[libxml2] Fix type confusion in xmlValidateOneNamespace



commit 92b9e8c8b3787068565a1820ba575d042f9eec66
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Tue Jun 6 12:56:28 2017 +0200

    Fix type confusion in xmlValidateOneNamespace
    
    Comment out code that casts xmlNsPtr to xmlAttrPtr. ID types on
    namespace declarations make no practical sense anyway.
    
    Fixes bug 780228.
    
    Found with libFuzzer and ASan.

 valid.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)
---
diff --git a/valid.c b/valid.c
index 8075d3a..c51ea29 100644
--- a/valid.c
+++ b/valid.c
@@ -4627,6 +4627,12 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
        }
     }
 
+    /*
+     * Casting ns to xmlAttrPtr is wrong. We'd need separate functions
+     * xmlAddID and xmlAddRef for namespace declarations, but it makes
+     * no practical sense to use ID types anyway.
+     */
+#if 0
     /* Validity Constraint: ID uniqueness */
     if (attrDecl->atype == XML_ATTRIBUTE_ID) {
         if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
@@ -4638,6 +4644,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
         if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
            ret = 0;
     }
+#endif
 
     /* Validity Constraint: Notation Attributes */
     if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]