diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2017-07-30 18:33:27 +0200 |
|---|---|---|
| committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2017-07-31 15:00:53 +0200 |
| commit | 6b067190fe4f0a9031cc39b6e52cfc19c416aac0 (patch) | |
| tree | 500a5f11a5f117c33523d640bd808b05e91ac2bc | |
| parent | 3892a890d9095b755453f0dc3d90a167df603cba (diff) | |
| download | libxslt-1.1.30-rc1.tar.gz | |
Fix NULL deref in xsltDefaultSortFunctionv1.1.30-rc1
An evaluation error in a secondary sort key could lead to a NULL pointer
dereference.
Thanks to Nicolas Gregoire for the report.
Fixes bug 785588.
| -rw-r--r-- | libxslt/xsltutils.c | 2 | ||||
| -rw-r--r-- | tests/docs/bug-208.xml | 8 | ||||
| -rw-r--r-- | tests/general/bug-208.err | 6 | ||||
| -rw-r--r-- | tests/general/bug-208.out | 0 | ||||
| -rw-r--r-- | tests/general/bug-208.xsl | 8 |
5 files changed, 24 insertions, 0 deletions
diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c index c250ccfa..6bd8ed06 100644 --- a/libxslt/xsltutils.c +++ b/libxslt/xsltutils.c @@ -1249,6 +1249,8 @@ xsltDefaultSortFunction(xsltTransformContextPtr ctxt, xmlNodePtr *sorts, if (res[j] == NULL) { if (res[j+incr] != NULL) tst = 1; + } else if (res[j+incr] == NULL) { + tst = -1; } else { if (numb) { /* We make NaN smaller than number in diff --git a/tests/docs/bug-208.xml b/tests/docs/bug-208.xml new file mode 100644 index 00000000..5d3529ae --- /dev/null +++ b/tests/docs/bug-208.xml @@ -0,0 +1,8 @@ +<a> + <b> + <c> + <d1><d2/></d1> + <e/> + </c> + </b> +</a> diff --git a/tests/general/bug-208.err b/tests/general/bug-208.err new file mode 100644 index 00000000..02c97121 --- /dev/null +++ b/tests/general/bug-208.err @@ -0,0 +1,6 @@ +XPath error : Undefined namespace prefix +XPath error : Undefined namespace prefix +XPath error : Undefined namespace prefix +XPath error : Undefined namespace prefix +XPath error : Undefined namespace prefix +no result for ./../docs/bug-208.xml diff --git a/tests/general/bug-208.out b/tests/general/bug-208.out new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/tests/general/bug-208.out diff --git a/tests/general/bug-208.xsl b/tests/general/bug-208.xsl new file mode 100644 index 00000000..322b58dc --- /dev/null +++ b/tests/general/bug-208.xsl @@ -0,0 +1,8 @@ +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:template match="/"> + <xsl:for-each select="//."> + <xsl:sort/> + <xsl:sort select="*[a:b]"/>; + </xsl:for-each> + </xsl:template> +</xsl:stylesheet> |