third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch - Issue 2797923004: Improve XML serialization, URI parsing, and XPath node set processing.

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch

Issue 2797923004: Improve XML serialization, URI parsing, and XPath node set processing. (Closed)

Patch Set: Rebase. Created 3 years, 8 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

OLD	NEW
(Empty)
	1 observed while fuzzing

	2

	3 --- src/valid.c

	4 +++ src/valid.c

	5 @@ -1172,12 +1172,14 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementConten tPtr content, int glob)

	6 xmlBufferWriteCHAR(buf, content->name);

	7 break;

	8 case XML_ELEMENT_CONTENT_SEQ:

	9 + if (content->c1 == NULL) return;

	10 if ((content->c1->type == XML_ELEMENT_CONTENT_OR) \|\|

	11 (content->c1->type == XML_ELEMENT_CONTENT_SEQ))

	12 xmlDumpElementContent(buf, content->c1, 1);

	13 else

	14 xmlDumpElementContent(buf, content->c1, 0);

	15 xmlBufferWriteChar(buf, " , ");

	16 + if (content->c2 == NULL) return;

	17 if ((content->c2->type == XML_ELEMENT_CONTENT_OR) \|\|

	18 ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&

	19 (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))

	20 @@ -1186,12 +1188,14 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementConten tPtr content, int glob)

	21 xmlDumpElementContent(buf, content->c2, 0);

	22 break;

	23 case XML_ELEMENT_CONTENT_OR:

	24 + if (content->c1 == NULL) return;

	25 if ((content->c1->type == XML_ELEMENT_CONTENT_OR) \|\|

	26 (content->c1->type == XML_ELEMENT_CONTENT_SEQ))

	27 xmlDumpElementContent(buf, content->c1, 1);

	28 else

	29 xmlDumpElementContent(buf, content->c1, 0);

	30 xmlBufferWriteChar(buf, " \| ");

	31 + if (content->c2 == NULL) return;

	32 if ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) \|\|

	33 ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&

	34 (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))

OLD	NEW