Brad Bishop | 1a4b7ee | 2018-12-16 17:11:34 -0800 | [diff] [blame^] | 1 | libxslt-1.1.32: Fix handling of RVTs returned from nested EXSLT functions |
| 2 | |
| 3 | [No upstream tracking] -- https://bugzilla.gnome.org/show_bug.cgi?id=792580 |
| 4 | |
| 5 | Set the context variable to NULL when evaluating EXSLT functions. |
| 6 | Fixes potential use-after-free errors or memory leaks. |
| 7 | |
| 8 | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxslt/commit/8bd32f7753ac253a54279a0b6a88d15a57076bb0] |
| 9 | bug: 792580 |
| 10 | Signed-off-by: Andrej Valek <andrej.valek@siemens.com> |
| 11 | |
| 12 | diff --git a/libexslt/functions.c b/libexslt/functions.c |
| 13 | index dc794e3..8511cb0 100644 |
| 14 | --- a/libexslt/functions.c |
| 15 | +++ b/libexslt/functions.c |
| 16 | @@ -280,6 +280,7 @@ exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt, int nargs) { |
| 17 | exsltFuncFunctionData *func; |
| 18 | xmlNodePtr paramNode, oldInsert, fake; |
| 19 | int oldBase; |
| 20 | + void *oldCtxtVar; |
| 21 | xsltStackElemPtr params = NULL, param; |
| 22 | xsltTransformContextPtr tctxt = xsltXPathGetTransformContext(ctxt); |
| 23 | int i, notSet; |
| 24 | @@ -418,11 +419,14 @@ exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt, int nargs) { |
| 25 | fake = xmlNewDocNode(tctxt->output, NULL, |
| 26 | (const xmlChar *)"fake", NULL); |
| 27 | oldInsert = tctxt->insert; |
| 28 | + oldCtxtVar = tctxt->contextVariable; |
| 29 | tctxt->insert = fake; |
| 30 | + tctxt->contextVariable = NULL; |
| 31 | xsltApplyOneTemplate (tctxt, tctxt->node, |
| 32 | func->content, NULL, NULL); |
| 33 | xsltLocalVariablePop(tctxt, tctxt->varsBase, -2); |
| 34 | tctxt->insert = oldInsert; |
| 35 | + tctxt->contextVariable = oldCtxtVar; |
| 36 | tctxt->varsBase = oldBase; /* restore original scope */ |
| 37 | if (params != NULL) |
| 38 | xsltFreeStackElemList(params); |
| 39 | diff --git a/tests/docs/bug-209.xml b/tests/docs/bug-209.xml |
| 40 | new file mode 100644 |
| 41 | index 0000000..69d62f2 |
| 42 | --- /dev/null |
| 43 | +++ b/tests/docs/bug-209.xml |
| 44 | @@ -0,0 +1 @@ |
| 45 | +<doc/> |
| 46 | diff --git a/tests/general/bug-209.out b/tests/general/bug-209.out |
| 47 | new file mode 100644 |
| 48 | index 0000000..e829790 |
| 49 | --- /dev/null |
| 50 | +++ b/tests/general/bug-209.out |
| 51 | @@ -0,0 +1,2 @@ |
| 52 | +<?xml version="1.0"?> |
| 53 | +<result/> |
| 54 | diff --git a/tests/general/bug-209.xsl b/tests/general/bug-209.xsl |
| 55 | new file mode 100644 |
| 56 | index 0000000..fe69ac6 |
| 57 | --- /dev/null |
| 58 | +++ b/tests/general/bug-209.xsl |
| 59 | @@ -0,0 +1,21 @@ |
| 60 | +<xsl:stylesheet |
| 61 | + version="1.0" |
| 62 | + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" |
| 63 | + xmlns:func="http://exslt.org/functions" |
| 64 | + extension-element-prefixes="func"> |
| 65 | + |
| 66 | + <xsl:template match="/"> |
| 67 | + <xsl:variable name="v" select="func:a()" /> |
| 68 | + <xsl:copy-of select="$v"/> |
| 69 | + </xsl:template> |
| 70 | + |
| 71 | + <func:function name="func:a"> |
| 72 | + <func:result select="func:b()" /> |
| 73 | + </func:function> |
| 74 | + |
| 75 | + <func:function name="func:b"> |
| 76 | + <func:result> |
| 77 | + <result/> |
| 78 | + </func:result> |
| 79 | + </func:function> |
| 80 | +</xsl:stylesheet> |