Skip to content
  • Nick Wellnhofer's avatar
    Fix use-after-free in xsltApplyTemplates · 50f9c9cd
    Nick Wellnhofer authored
    xsltApplyTemplates without a select expression could delete nodes in
    the source document.
    
    1. Text nodes with strippable whitespace
    
    Whitespace from input documents is already stripped, so there's no
    need to strip it again. Under certain circumstances, xsltApplyTemplates
    could be fooled into deleting text nodes that are still referenced,
    resulting in a use-after-free.
    
    2. The DTD
    
    The DTD was only unlinked, but there's no good reason to do this just
    now. Maybe it was meant as a micro-optimization.
    
    3. Unknown nodes
    
    Useless and dangerous as well, especially with XInclude nodes.
    See libxml2#268
    
    Simply stop trying to uselessly delete nodes when applying a template.
    This part of the code is probably a leftover from a time where
    xsltApplyStripSpaces wasn't implemented yet. Also note that
    xsltApplyTemplates with a select expression never tried to delete
    nodes.
    
    Also stop xsltDefaultProcessOneNode from deleting nodes for the same
    reasons.
    
    This fixes CVE-2021-30560.
    50f9c9cd