summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support/libxslt
diff options
context:
space:
mode:
authorAndrej Valek <andrej.valek@siemens.com>2018-05-16 12:59:22 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-05-22 13:13:33 +0100
commit669a89f377f7e41731b6920c71231269aebcb229 (patch)
treefcce09c6c544797c5a198f50e7419da2cdad79b1 /meta/recipes-support/libxslt
parent46a8d4e8479c1f3eb136ef5c91a91ed431fa025a (diff)
downloadpoky-669a89f377f7e41731b6920c71231269aebcb229.tar.gz
libxslt: Fix handling of RVTs returned from nested EXSLT functions
Set the context variable to NULL when evaluating EXSLT functions. Fixes potential use-after-free errors or memory leaks. Fixes bug 792580 (From OE-Core rev: a997bcd3f985b65141f9b7a497581da2fd7afc10) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-support/libxslt')
-rw-r--r--meta/recipes-support/libxslt/libxslt/fix-rvts-handling.patch80
-rw-r--r--meta/recipes-support/libxslt/libxslt_1.1.32.bb5
2 files changed, 84 insertions, 1 deletions
diff --git a/meta/recipes-support/libxslt/libxslt/fix-rvts-handling.patch b/meta/recipes-support/libxslt/libxslt/fix-rvts-handling.patch
new file mode 100644
index 0000000000..424c976d9b
--- /dev/null
+++ b/meta/recipes-support/libxslt/libxslt/fix-rvts-handling.patch
@@ -0,0 +1,80 @@
1libxslt-1.1.32: Fix handling of RVTs returned from nested EXSLT functions
2
3[No upstream tracking] -- https://bugzilla.gnome.org/show_bug.cgi?id=792580
4
5Set the context variable to NULL when evaluating EXSLT functions.
6Fixes potential use-after-free errors or memory leaks.
7
8Upstream-Status: Backport [https://git.gnome.org/browse/libxslt/commit/?id=8bd32f7753ac253a54279a0b6a88d15a57076bb0]
9bug: 792580
10Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
11
12diff --git a/libexslt/functions.c b/libexslt/functions.c
13index dc794e3..8511cb0 100644
14--- a/libexslt/functions.c
15+++ b/libexslt/functions.c
16@@ -280,6 +280,7 @@ exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
17 exsltFuncFunctionData *func;
18 xmlNodePtr paramNode, oldInsert, fake;
19 int oldBase;
20+ void *oldCtxtVar;
21 xsltStackElemPtr params = NULL, param;
22 xsltTransformContextPtr tctxt = xsltXPathGetTransformContext(ctxt);
23 int i, notSet;
24@@ -418,11 +419,14 @@ exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
25 fake = xmlNewDocNode(tctxt->output, NULL,
26 (const xmlChar *)"fake", NULL);
27 oldInsert = tctxt->insert;
28+ oldCtxtVar = tctxt->contextVariable;
29 tctxt->insert = fake;
30+ tctxt->contextVariable = NULL;
31 xsltApplyOneTemplate (tctxt, tctxt->node,
32 func->content, NULL, NULL);
33 xsltLocalVariablePop(tctxt, tctxt->varsBase, -2);
34 tctxt->insert = oldInsert;
35+ tctxt->contextVariable = oldCtxtVar;
36 tctxt->varsBase = oldBase; /* restore original scope */
37 if (params != NULL)
38 xsltFreeStackElemList(params);
39diff --git a/tests/docs/bug-209.xml b/tests/docs/bug-209.xml
40new file mode 100644
41index 0000000..69d62f2
42--- /dev/null
43+++ b/tests/docs/bug-209.xml
44@@ -0,0 +1 @@
45+<doc/>
46diff --git a/tests/general/bug-209.out b/tests/general/bug-209.out
47new file mode 100644
48index 0000000..e829790
49--- /dev/null
50+++ b/tests/general/bug-209.out
51@@ -0,0 +1,2 @@
52+<?xml version="1.0"?>
53+<result/>
54diff --git a/tests/general/bug-209.xsl b/tests/general/bug-209.xsl
55new file mode 100644
56index 0000000..fe69ac6
57--- /dev/null
58+++ b/tests/general/bug-209.xsl
59@@ -0,0 +1,21 @@
60+<xsl:stylesheet
61+ version="1.0"
62+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
63+ xmlns:func="http://exslt.org/functions"
64+ extension-element-prefixes="func">
65+
66+ <xsl:template match="/">
67+ <xsl:variable name="v" select="func:a()" />
68+ <xsl:copy-of select="$v"/>
69+ </xsl:template>
70+
71+ <func:function name="func:a">
72+ <func:result select="func:b()" />
73+ </func:function>
74+
75+ <func:function name="func:b">
76+ <func:result>
77+ <result/>
78+ </func:result>
79+ </func:function>
80+</xsl:stylesheet>
diff --git a/meta/recipes-support/libxslt/libxslt_1.1.32.bb b/meta/recipes-support/libxslt/libxslt_1.1.32.bb
index 6a03f77699..f0fa5e723f 100644
--- a/meta/recipes-support/libxslt/libxslt_1.1.32.bb
+++ b/meta/recipes-support/libxslt/libxslt_1.1.32.bb
@@ -8,7 +8,10 @@ LIC_FILES_CHKSUM = "file://Copyright;md5=0cd9a07afbeb24026c9b03aecfeba458"
8SECTION = "libs" 8SECTION = "libs"
9DEPENDS = "libxml2" 9DEPENDS = "libxml2"
10 10
11SRC_URI = "http://xmlsoft.org/sources/libxslt-${PV}.tar.gz" 11SRC_URI = "http://xmlsoft.org/sources/libxslt-${PV}.tar.gz \
12 file://fix-rvts-handling.patch \
13 "
14
12SRC_URI[md5sum] = "1fc72f98e98bf4443f1651165f3aa146" 15SRC_URI[md5sum] = "1fc72f98e98bf4443f1651165f3aa146"
13SRC_URI[sha256sum] = "526ecd0abaf4a7789041622c3950c0e7f2c4c8835471515fd77eec684a355460" 16SRC_URI[sha256sum] = "526ecd0abaf4a7789041622c3950c0e7f2c4c8835471515fd77eec684a355460"
14 17