Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(35)

Unified Diff: third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch

Issue 2797923004: Improve XML serialization, URI parsing, and XPath node set processing. (Closed)
Patch Set: Rebase. Created 3 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch
diff --git a/third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch b/third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ec28c85202aae879a9db48d5d46b2f25a69182c3
--- /dev/null
+++ b/third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch
@@ -0,0 +1,34 @@
+observed while fuzzing
+
+--- src/valid.c
++++ src/valid.c
+@@ -1172,12 +1172,14 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementContentPtr content, int glob)
+ xmlBufferWriteCHAR(buf, content->name);
+ break;
+ case XML_ELEMENT_CONTENT_SEQ:
++ if (content->c1 == NULL) return;
+ if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
+ (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
+ xmlDumpElementContent(buf, content->c1, 1);
+ else
+ xmlDumpElementContent(buf, content->c1, 0);
+ xmlBufferWriteChar(buf, " , ");
++ if (content->c2 == NULL) return;
+ if ((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
+ ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&
+ (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
+@@ -1186,12 +1188,14 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementContentPtr content, int glob)
+ xmlDumpElementContent(buf, content->c2, 0);
+ break;
+ case XML_ELEMENT_CONTENT_OR:
++ if (content->c1 == NULL) return;
+ if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
+ (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
+ xmlDumpElementContent(buf, content->c1, 1);
+ else
+ xmlDumpElementContent(buf, content->c1, 0);
+ xmlBufferWriteChar(buf, " | ");
++ if (content->c2 == NULL) return;
+ if ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
+ ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&
+ (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
« no previous file with comments | « third_party/libxml/chromium/libxml2-2.9.4-security-xpath-nodetab-uaf.patch ('k') | third_party/libxml/chromium/roll.py » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698