| Index: third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch
|
| diff --git a/third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch b/third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..ec28c85202aae879a9db48d5d46b2f25a69182c3
|
| --- /dev/null
|
| +++ b/third_party/libxml/chromium/libxml2-2.9.4-xmlDumpElementContent-null-deref.patch
|
| @@ -0,0 +1,34 @@
|
| +observed while fuzzing
|
| +
|
| +--- src/valid.c
|
| ++++ src/valid.c
|
| +@@ -1172,12 +1172,14 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementContentPtr content, int glob)
|
| + xmlBufferWriteCHAR(buf, content->name);
|
| + break;
|
| + case XML_ELEMENT_CONTENT_SEQ:
|
| ++ if (content->c1 == NULL) return;
|
| + if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
|
| + (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
|
| + xmlDumpElementContent(buf, content->c1, 1);
|
| + else
|
| + xmlDumpElementContent(buf, content->c1, 0);
|
| + xmlBufferWriteChar(buf, " , ");
|
| ++ if (content->c2 == NULL) return;
|
| + if ((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
|
| + ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&
|
| + (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
|
| +@@ -1186,12 +1188,14 @@ xmlDumpElementContent(xmlBufferPtr buf, xmlElementContentPtr content, int glob)
|
| + xmlDumpElementContent(buf, content->c2, 0);
|
| + break;
|
| + case XML_ELEMENT_CONTENT_OR:
|
| ++ if (content->c1 == NULL) return;
|
| + if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
|
| + (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
|
| + xmlDumpElementContent(buf, content->c1, 1);
|
| + else
|
| + xmlDumpElementContent(buf, content->c1, 0);
|
| + xmlBufferWriteChar(buf, " | ");
|
| ++ if (content->c2 == NULL) return;
|
| + if ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
|
| + ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&
|
| + (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
|
|
|