Commit 9f42f6ba authored by Nick Wellnhofer's avatar Nick Wellnhofer

Don't follow next pointer on documents in xmlXPathRunStreamEval

RVTs from libxslt are document nodes which are linked using the 'next'
pointer. These pointers must never be used to navigate the document
tree. Otherwise, random content from other RVTs could be returned
when evaluating XPath expressions.

It's interesting that this seemingly long-standing bug wasn't
discovered earlier. This issue could also cause severe performance
degradation.

Fixes libxslt#37
parent c0440868
Pipeline #190985 passed with stage
in 4 minutes and 1 second
......@@ -13833,7 +13833,8 @@ scan_children:
do {
cur = cur->parent;
depth--;
if ((cur == NULL) || (cur == limit))
if ((cur == NULL) || (cur == limit) ||
(cur->type == XML_DOCUMENT_NODE))
goto done;
if (cur->type == XML_ELEMENT_NODE) {
ret = xmlStreamPop(patstream);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment