Shlomi Fish avatar Shlomi Fish committed 40950c3

Fix removeChild crash (rt #80395).

See: https://rt.cpan.org/Ticket/Display.html?id=80395 .

Comments (0)

Files changed (4)

 Revision history for Perl extension XML::LibXML
 
+    - Fix crash in removeChild() when not expanding entities
+        - https://rt.cpan.org/Ticket/Display.html?id=80395
+            - "removeChild() segfaults when not expanding entities"
+        - Thanks to GUIDO@cpan.org for the report, for a test case (that
+        was adapted into t/48_removeChild_crashes_rt_80395.t ) and for
+        a patch to fix it.
+
 2.0010          Thu  1 Nov 20:13:08 IST 2012
     - Passing debug (an undocumented option) to check_lib in Makefile.PL.
         - This way we get more meaningful traces on perl Makefile.PL DEBUG=1.
 t/47load_xml_callbacks.t
 t/48_rt55000.t
 t/48importing_nodes_IDs_rt_69520.t
+t/48_removeChild_crashes_rt_80395.t
 t/49_load_html.t
 t/49callbacks_returning_undef.t
 t/49global_extent.t
 void
 _domReconcileNs(xmlNodePtr tree, xmlNsPtr * unused)
 {
-        if( tree->ns != NULL )
+        if( tree->ns != NULL
+            && ((tree->type == XML_ELEMENT_NODE)
+                || (tree->type == XML_ATTRIBUTE_NODE)))
         {
                 xmlNsPtr ns = xmlSearchNs( tree->doc, tree->parent, tree->ns->prefix );
                 if( ns != NULL && ns->href != NULL && tree->ns->href != NULL &&

t/48_removeChild_crashes_rt_80395.t

+#!/usr/bin/perl
+
+# See:
+#
+# https://rt.cpan.org/Public/Bug/Display.html?id=80395
+
+use strict;
+use warnings;
+
+use Test::More tests => 1;
+
+use XML::LibXML;
+
+my $xml = <<EOF;
+<!DOCTYPE bug [
+<!ENTITY myent "xyz">
+]>
+<bug>
+  <elem>&myent;</elem>
+</bug>
+EOF
+
+my $dom = XML::LibXML->load_xml (string => $xml,
+                                 expand_entities => 0);
+my $root = $dom->documentElement;
+
+my @nodes = $root->childNodes;
+foreach my $node (@nodes) {
+    next if $node->nodeType != XML_ELEMENT_NODE;
+    next if $node->nodeName ne 'elem';
+
+    $root->removeChild ($node);
+}
+
+# TEST
+ok(1, "Code did not crash.");
Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for ProjectModifiedEvent.java.
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.