From 57fff5b42dcd8a81562916925a70a112eada3f80 Mon Sep 17 00:00:00 2001 From: liquor <1692257904@qq.com> Date: Mon, 3 Aug 2020 18:42:48 +0800 Subject: [PATCH] Fix integer overflow in xmlFAParseQuantExact --- ...-and-Inf-fixes-for-pre-C99-compilers.patch | 61 --- ...lls-to-xmlCharEncInput-to-set-flush-.patch | 67 --- 0003-Fix-inconsistency-in-xmlXPathIsInf.patch | 29 - 0004-Stop-using-XPATH_OP_RESET.patch | 104 ---- ...-change-context-node-in-xmlXPathRoot.patch | 27 - ...ecessary-backups-of-the-context-node.patch | 189 ------- ...implify-and-harden-nodeset-filtering.patch | 378 ------------- ...storing-of-context-size-and-position.patch | 443 --------------- ...x-null-deref-in-xmlregexp-error-path.patch | 26 - 0009-HTML-noscript-should-not-close-p.patch | 28 - ...isleading-line-from-xmlCharEncOutput.patch | 33 -- ...-Remove-stray-character-from-comment.patch | 28 - ...-XPath-stack-after-calling-functions.patch | 31 -- ...x-nullptr-deref-with-XPath-logic-ops.patch | 54 -- ...eger-overflow-in-xmlXPtrEvalChildSeq.patch | 43 -- ...-infinite-loop-in-LZMA-decompression.patch | 50 -- ...-in-xmlXPathParseNameComplex-error-p.patch | 41 -- ...all-stack-overflow-in-xmlFreePattern.patch | 49 -- ...nation-from-Double-hyphen-within-com.patch | 36 -- ...return-value-of-xmlOutputBufferWrite.patch | 85 --- 0034-Fix-unsigned-integer-overflow.patch | 171 ------ ...in-xmlAllocOutputBufferInternal-erro.patch | 26 - Add-regexp-regression-tests.patch | 110 ++++ ...ML-serialization-with-UTF-8-encoding.patch | 150 ------ ...-deref-in-xmlTextReaderValidateEntit.patch | 39 -- ...Memory-leak-in-xmlFreeID-xmlreader.c.patch | 26 - ...ger-overflow-in-xmlFAParseQuantExact.patch | 44 ++ ...in-xmlParseBalancedChunkMemoryRecove.patch | 33 -- ...mory-leak-in-xmlSchemaValidateStream.patch | 31 -- ...in-xmlSwitchInputEncodingInt-error-p.patch | 36 -- ...aks-in-xmlParseStartTag2-error-paths.patch | 37 -- ...SchemaValidCtxtPtr-reuse-memory-leak.patch | 44 -- Memory-leak-in-xmlFreeID-xmlreader.c.patch | 29 - Memory-leak-in-xmlFreeTextReader.patch | 47 -- ...isleading-line-from-xmlCharEncOutput.patch | 33 -- ...error-for-invalid-regexp-quantifiers.patch | 26 + ...r-input-pointers-on-encoding-failure.patch | 39 -- ...tions-with-__attribute__-no_sanitize.patch | 85 --- ...conditional-sections-at-end-of-docum.patch | 27 - ...ignored-attribute-warnings-under-GCC.patch | 62 --- ...ditional-sections-at-end-of-document.patch | 41 -- ...er-free-in-xmlTextReaderFreeNodeList.patch | 36 -- ...-xmlDumpElementContent-non-recursive.patch | 211 -------- ...t-Make-xmlFreeNodeList-non-recursive.patch | 71 --- ...rseConditionalSections-non-recursive.patch | 510 ------------------ ...tent-and-xmlParseElement-non-recursi.patch | 286 ---------- ...TextReaderFreeNodeList-non-recursive.patch | 77 --- libxml2.spec | 10 +- 48 files changed, 188 insertions(+), 3951 deletions(-) delete mode 100644 0001-NaN-and-Inf-fixes-for-pre-C99-compilers.patch delete mode 100644 0002-Revert-Change-calls-to-xmlCharEncInput-to-set-flush-.patch delete mode 100644 0003-Fix-inconsistency-in-xmlXPathIsInf.patch delete mode 100644 0004-Stop-using-XPATH_OP_RESET.patch delete mode 100644 0005-Don-t-change-context-node-in-xmlXPathRoot.patch delete mode 100644 0006-Avoid-unnecessary-backups-of-the-context-node.patch delete mode 100644 0007-Simplify-and-harden-nodeset-filtering.patch delete mode 100644 0008-Improve-restoring-of-context-size-and-position.patch delete mode 100644 0009-Fix-null-deref-in-xmlregexp-error-path.patch delete mode 100644 0009-HTML-noscript-should-not-close-p.patch delete mode 100644 0010-Remove-a-misleading-line-from-xmlCharEncOutput.patch delete mode 100644 0011-Remove-stray-character-from-comment.patch delete mode 100644 0012-Check-XPath-stack-after-calling-functions.patch delete mode 100644 0012-Fix-nullptr-deref-with-XPath-logic-ops.patch delete mode 100644 0013-Check-for-integer-overflow-in-xmlXPtrEvalChildSeq.patch delete mode 100644 0013-Fix-infinite-loop-in-LZMA-decompression.patch delete mode 100644 0021-Fix-memory-leaks-in-xmlXPathParseNameComplex-error-p.patch delete mode 100644 0026-Fix-call-stack-overflow-in-xmlFreePattern.patch delete mode 100644 0031-Fix-parser-termination-from-Double-hyphen-within-com.patch delete mode 100644 0032-Fix-return-value-of-xmlOutputBufferWrite.patch delete mode 100644 0034-Fix-unsigned-integer-overflow.patch delete mode 100644 0037-Fix-memory-leak-in-xmlAllocOutputBufferInternal-erro.patch create mode 100644 Add-regexp-regression-tests.patch delete mode 100644 Fix-HTML-serialization-with-UTF-8-encoding.patch delete mode 100644 Fix-NULL-pointer-deref-in-xmlTextReaderValidateEntit.patch delete mode 100644 Fix-commit-Memory-leak-in-xmlFreeID-xmlreader.c.patch create mode 100644 Fix-integer-overflow-in-xmlFAParseQuantExact.patch delete mode 100644 Fix-memory-leak-in-xmlParseBalancedChunkMemoryRecove.patch delete mode 100644 Fix-memory-leak-in-xmlSchemaValidateStream.patch delete mode 100644 Fix-memory-leak-in-xmlSwitchInputEncodingInt-error-p.patch delete mode 100644 Fix-memory-leaks-in-xmlParseStartTag2-error-paths.patch delete mode 100644 Fix-xmlSchemaValidCtxtPtr-reuse-memory-leak.patch delete mode 100644 Memory-leak-in-xmlFreeID-xmlreader.c.patch delete mode 100644 Memory-leak-in-xmlFreeTextReader.patch delete mode 100644 Remove-a-misleading-line-from-xmlCharEncOutput.patch create mode 100644 Report-error-for-invalid-regexp-quantifiers.patch delete mode 100644 Reset-HTML-parser-input-pointers-on-encoding-failure.patch delete mode 100644 backport-Annotate-functions-with-__attribute__-no_sanitize.patch delete mode 100644 backport-Another-fix-for-conditional-sections-at-end-of-docum.patch delete mode 100644 backport-Avoid-ignored-attribute-warnings-under-GCC.patch delete mode 100644 backport-Fix-for-conditional-sections-at-end-of-document.patch delete mode 100644 backport-Fix-use-after-free-in-xmlTextReaderFreeNodeList.patch delete mode 100644 backport-Make-xmlDumpElementContent-non-recursive.patch delete mode 100644 backport-Make-xmlFreeNodeList-non-recursive.patch delete mode 100644 backport-Make-xmlParseConditionalSections-non-recursive.patch delete mode 100644 backport-Make-xmlParseContent-and-xmlParseElement-non-recursi.patch delete mode 100644 backport-Make-xmlTextReaderFreeNodeList-non-recursive.patch diff --git a/0001-NaN-and-Inf-fixes-for-pre-C99-compilers.patch b/0001-NaN-and-Inf-fixes-for-pre-C99-compilers.patch deleted file mode 100644 index cf83158..0000000 --- a/0001-NaN-and-Inf-fixes-for-pre-C99-compilers.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 7abec671473b837f99181442d59edd0cc2ee01d1 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Thu, 15 Mar 2018 19:33:52 +0100 -Subject: [PATCH 01/13] NaN and Inf fixes for pre-C99 compilers - -On some pre-C99 compilers, the NAN and INFINITY macros don't expand to -constant expressions. - -Some MSVC versions complain about floating point division by zero in -constants. - -Thanks to Fabrice Manfroi for the report. ---- - xpath.c | 19 ++++++++++--------- - 1 file changed, 10 insertions(+), 9 deletions(-) - -diff --git a/xpath.c b/xpath.c -index f4406967..89fab588 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -477,27 +477,28 @@ int wrap_cmp( xmlNodePtr x, xmlNodePtr y ); - * * - ************************************************************************/ - --#ifndef NAN --#define NAN (0.0 / 0.0) -+#ifndef INFINITY -+#define INFINITY (DBL_MAX * DBL_MAX) - #endif - --#ifndef INFINITY --#define INFINITY HUGE_VAL -+#ifndef NAN -+#define NAN (INFINITY / INFINITY) - #endif - --double xmlXPathNAN = NAN; --double xmlXPathPINF = INFINITY; --double xmlXPathNINF = -INFINITY; -+double xmlXPathNAN; -+double xmlXPathPINF; -+double xmlXPathNINF; - - /** - * xmlXPathInit: - * - * Initialize the XPath environment -- * -- * Does nothing but must be kept as public function. - */ - void - xmlXPathInit(void) { -+ xmlXPathNAN = NAN; -+ xmlXPathPINF = INFINITY; -+ xmlXPathNINF = -INFINITY; - } - - /** --- -2.18.0 - diff --git a/0002-Revert-Change-calls-to-xmlCharEncInput-to-set-flush-.patch b/0002-Revert-Change-calls-to-xmlCharEncInput-to-set-flush-.patch deleted file mode 100644 index 40a673b..0000000 --- a/0002-Revert-Change-calls-to-xmlCharEncInput-to-set-flush-.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 7a1bd7f6497ac33a9023d556f6f47a48f01deac0 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Sat, 17 Mar 2018 00:03:24 +0100 -Subject: [PATCH 02/13] Revert "Change calls to xmlCharEncInput to set flush - false" - -This reverts commit 6e6ae5daa6cd9640c9a83c1070896273e9b30d14 which -broke decoding of larger documents with ICU. - -See https://bugs.chromium.org/p/chromium/issues/detail?id=820163 ---- - HTMLparser.c | 2 +- - parserInternals.c | 2 +- - xmlIO.c | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/HTMLparser.c b/HTMLparser.c -index 9adeb174..7e243e60 100644 ---- a/HTMLparser.c -+++ b/HTMLparser.c -@@ -3635,7 +3635,7 @@ htmlCheckEncodingDirect(htmlParserCtxtPtr ctxt, const xmlChar *encoding) { - */ - processed = ctxt->input->cur - ctxt->input->base; - xmlBufShrink(ctxt->input->buf->buffer, processed); -- nbchars = xmlCharEncInput(ctxt->input->buf, 0); -+ nbchars = xmlCharEncInput(ctxt->input->buf, 1); - if (nbchars < 0) { - htmlParseErr(ctxt, XML_ERR_INVALID_ENCODING, - "htmlCheckEncoding: encoder error\n", -diff --git a/parserInternals.c b/parserInternals.c -index 8c0cd57a..09876ab4 100644 ---- a/parserInternals.c -+++ b/parserInternals.c -@@ -1214,7 +1214,7 @@ xmlSwitchInputEncodingInt(xmlParserCtxtPtr ctxt, xmlParserInputPtr input, - /* - * convert as much as possible of the buffer - */ -- nbchars = xmlCharEncInput(input->buf, 0); -+ nbchars = xmlCharEncInput(input->buf, 1); - } else { - /* - * convert just enough to get -diff --git a/xmlIO.c b/xmlIO.c -index 82543477..f61dd05a 100644 ---- a/xmlIO.c -+++ b/xmlIO.c -@@ -3157,7 +3157,7 @@ xmlParserInputBufferPush(xmlParserInputBufferPtr in, - * convert as much as possible to the parser reading buffer. - */ - use = xmlBufUse(in->raw); -- nbchars = xmlCharEncInput(in, 0); -+ nbchars = xmlCharEncInput(in, 1); - if (nbchars < 0) { - xmlIOErr(XML_IO_ENCODER, NULL); - in->error = XML_IO_ENCODER; -@@ -3273,7 +3273,7 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) { - * convert as much as possible to the parser reading buffer. - */ - use = xmlBufUse(in->raw); -- nbchars = xmlCharEncInput(in, 0); -+ nbchars = xmlCharEncInput(in, 1); - if (nbchars < 0) { - xmlIOErr(XML_IO_ENCODER, NULL); - in->error = XML_IO_ENCODER; --- -2.18.0 - diff --git a/0003-Fix-inconsistency-in-xmlXPathIsInf.patch b/0003-Fix-inconsistency-in-xmlXPathIsInf.patch deleted file mode 100644 index b5dd0a3..0000000 --- a/0003-Fix-inconsistency-in-xmlXPathIsInf.patch +++ /dev/null @@ -1,29 +0,0 @@ -From ebe12882ee7e14fa6463bb07d7de5f5388f09573 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Mon, 16 Apr 2018 18:18:11 +0200 -Subject: [PATCH 03/13] Fix inconsistency in xmlXPathIsInf - -We don't use HUGE_VAL for INFINITY after the most recent fix. ---- - xpath.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/xpath.c b/xpath.c -index 89fab588..bd093643 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -527,9 +527,9 @@ xmlXPathIsInf(double val) { - #ifdef isinf - return isinf(val) ? (val > 0 ? 1 : -1) : 0; - #else -- if (val >= HUGE_VAL) -+ if (val >= INFINITY) - return 1; -- if (val <= -HUGE_VAL) -+ if (val <= -INFINITY) - return -1; - return 0; - #endif --- -2.18.0 - diff --git a/0004-Stop-using-XPATH_OP_RESET.patch b/0004-Stop-using-XPATH_OP_RESET.patch deleted file mode 100644 index 2c78103..0000000 --- a/0004-Stop-using-XPATH_OP_RESET.patch +++ /dev/null @@ -1,104 +0,0 @@ -From e22a83b1d095dac25ce05e1a2d9f263f41d11c68 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Thu, 25 May 2017 01:18:36 +0200 -Subject: [PATCH 04/13] Stop using XPATH_OP_RESET - -It only sets the context node to NULL which doesn't seem useful and can -even cause bugs like bug #795299: - -https://bugzilla.gnome.org/show_bug.cgi?id=795299 ---- - xpath.c | 37 +++---------------------------------- - 1 file changed, 3 insertions(+), 34 deletions(-) - -diff --git a/xpath.c b/xpath.c -index bd093643..601763ee 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -868,15 +868,14 @@ typedef enum { - XPATH_OP_UNION, - XPATH_OP_ROOT, - XPATH_OP_NODE, -- XPATH_OP_RESET, /* 10 */ - XPATH_OP_COLLECT, -- XPATH_OP_VALUE, /* 12 */ -+ XPATH_OP_VALUE, /* 11 */ - XPATH_OP_VARIABLE, - XPATH_OP_FUNCTION, - XPATH_OP_ARG, - XPATH_OP_PREDICATE, -- XPATH_OP_FILTER, /* 17 */ -- XPATH_OP_SORT /* 18 */ -+ XPATH_OP_FILTER, /* 16 */ -+ XPATH_OP_SORT /* 17 */ - #ifdef LIBXML_XPTR_ENABLED - ,XPATH_OP_RANGETO - #endif -@@ -1526,8 +1525,6 @@ xmlXPathDebugDumpStepOp(FILE *output, xmlXPathCompExprPtr comp, - fprintf(output, "ROOT"); break; - case XPATH_OP_NODE: - fprintf(output, "NODE"); break; -- case XPATH_OP_RESET: -- fprintf(output, "RESET"); break; - case XPATH_OP_SORT: - fprintf(output, "SORT"); break; - case XPATH_OP_COLLECT: { -@@ -10735,7 +10732,6 @@ xmlXPathCompPathExpr(xmlXPathParserContextPtr ctxt) { - - PUSH_LONG_EXPR(XPATH_OP_COLLECT, AXIS_DESCENDANT_OR_SELF, - NODE_TEST_TYPE, NODE_TYPE_NODE, NULL, NULL); -- PUSH_UNARY_EXPR(XPATH_OP_RESET, ctxt->comp->last, 1, 0); - - xmlXPathCompRelativeLocationPath(ctxt); - } else if (CUR == '/') { -@@ -12779,15 +12775,6 @@ xmlXPathCompOpEvalFirst(xmlXPathParserContextPtr ctxt, - valuePush(ctxt, xmlXPathCacheNewNodeSet(ctxt->context, - ctxt->context->node)); - return (total); -- case XPATH_OP_RESET: -- if (op->ch1 != -1) -- total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); -- CHECK_ERROR0; -- if (op->ch2 != -1) -- total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -- CHECK_ERROR0; -- ctxt->context->node = NULL; -- return (total); - case XPATH_OP_COLLECT:{ - if (op->ch1 == -1) - return (total); -@@ -12918,15 +12905,6 @@ xmlXPathCompOpEvalLast(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op, - valuePush(ctxt, xmlXPathCacheNewNodeSet(ctxt->context, - ctxt->context->node)); - return (total); -- case XPATH_OP_RESET: -- if (op->ch1 != -1) -- total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); -- CHECK_ERROR0; -- if (op->ch2 != -1) -- total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -- CHECK_ERROR0; -- ctxt->context->node = NULL; -- return (total); - case XPATH_OP_COLLECT:{ - if (op->ch1 == -1) - return (0); -@@ -13457,15 +13435,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - valuePush(ctxt, xmlXPathCacheNewNodeSet(ctxt->context, - ctxt->context->node)); - return (total); -- case XPATH_OP_RESET: -- if (op->ch1 != -1) -- total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); -- CHECK_ERROR0; -- if (op->ch2 != -1) -- total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -- CHECK_ERROR0; -- ctxt->context->node = NULL; -- return (total); - case XPATH_OP_COLLECT:{ - if (op->ch1 == -1) - return (total); --- -2.18.0 - diff --git a/0005-Don-t-change-context-node-in-xmlXPathRoot.patch b/0005-Don-t-change-context-node-in-xmlXPathRoot.patch deleted file mode 100644 index 7a736ff..0000000 --- a/0005-Don-t-change-context-node-in-xmlXPathRoot.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 938835e763277684274ac31afc08fc40fa419aae Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Thu, 25 May 2017 01:21:57 +0200 -Subject: [PATCH 05/13] Don't change context node in xmlXPathRoot - ---- - xpath.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/xpath.c b/xpath.c -index 601763ee..1e98ddc2 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -8477,9 +8477,8 @@ void - xmlXPathRoot(xmlXPathParserContextPtr ctxt) { - if ((ctxt == NULL) || (ctxt->context == NULL)) - return; -- ctxt->context->node = (xmlNodePtr) ctxt->context->doc; - valuePush(ctxt, xmlXPathCacheNewNodeSet(ctxt->context, -- ctxt->context->node)); -+ (xmlNodePtr) ctxt->context->doc)); - } - - /************************************************************************ --- -2.18.0 - diff --git a/0006-Avoid-unnecessary-backups-of-the-context-node.patch b/0006-Avoid-unnecessary-backups-of-the-context-node.patch deleted file mode 100644 index f904fbb..0000000 --- a/0006-Avoid-unnecessary-backups-of-the-context-node.patch +++ /dev/null @@ -1,189 +0,0 @@ -From 029d0e960c02d83111acb5ab057ee055821943f7 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Thu, 25 May 2017 01:28:27 +0200 -Subject: [PATCH 06/13] Avoid unnecessary backups of the context node - ---- - xpath.c | 42 ------------------------------------------ - 1 file changed, 42 deletions(-) - -diff --git a/xpath.c b/xpath.c -index 1e98ddc2..b1bd7e07 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -12829,8 +12829,6 @@ xmlXPathCompOpEvalLast(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op, - int total = 0, cur; - xmlXPathCompExprPtr comp; - xmlXPathObjectPtr arg1, arg2; -- xmlNodePtr bak; -- xmlDocPtr bakd; - int pp; - int cs; - -@@ -12840,8 +12838,6 @@ xmlXPathCompOpEvalLast(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op, - case XPATH_OP_END: - return (0); - case XPATH_OP_UNION: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total = -@@ -12861,8 +12857,6 @@ xmlXPathCompOpEvalLast(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op, - nodesetval->nodeNr - - 1]; - } -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - cur = -@@ -13244,8 +13238,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - int equal, ret; - xmlXPathCompExprPtr comp; - xmlXPathObjectPtr arg1, arg2; -- xmlNodePtr bak; -- xmlDocPtr bakd; - int pp; - int cs; - -@@ -13255,8 +13247,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - case XPATH_OP_END: - return (0); - case XPATH_OP_AND: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); -@@ -13265,8 +13255,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - if ((ctxt->value == NULL) || (ctxt->value->boolval == 0)) - return (total); - arg2 = valuePop(ctxt); -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -@@ -13281,8 +13269,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathReleaseObject(ctxt->context, arg2); - return (total); - case XPATH_OP_OR: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); -@@ -13291,8 +13277,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - if ((ctxt->value == NULL) || (ctxt->value->boolval == 1)) - return (total); - arg2 = valuePop(ctxt); -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -@@ -13307,14 +13291,10 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathReleaseObject(ctxt->context, arg2); - return (total); - case XPATH_OP_EQUAL: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -@@ -13326,14 +13306,10 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - valuePush(ctxt, xmlXPathCacheNewBoolean(ctxt->context, equal)); - return (total); - case XPATH_OP_CMP: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -@@ -13342,15 +13318,11 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - valuePush(ctxt, xmlXPathCacheNewBoolean(ctxt->context, ret)); - return (total); - case XPATH_OP_PLUS: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; - if (op->ch2 != -1) { -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -@@ -13368,14 +13340,10 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - } - return (total); - case XPATH_OP_MULT: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -@@ -13388,14 +13356,10 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathModValues(ctxt); - return (total); - case XPATH_OP_UNION: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->doc = bakd; -- ctxt->context->node = bak; - ctxt->context->proximityPosition = pp; - ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -@@ -13552,24 +13516,18 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - return (total); - } - case XPATH_OP_ARG: -- bakd = ctxt->context->doc; -- bak = ctxt->context->node; - pp = ctxt->context->proximityPosition; - cs = ctxt->context->contextSize; - if (op->ch1 != -1) { - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - ctxt->context->contextSize = cs; - ctxt->context->proximityPosition = pp; -- ctxt->context->node = bak; -- ctxt->context->doc = bakd; - CHECK_ERROR0; - } - if (op->ch2 != -1) { - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - ctxt->context->contextSize = cs; - ctxt->context->proximityPosition = pp; -- ctxt->context->node = bak; -- ctxt->context->doc = bakd; - CHECK_ERROR0; - } - return (total); --- -2.18.0 - diff --git a/0007-Simplify-and-harden-nodeset-filtering.patch b/0007-Simplify-and-harden-nodeset-filtering.patch deleted file mode 100644 index 734e40c..0000000 --- a/0007-Simplify-and-harden-nodeset-filtering.patch +++ /dev/null @@ -1,378 +0,0 @@ -From 665df41dcc6c4c3a609907c979b6c16472593d0d Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Mon, 16 Apr 2018 19:37:34 +0200 -Subject: [PATCH 07/13] Simplify and harden nodeset filtering - -If a nodeset to be filtered is empty, it can be returned without popping -it from the stack. - -Make sure to restore the context node in all error paths and never set -it to NULL. - -Save and restore the context node in RANGETO operations. ---- - xpath.c | 152 +++++++++++++++----------------------------------------- - 1 file changed, 41 insertions(+), 111 deletions(-) - -diff --git a/xpath.c b/xpath.c -index b1bd7e07..4b9faaf6 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -12993,7 +12993,6 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - return (total); - - #ifdef LIBXML_XPTR_ENABLED -- oldnode = ctxt->context->node; - /* - * Hum are we filtering the result of an XPointer expression - */ -@@ -13008,23 +13007,15 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - * up a new locset. - */ - CHECK_TYPE0(XPATH_LOCATIONSET); -+ -+ if ((ctxt->value->user == NULL) || -+ (((xmlLocationSetPtr) ctxt->value->user)->locNr == 0)) -+ return (total); -+ - obj = valuePop(ctxt); - oldlocset = obj->user; -- ctxt->context->node = NULL; -+ oldnode = ctxt->context->node; - -- if ((oldlocset == NULL) || (oldlocset->locNr == 0)) { -- ctxt->context->contextSize = 0; -- ctxt->context->proximityPosition = 0; -- if (op->ch2 != -1) -- total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -- res = valuePop(ctxt); -- if (res != NULL) { -- xmlXPathReleaseObject(ctxt->context, res); -- } -- valuePush(ctxt, obj); -- CHECK_ERROR0; -- return (total); -- } - newlocset = xmlXPtrLocationSetCreate(NULL); - - for (i = 0; i < oldlocset->locNr; i++) { -@@ -13049,6 +13040,7 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeObject(obj); -+ ctxt->context->node = oldnode; - return(0); - } - /* -@@ -13077,7 +13069,6 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - /* OLD: xmlXPathFreeObject(res); */ - } else - tmp = NULL; -- ctxt->context->node = NULL; - /* - * Only put the first node in the result, then leave. - */ -@@ -13093,7 +13084,6 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - * The result is used as the new evaluation locset. - */ - xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->node = NULL; - ctxt->context->contextSize = -1; - ctxt->context->proximityPosition = -1; - valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset)); -@@ -13108,32 +13098,17 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - * up a new set. - */ - CHECK_TYPE0(XPATH_NODESET); -- obj = valuePop(ctxt); -- oldset = obj->nodesetval; - -- oldnode = ctxt->context->node; -- oldDoc = ctxt->context->doc; -- ctxt->context->node = NULL; -- -- if ((oldset == NULL) || (oldset->nodeNr == 0)) { -- ctxt->context->contextSize = 0; -- ctxt->context->proximityPosition = 0; -- /* QUESTION TODO: Why was this code commented out? -- if (op->ch2 != -1) -- total += -- xmlXPathCompOpEval(ctxt, -- &comp->steps[op->ch2]); -- CHECK_ERROR0; -- res = valuePop(ctxt); -- if (res != NULL) -- xmlXPathFreeObject(res); -- */ -- valuePush(ctxt, obj); -- ctxt->context->node = oldnode; -- CHECK_ERROR0; -- } else { -+ if ((ctxt->value->nodesetval != NULL) && -+ (ctxt->value->nodesetval->nodeNr != 0)) { - xmlNodeSetPtr newset; - xmlXPathObjectPtr tmp = NULL; -+ -+ obj = valuePop(ctxt); -+ oldset = obj->nodesetval; -+ oldnode = ctxt->context->node; -+ oldDoc = ctxt->context->doc; -+ - /* - * Initialize the new set. - * Also set the xpath document in case things like -@@ -13168,6 +13143,7 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeNodeSet(newset); - xmlXPathFreeObject(obj); -+ ctxt->context->node = oldnode; - return(0); - } - /* -@@ -13195,7 +13171,6 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - xmlXPathNodeSetClear(tmp->nodesetval, 1); - } else - tmp = NULL; -- ctxt->context->node = NULL; - /* - * Only put the first node in the result, then leave. - */ -@@ -13211,14 +13186,12 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - * The result is used as the new evaluation set. - */ - xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->node = NULL; - ctxt->context->contextSize = -1; - ctxt->context->proximityPosition = -1; -- /* may want to move this past the '}' later */ -+ ctxt->context->node = oldnode; - ctxt->context->doc = oldDoc; - valuePush(ctxt, xmlXPathCacheWrapNodeSet(ctxt->context, newset)); - } -- ctxt->context->node = oldnode; - return(total); - } - #endif /* XP_OPTIMIZED_FILTER_FIRST */ -@@ -13641,8 +13614,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - if (ctxt->value == NULL) - return (total); - -- oldnode = ctxt->context->node; -- - #ifdef LIBXML_XPTR_ENABLED - /* - * Hum are we filtering the result of an XPointer expression -@@ -13657,25 +13628,15 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - * up a new locset. - */ - CHECK_TYPE0(XPATH_LOCATIONSET); -+ -+ if ((ctxt->value->user == NULL) || -+ (((xmlLocationSetPtr) ctxt->value->user)->locNr == 0)) -+ return (total); -+ - obj = valuePop(ctxt); - oldlocset = obj->user; -- ctxt->context->node = NULL; -+ oldnode = ctxt->context->node; - -- if ((oldlocset == NULL) || (oldlocset->locNr == 0)) { -- ctxt->context->contextSize = 0; -- ctxt->context->proximityPosition = 0; -- if (op->ch2 != -1) -- total += -- xmlXPathCompOpEval(ctxt, -- &comp->steps[op->ch2]); -- res = valuePop(ctxt); -- if (res != NULL) { -- xmlXPathReleaseObject(ctxt->context, res); -- } -- valuePush(ctxt, obj); -- CHECK_ERROR0; -- return (total); -- } - newlocset = xmlXPtrLocationSetCreate(NULL); - - for (i = 0; i < oldlocset->locNr; i++) { -@@ -13696,6 +13657,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeObject(obj); -+ ctxt->context->node = oldnode; - return(0); - } - -@@ -13720,15 +13682,12 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - res = valuePop(ctxt); - xmlXPathReleaseObject(ctxt->context, res); - } -- -- ctxt->context->node = NULL; - } - - /* - * The result is used as the new evaluation locset. - */ - xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->node = NULL; - ctxt->context->contextSize = -1; - ctxt->context->proximityPosition = -1; - valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset)); -@@ -13743,30 +13702,13 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - * up a new set. - */ - CHECK_TYPE0(XPATH_NODESET); -- obj = valuePop(ctxt); -- oldset = obj->nodesetval; -- -- oldnode = ctxt->context->node; -- oldDoc = ctxt->context->doc; -- ctxt->context->node = NULL; - -- if ((oldset == NULL) || (oldset->nodeNr == 0)) { -- ctxt->context->contextSize = 0; -- ctxt->context->proximityPosition = 0; --/* -- if (op->ch2 != -1) -- total += -- xmlXPathCompOpEval(ctxt, -- &comp->steps[op->ch2]); -- CHECK_ERROR0; -- res = valuePop(ctxt); -- if (res != NULL) -- xmlXPathFreeObject(res); --*/ -- valuePush(ctxt, obj); -- ctxt->context->node = oldnode; -- CHECK_ERROR0; -- } else { -+ if ((ctxt->value->nodesetval != NULL) && -+ (ctxt->value->nodesetval->nodeNr != 0)) { -+ obj = valuePop(ctxt); -+ oldset = obj->nodesetval; -+ oldnode = ctxt->context->node; -+ oldDoc = ctxt->context->doc; - tmp = NULL; - /* - * Initialize the new set. -@@ -13833,6 +13775,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeNodeSet(newset); - xmlXPathFreeObject(obj); -+ ctxt->context->node = oldnode; - return(0); - } - -@@ -13867,7 +13810,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - */ - } else - tmp = NULL; -- ctxt->context->node = NULL; - } - if (tmp != NULL) - xmlXPathReleaseObject(ctxt->context, tmp); -@@ -13875,15 +13817,13 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - * The result is used as the new evaluation set. - */ - xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->node = NULL; - ctxt->context->contextSize = -1; - ctxt->context->proximityPosition = -1; -- /* may want to move this past the '}' later */ -+ ctxt->context->node = oldnode; - ctxt->context->doc = oldDoc; - valuePush(ctxt, - xmlXPathCacheWrapNodeSet(ctxt->context, newset)); - } -- ctxt->context->node = oldnode; - return (total); - } - case XPATH_OP_SORT: -@@ -13906,6 +13846,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlLocationSetPtr newlocset = NULL; - xmlLocationSetPtr oldlocset; - xmlNodeSetPtr oldset; -+ xmlNodePtr oldnode = ctxt->context->node; - int i, j; - - if (op->ch1 != -1) { -@@ -13926,22 +13867,14 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - * up a new locset. - */ - CHECK_TYPE0(XPATH_LOCATIONSET); -+ -+ if ((ctxt->value->user == NULL) || -+ (((xmlLocationSetPtr) ctxt->value->user)->locNr == 0)) -+ return (total); -+ - obj = valuePop(ctxt); - oldlocset = obj->user; - -- if ((oldlocset == NULL) || (oldlocset->locNr == 0)) { -- ctxt->context->node = NULL; -- ctxt->context->contextSize = 0; -- ctxt->context->proximityPosition = 0; -- total += xmlXPathCompOpEval(ctxt,&comp->steps[op->ch2]); -- res = valuePop(ctxt); -- if (res != NULL) { -- xmlXPathReleaseObject(ctxt->context, res); -- } -- valuePush(ctxt, obj); -- CHECK_ERROR0; -- return (total); -- } - newlocset = xmlXPtrLocationSetCreate(NULL); - - for (i = 0; i < oldlocset->locNr; i++) { -@@ -13962,6 +13895,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeObject(obj); -+ ctxt->context->node = oldnode; - return(0); - } - -@@ -13997,14 +13931,11 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - res = valuePop(ctxt); - xmlXPathReleaseObject(ctxt->context, res); - } -- -- ctxt->context->node = NULL; - } - } else { /* Not a location set */ - CHECK_TYPE0(XPATH_NODESET); - obj = valuePop(ctxt); - oldset = obj->nodesetval; -- ctxt->context->node = NULL; - - newlocset = xmlXPtrLocationSetCreate(NULL); - -@@ -14028,6 +13959,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeObject(obj); -+ ctxt->context->node = oldnode; - return(0); - } - -@@ -14049,8 +13981,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - res = valuePop(ctxt); - xmlXPathReleaseObject(ctxt->context, res); - } -- -- ctxt->context->node = NULL; - } - } - } -@@ -14059,7 +13989,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - * The result is used as the new evaluation set. - */ - xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->node = NULL; -+ ctxt->context->node = oldnode; - ctxt->context->contextSize = -1; - ctxt->context->proximityPosition = -1; - valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset)); --- -2.18.0 - diff --git a/0008-Improve-restoring-of-context-size-and-position.patch b/0008-Improve-restoring-of-context-size-and-position.patch deleted file mode 100644 index 1577b2c..0000000 --- a/0008-Improve-restoring-of-context-size-and-position.patch +++ /dev/null @@ -1,443 +0,0 @@ -From fa33bf317aa9b455e08b211252092dd9110c49fb Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Thu, 25 May 2017 00:45:10 +0200 -Subject: [PATCH 08/13] Improve restoring of context size and position - -Restore context size and position where it is modified, not in -seemingly random places. ---- - xpath.c | 133 ++++++++++++++++++++++---------------------------------- - 1 file changed, 53 insertions(+), 80 deletions(-) - -diff --git a/xpath.c b/xpath.c -index 4b9faaf6..9d223977 100644 ---- a/xpath.c -+++ b/xpath.c -@@ -11661,6 +11661,7 @@ xmlXPathCompOpEvalPredicate(xmlXPathParserContextPtr ctxt, - xmlXPathContextPtr xpctxt = ctxt->context; - xmlNodePtr contextNode, oldContextNode; - xmlDocPtr oldContextDoc; -+ int oldcs, oldpp; - int i, res, contextPos = 0, newContextSize; - xmlXPathStepOpPtr exprOp; - xmlXPathObjectPtr contextObj = NULL, exprRes = NULL; -@@ -11697,6 +11698,8 @@ xmlXPathCompOpEvalPredicate(xmlXPathParserContextPtr ctxt, - */ - oldContextNode = xpctxt->node; - oldContextDoc = xpctxt->doc; -+ oldcs = xpctxt->contextSize; -+ oldpp = xpctxt->proximityPosition; - /* - * Get the expression of this predicate. - */ -@@ -11783,8 +11786,8 @@ evaluation_exit: - */ - xpctxt->node = oldContextNode; - xpctxt->doc = oldContextDoc; -- xpctxt->contextSize = -1; -- xpctxt->proximityPosition = -1; -+ xpctxt->contextSize = oldcs; -+ xpctxt->proximityPosition = oldpp; - return(newContextSize); - } - return(contextSize); -@@ -11827,6 +11830,7 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt, - return (contextSize); - } else { - xmlDocPtr oldContextDoc; -+ int oldcs, oldpp; - int i, pos = 0, newContextSize = 0, contextPos = 0, res; - xmlXPathStepOpPtr exprOp; - xmlXPathObjectPtr contextObj = NULL, exprRes = NULL; -@@ -11847,6 +11851,8 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt, - */ - oldContextNode = xpctxt->node; - oldContextDoc = xpctxt->doc; -+ oldcs = xpctxt->contextSize; -+ oldpp = xpctxt->proximityPosition; - /* - * Get the expression of this predicate. - */ -@@ -11983,8 +11989,8 @@ evaluation_exit: - */ - xpctxt->node = oldContextNode; - xpctxt->doc = oldContextDoc; -- xpctxt->contextSize = -1; -- xpctxt->proximityPosition = -1; -+ xpctxt->contextSize = oldcs; -+ xpctxt->proximityPosition = oldpp; - return(newContextSize); - } - return(contextSize); -@@ -12829,8 +12835,6 @@ xmlXPathCompOpEvalLast(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op, - int total = 0, cur; - xmlXPathCompExprPtr comp; - xmlXPathObjectPtr arg1, arg2; -- int pp; -- int cs; - - CHECK_ERROR0; - comp = ctxt->comp; -@@ -12838,8 +12842,6 @@ xmlXPathCompOpEvalLast(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op, - case XPATH_OP_END: - return (0); - case XPATH_OP_UNION: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total = - xmlXPathCompOpEvalLast(ctxt, &comp->steps[op->ch1], last); - CHECK_ERROR0; -@@ -12857,8 +12859,6 @@ xmlXPathCompOpEvalLast(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op, - nodesetval->nodeNr - - 1]; - } -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - cur = - xmlXPathCompOpEvalLast(ctxt, &comp->steps[op->ch2], last); - CHECK_ERROR0; -@@ -12942,6 +12942,7 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - xmlNodeSetPtr oldset; - xmlNodePtr oldnode; - xmlDocPtr oldDoc; -+ int oldcs, oldpp; - int i; - - CHECK_ERROR0; -@@ -13015,6 +13016,8 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - obj = valuePop(ctxt); - oldlocset = obj->user; - oldnode = ctxt->context->node; -+ oldcs = ctxt->context->contextSize; -+ oldpp = ctxt->context->proximityPosition; - - newlocset = xmlXPtrLocationSetCreate(NULL); - -@@ -13039,9 +13042,8 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - if (op->ch2 != -1) - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { -- xmlXPathFreeObject(obj); -- ctxt->context->node = oldnode; -- return(0); -+ xmlXPtrFreeLocationSet(newlocset); -+ goto xptr_error; - } - /* - * The result of the evaluation need to be tested to -@@ -13083,11 +13085,12 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - /* - * The result is used as the new evaluation locset. - */ -- xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->contextSize = -1; -- ctxt->context->proximityPosition = -1; - valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset)); -+xptr_error: -+ xmlXPathReleaseObject(ctxt->context, obj); - ctxt->context->node = oldnode; -+ ctxt->context->contextSize = oldcs; -+ ctxt->context->proximityPosition = oldpp; - return (total); - } - #endif /* LIBXML_XPTR_ENABLED */ -@@ -13108,6 +13111,8 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - oldset = obj->nodesetval; - oldnode = ctxt->context->node; - oldDoc = ctxt->context->doc; -+ oldcs = ctxt->context->contextSize; -+ oldpp = ctxt->context->proximityPosition; - - /* - * Initialize the new set. -@@ -13142,9 +13147,7 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeNodeSet(newset); -- xmlXPathFreeObject(obj); -- ctxt->context->node = oldnode; -- return(0); -+ goto error; - } - /* - * The result of the evaluation needs to be tested to -@@ -13185,12 +13188,13 @@ xmlXPathCompOpEvalFilterFirst(xmlXPathParserContextPtr ctxt, - /* - * The result is used as the new evaluation set. - */ -+ valuePush(ctxt, xmlXPathCacheWrapNodeSet(ctxt->context, newset)); -+error: - xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->contextSize = -1; -- ctxt->context->proximityPosition = -1; - ctxt->context->node = oldnode; - ctxt->context->doc = oldDoc; -- valuePush(ctxt, xmlXPathCacheWrapNodeSet(ctxt->context, newset)); -+ ctxt->context->contextSize = oldcs; -+ ctxt->context->proximityPosition = oldpp; - } - return(total); - } -@@ -13211,8 +13215,6 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - int equal, ret; - xmlXPathCompExprPtr comp; - xmlXPathObjectPtr arg1, arg2; -- int pp; -- int cs; - - CHECK_ERROR0; - comp = ctxt->comp; -@@ -13220,16 +13222,12 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - case XPATH_OP_END: - return (0); - case XPATH_OP_AND: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; - xmlXPathBooleanFunction(ctxt, 1); - if ((ctxt->value == NULL) || (ctxt->value->boolval == 0)) - return (total); - arg2 = valuePop(ctxt); -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - if (ctxt->error) { - xmlXPathFreeObject(arg2); -@@ -13242,16 +13240,12 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathReleaseObject(ctxt->context, arg2); - return (total); - case XPATH_OP_OR: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; - xmlXPathBooleanFunction(ctxt, 1); - if ((ctxt->value == NULL) || (ctxt->value->boolval == 1)) - return (total); - arg2 = valuePop(ctxt); -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - if (ctxt->error) { - xmlXPathFreeObject(arg2); -@@ -13264,12 +13258,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathReleaseObject(ctxt->context, arg2); - return (total); - case XPATH_OP_EQUAL: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - CHECK_ERROR0; - if (op->value) -@@ -13279,25 +13269,17 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - valuePush(ctxt, xmlXPathCacheNewBoolean(ctxt->context, equal)); - return (total); - case XPATH_OP_CMP: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - CHECK_ERROR0; - ret = xmlXPathCompareValues(ctxt, op->value, op->value2); - valuePush(ctxt, xmlXPathCacheNewBoolean(ctxt->context, ret)); - return (total); - case XPATH_OP_PLUS: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; - if (op->ch2 != -1) { -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - } - CHECK_ERROR0; -@@ -13313,12 +13295,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - } - return (total); - case XPATH_OP_MULT: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - CHECK_ERROR0; - if (op->value == 0) -@@ -13329,12 +13307,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathModValues(ctxt); - return (total); - case XPATH_OP_UNION: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); - CHECK_ERROR0; -- ctxt->context->proximityPosition = pp; -- ctxt->context->contextSize = cs; - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); - CHECK_ERROR0; - -@@ -13489,18 +13463,12 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - return (total); - } - case XPATH_OP_ARG: -- pp = ctxt->context->proximityPosition; -- cs = ctxt->context->contextSize; - if (op->ch1 != -1) { - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]); -- ctxt->context->contextSize = cs; -- ctxt->context->proximityPosition = pp; - CHECK_ERROR0; - } - if (op->ch2 != -1) { - total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]); -- ctxt->context->contextSize = cs; -- ctxt->context->proximityPosition = pp; - CHECK_ERROR0; - } - return (total); -@@ -13512,6 +13480,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlNodeSetPtr oldset; - xmlNodePtr oldnode; - xmlDocPtr oldDoc; -+ int oldcs, oldpp; - int i; - - /* -@@ -13636,6 +13605,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - obj = valuePop(ctxt); - oldlocset = obj->user; - oldnode = ctxt->context->node; -+ oldcs = ctxt->context->contextSize; -+ oldpp = ctxt->context->proximityPosition; - - newlocset = xmlXPtrLocationSetCreate(NULL); - -@@ -13656,9 +13627,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathCompOpEval(ctxt, - &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { -- xmlXPathFreeObject(obj); -- ctxt->context->node = oldnode; -- return(0); -+ xmlXPtrFreeLocationSet(newlocset); -+ goto filter_xptr_error; - } - - /* -@@ -13687,11 +13657,12 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - /* - * The result is used as the new evaluation locset. - */ -- xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->contextSize = -1; -- ctxt->context->proximityPosition = -1; - valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset)); -+filter_xptr_error: -+ xmlXPathReleaseObject(ctxt->context, obj); - ctxt->context->node = oldnode; -+ ctxt->context->contextSize = oldcs; -+ ctxt->context->proximityPosition = oldpp; - return (total); - } - #endif /* LIBXML_XPTR_ENABLED */ -@@ -13709,6 +13680,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - oldset = obj->nodesetval; - oldnode = ctxt->context->node; - oldDoc = ctxt->context->doc; -+ oldcs = ctxt->context->contextSize; -+ oldpp = ctxt->context->proximityPosition; - tmp = NULL; - /* - * Initialize the new set. -@@ -13774,9 +13747,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { - xmlXPathFreeNodeSet(newset); -- xmlXPathFreeObject(obj); -- ctxt->context->node = oldnode; -- return(0); -+ goto filter_error; - } - - /* -@@ -13816,13 +13787,14 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - /* - * The result is used as the new evaluation set. - */ -+ valuePush(ctxt, -+ xmlXPathCacheWrapNodeSet(ctxt->context, newset)); -+filter_error: - xmlXPathReleaseObject(ctxt->context, obj); -- ctxt->context->contextSize = -1; -- ctxt->context->proximityPosition = -1; - ctxt->context->node = oldnode; - ctxt->context->doc = oldDoc; -- valuePush(ctxt, -- xmlXPathCacheWrapNodeSet(ctxt->context, newset)); -+ ctxt->context->contextSize = oldcs; -+ ctxt->context->proximityPosition = oldpp; - } - return (total); - } -@@ -13847,6 +13819,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlLocationSetPtr oldlocset; - xmlNodeSetPtr oldset; - xmlNodePtr oldnode = ctxt->context->node; -+ int oldcs = ctxt->context->contextSize; -+ int oldpp = ctxt->context->proximityPosition; - int i, j; - - if (op->ch1 != -1) { -@@ -13894,9 +13868,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathCompOpEval(ctxt, - &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { -- xmlXPathFreeObject(obj); -- ctxt->context->node = oldnode; -- return(0); -+ xmlXPtrFreeLocationSet(newlocset); -+ goto rangeto_error; - } - - res = valuePop(ctxt); -@@ -13958,9 +13931,8 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - xmlXPathCompOpEval(ctxt, - &comp->steps[op->ch2]); - if (ctxt->error != XPATH_EXPRESSION_OK) { -- xmlXPathFreeObject(obj); -- ctxt->context->node = oldnode; -- return(0); -+ xmlXPtrFreeLocationSet(newlocset); -+ goto rangeto_error; - } - - res = valuePop(ctxt); -@@ -13988,11 +13960,12 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op) - /* - * The result is used as the new evaluation set. - */ -+ valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset)); -+rangeto_error: - xmlXPathReleaseObject(ctxt->context, obj); - ctxt->context->node = oldnode; -- ctxt->context->contextSize = -1; -- ctxt->context->proximityPosition = -1; -- valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset)); -+ ctxt->context->contextSize = oldcs; -+ ctxt->context->proximityPosition = oldpp; - return (total); - } - #endif /* LIBXML_XPTR_ENABLED */ --- -2.18.0 - diff --git a/0009-Fix-null-deref-in-xmlregexp-error-path.patch b/0009-Fix-null-deref-in-xmlregexp-error-path.patch deleted file mode 100644 index c486ced..0000000 --- a/0009-Fix-null-deref-in-xmlregexp-error-path.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 09797c139e5b0168c87f41b2cea1078d7244638d Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Tue, 5 Mar 2019 15:14:34 +0100 -Subject: [PATCH 09/37] Fix null deref in xmlregexp error path - -Thanks to Shaobo He for the report. ---- - xmlregexp.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/xmlregexp.c b/xmlregexp.c -index d255fbf..9e9c375 100644 ---- a/xmlregexp.c -+++ b/xmlregexp.c -@@ -5537,6 +5537,8 @@ xmlRegexpIsDeterminist(xmlRegexpPtr comp) { - return(comp->determinist); - - am = xmlNewAutomata(); -+ if (am == NULL) -+ return(-1); - if (am->states != NULL) { - int i; - --- -1.8.3.1 - diff --git a/0009-HTML-noscript-should-not-close-p.patch b/0009-HTML-noscript-should-not-close-p.patch deleted file mode 100644 index 573d708..0000000 --- a/0009-HTML-noscript-should-not-close-p.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 35e83488505d501864826125cfe6a7950d6cba78 Mon Sep 17 00:00:00 2001 -From: Daniel Veillard -Date: Wed, 18 Apr 2018 15:58:42 +0200 -Subject: [PATCH 09/13] HTML noscript should not close p - -For https://bugzilla.gnome.org/show_bug.cgi?id=795343 - -- HTMLparser.c: noscript should not close

but it should close