev's avatar Vladimir Bashkirtsev
Browse files
Options

Patched to work with libxml2 2.9.12

parent 2eaa50ee
Show whitespace changes
Inline Side-by-side
Showing with 228 additions and 0 deletions
Makefile
View file @ 21c7999f
all:
tar xf libxslt-1.1.34.tar.gz
patch -Np1 -d libxslt-1.1.34 < libxslt-1.1.34-CVE-2021-30560.patch
patch -Np1 -d libxslt-1.1.34 < libxslt-1.1.34-libxml2-2.9.12.patch
cd libxslt-1.1.34 && sed -i s/3000/5000/ libxslt/transform.c doc/xsltproc.{1,xml}
cd libxslt-1.1.34 && ./configure --prefix=/usr --disable-static --without-python
$(MAKE) -C libxslt-1.1.34
......
libxslt-1.1.34-CVE-2021-30560.patch 0 → 100644
View file @ 21c7999f
diff -uNr libxslt-1.1.34/libxslt/transform.c libxslt-1.1.34-CVE-2021-30560/libxslt/transform.c
--- libxslt-1.1.34/libxslt/transform.c 2019-10-24 04:06:39.000000000 +1030
+++ libxslt-1.1.34-CVE-2021-30560/libxslt/transform.c 2022-10-27 23:25:26.037656750 +1030
@@ -1895,7 +1895,7 @@
xsltDefaultProcessOneNode(xsltTransformContextPtr ctxt, xmlNodePtr node,
xsltStackElemPtr params) {
xmlNodePtr copy;
- xmlNodePtr delete = NULL, cur;
+ xmlNodePtr cur;
int nbchild = 0, oldSize;
int childno = 0, oldPos;
xsltTemplatePtr template;
@@ -1968,54 +1968,13 @@
return;
}
/*
- * Handling of Elements: first pass, cleanup and counting
+ * Handling of Elements: first pass, counting
*/
cur = node->children;
while (cur != NULL) {
- switch (cur->type) {
- case XML_TEXT_NODE:
- case XML_CDATA_SECTION_NODE:
- case XML_DOCUMENT_NODE:
- case XML_HTML_DOCUMENT_NODE:
- case XML_ELEMENT_NODE:
- case XML_PI_NODE:
- case XML_COMMENT_NODE:
- nbchild++;
- break;
- case XML_DTD_NODE:
- /* Unlink the DTD, it's still reachable using doc->intSubset */
- if (cur->next != NULL)
- cur->next->prev = cur->prev;
- if (cur->prev != NULL)
- cur->prev->next = cur->next;
- break;
- default:
-#ifdef WITH_XSLT_DEBUG_PROCESS
- XSLT_TRACE(ctxt,XSLT_TRACE_PROCESS_NODE,xsltGenericDebug(xsltGenericDebugContext,
- "xsltDefaultProcessOneNode: skipping node type %d\n",
- cur->type));
-#endif
- delete = cur;
- }
+ if (IS_XSLT_REAL_NODE(cur))
+ nbchild++;
cur = cur->next;
- if (delete != NULL) {
-#ifdef WITH_XSLT_DEBUG_PROCESS
- XSLT_TRACE(ctxt,XSLT_TRACE_PROCESS_NODE,xsltGenericDebug(xsltGenericDebugContext,
- "xsltDefaultProcessOneNode: removing ignorable blank node\n"));
-#endif
- xmlUnlinkNode(delete);
- xmlFreeNode(delete);
- delete = NULL;
- }
- }
- if (delete != NULL) {
-#ifdef WITH_XSLT_DEBUG_PROCESS
- XSLT_TRACE(ctxt,XSLT_TRACE_PROCESS_NODE,xsltGenericDebug(xsltGenericDebugContext,
- "xsltDefaultProcessOneNode: removing ignorable blank node\n"));
-#endif
- xmlUnlinkNode(delete);
- xmlFreeNode(delete);
- delete = NULL;
}
/*
@@ -4864,7 +4823,7 @@
xsltStylePreCompPtr comp = (xsltStylePreCompPtr) castedComp;
#endif
int i;
- xmlNodePtr cur, delNode = NULL, oldContextNode;
+ xmlNodePtr cur, oldContextNode;
xmlNodeSetPtr list = NULL, oldList;
xsltStackElemPtr withParams = NULL;
int oldXPProximityPosition, oldXPContextSize;
@@ -4998,73 +4957,9 @@
else
cur = NULL;
while (cur != NULL) {
- switch (cur->type) {
- case XML_TEXT_NODE:
- if ((IS_BLANK_NODE(cur)) &&
- (cur->parent != NULL) &&
- (cur->parent->type == XML_ELEMENT_NODE) &&
- (ctxt->style->stripSpaces != NULL)) {
- const xmlChar *val;
-
- if (cur->parent->ns != NULL) {
- val = (const xmlChar *)
- xmlHashLookup2(ctxt->style->stripSpaces,
- cur->parent->name,
- cur->parent->ns->href);
- if (val == NULL) {
- val = (const xmlChar *)
- xmlHashLookup2(ctxt->style->stripSpaces,
- BAD_CAST "*",
- cur->parent->ns->href);
- }
- } else {
- val = (const xmlChar *)
- xmlHashLookup2(ctxt->style->stripSpaces,
- cur->parent->name, NULL);
- }
- if ((val != NULL) &&
- (xmlStrEqual(val, (xmlChar *) "strip"))) {
- delNode = cur;
- break;
- }
- }
- /* Intentional fall-through */
- case XML_ELEMENT_NODE:
- case XML_DOCUMENT_NODE:
- case XML_HTML_DOCUMENT_NODE:
- case XML_CDATA_SECTION_NODE:
- case XML_PI_NODE:
- case XML_COMMENT_NODE:
- xmlXPathNodeSetAddUnique(list, cur);
- break;
- case XML_DTD_NODE:
- /* Unlink the DTD, it's still reachable
- * using doc->intSubset */
- if (cur->next != NULL)
- cur->next->prev = cur->prev;
- if (cur->prev != NULL)
- cur->prev->next = cur->next;
- break;
- case XML_NAMESPACE_DECL:
- break;
- default:
-#ifdef WITH_XSLT_DEBUG_PROCESS
- XSLT_TRACE(ctxt,XSLT_TRACE_APPLY_TEMPLATES,xsltGenericDebug(xsltGenericDebugContext,
- "xsltApplyTemplates: skipping cur type %d\n",
- cur->type));
-#endif
- delNode = cur;
- }
+ if (IS_XSLT_REAL_NODE(cur))
+ xmlXPathNodeSetAddUnique(list, cur);
cur = cur->next;
- if (delNode != NULL) {
-#ifdef WITH_XSLT_DEBUG_PROCESS
- XSLT_TRACE(ctxt,XSLT_TRACE_APPLY_TEMPLATES,xsltGenericDebug(xsltGenericDebugContext,
- "xsltApplyTemplates: removing ignorable blank cur\n"));
-#endif
- xmlUnlinkNode(delNode);
- xmlFreeNode(delNode);
- delNode = NULL;
- }
}
}
libxslt-1.1.34-libxml2-2.9.12.patch 0 → 100644
View file @ 21c7999f
diff -uNr libxslt-1.1.34/libxslt/functions.c libxslt-1.1.34-libxml2-2.9.12/libxslt/functions.c
--- libxslt-1.1.34/libxslt/functions.c 2019-10-24 04:06:39.000000000 +1030
+++ libxslt-1.1.34-libxml2-2.9.12/libxslt/functions.c 2022-10-27 23:22:37.057886784 +1030
@@ -178,10 +178,22 @@
goto out_fragment;
}
+#if LIBXML_VERSION >= 20911 || \
+ defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+ xptrctxt->opLimit = ctxt->context->opLimit;
+ xptrctxt->opCount = ctxt->context->opCount;
+ xptrctxt->depth = ctxt->context->depth;
+
+ resObj = xmlXPtrEval(fragment, xptrctxt);
+
+ ctxt->context->opCount = xptrctxt->opCount;
+#else
resObj = xmlXPtrEval(fragment, xptrctxt);
- xmlXPathFreeContext(xptrctxt);
#endif
+ xmlXPathFreeContext(xptrctxt);
+#endif /* LIBXML_XPTR_ENABLED */
+
if (resObj == NULL)
goto out_fragment;
diff -uNr libxslt-1.1.34/tests/fuzz/fuzz.c libxslt-1.1.34-libxml2-2.9.12/tests/fuzz/fuzz.c
--- libxslt-1.1.34/tests/fuzz/fuzz.c 2019-10-24 04:06:39.000000000 +1030
+++ libxslt-1.1.34-libxml2-2.9.12/tests/fuzz/fuzz.c 2022-10-27 23:22:37.057886784 +1030
@@ -168,8 +168,6 @@
xpctxt = tctxt->xpathCtxt;
/* Resource limits to avoid timeouts and call stack overflows */
- xpctxt->maxParserDepth = 15;
- xpctxt->maxDepth = 100;
xpctxt->opLimit = 500000;
/* Test namespaces used in xpath.xml */
@@ -300,13 +298,6 @@
return 0;
}
-static void
-xsltSetXPathResourceLimits(xmlXPathContextPtr ctxt) {
- ctxt->maxParserDepth = 15;
- ctxt->maxDepth = 100;
- ctxt->opLimit = 100000;
-}
-
xmlChar *
xsltFuzzXslt(const char *data, size_t size) {
xmlDocPtr xsltDoc;
@@ -336,7 +327,7 @@
xmlFreeDoc(xsltDoc);
return NULL;
}
- xsltSetXPathResourceLimits(sheet->xpathCtxt);
+ sheet->xpathCtxt->opLimit = 100000;
sheet->xpathCtxt->opCount = 0;
if (xsltParseStylesheetUser(sheet, xsltDoc) != 0) {
xsltFreeStylesheet(sheet);
@@ -348,7 +339,7 @@
xsltSetCtxtSecurityPrefs(sec, ctxt);
ctxt->maxTemplateDepth = 100;
ctxt->opLimit = 20000;
- xsltSetXPathResourceLimits(ctxt->xpathCtxt);
+ ctxt->xpathCtxt->opLimit = 100000;
ctxt->xpathCtxt->opCount = sheet->xpathCtxt->opCount;
result = xsltApplyStylesheetUser(sheet, doc, NULL, NULL, NULL, ctxt);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment