1
0
mirror of https://github.com/GNOME/libxml2.git synced 2025-10-20 05:14:10 +08:00
Commit Graph

17 Commits

Author SHA1 Message Date
Nick Wellnhofer
57b81c208c Normalize XPath strings in-place
Simplify the code and fix a potential memory leak.

Fixes #343.
2022-03-05 18:22:51 +01:00
Nick Wellnhofer
30a6533e01 Fix float casts in xmlXPathSubstringFunction
Rewrite conversion of double to int in xmlXPathSubstringFunction, adding
range checks to avoid undefined behavior. Make sure to add start and
length as floating-point numbers before converting to int. Fix a bug
when rounding negative start indices.

Remove unneeded calls to xmlXPathIs{Inf,NaN} and rely on IEEE math
instead. Avoid computing the string length. xmlUTF8Strsub works as
expected if the length of the requested substring exceeds the input.

Found with libFuzzer and UBSan.
2019-03-08 14:29:59 +01:00
Nick Wellnhofer
7482f41f61 Check for integer overflow in xmlXPathFormatNumber
Check for overflow before casting double to int.

Found with afl-fuzz and UBSan.
2017-06-01 22:00:19 +02:00
Nick Wellnhofer
f4029cd413 Check XPath exponents for overflow
Avoid undefined behavior and wrong results with huge exponents.

Found with afl-fuzz and UBSan.
2017-05-31 16:04:37 +02:00
Nick Wellnhofer
a851868a75 Parse small XPath numbers more accurately
Don't count leading zeros towards the fraction size limit. This allows
to parse numbers like

    0.0000000000000000000000000000000000000000000000000000000001

which is the only standard-conformant way to represent such numbers, as
scientific notation isn't allowed in XPath 1.0. (It is allowed in XPath
2.0 and in libxml2 as an extension, though.)

Overall accuracy is still bad, see bug 783238.
2017-05-31 15:46:29 +02:00
Nick Wellnhofer
4bebb030db Rework XPath rounding functions
Use the C library's floor and ceil functions. The old code was overly
complicated for no apparent reason and could result in undefined
behavior when handling NaNs (found with afl-fuzz and UBSan).

Fix wrong comment in xmlXPathRoundFunction. The implementation was
already following the spec and rounding half up.
2017-05-31 15:38:42 +02:00
Nick Wellnhofer
839689a9a8 Don't recurse into OP_VALUEs in xmlXPathOptimizeExpression
The ch1 slot of OP_VALUEs contains an invalid value. Ignore it.

Fixes bug #760325:

https://bugzilla.gnome.org/show_bug.cgi?id=760325
2016-04-27 18:05:06 +02:00
Nick Wellnhofer
e289390362 Fix parsing of NCNames in XPath
The NCName parser would allow any NameChar as start character. For
example, the following XPath expressions would compile:

    self::-abc
    self::0abc
    self::.abc
2016-04-23 19:12:47 +02:00
Daniel Veillard
fdc9156a75 applied patch from Richard Jinks for the namespace axis + fixed a memory
* xpath.c: applied patch from Richard Jinks for the namespace
  axis + fixed a memory error.
* parser.c parserInternals.c: applied patches from Peter Jacobi
  removing ctxt->token for good.
* xmlschemas.c xmlschemastypes.c: fixed a few memory leaks
  popped out by the regression tests.
* Makefile.am: patch for threads makefile from Gary Pennington
Daniel
2002-07-01 21:52:03 +00:00
Daniel Veillard
9e4123023a patch from Richard Jinks for XPath substring() function new set of tests
* xpath.c: patch from Richard Jinks for XPath substring() function
* result/XPath/expr/strings test/XPath/expr/strings: new set of tests
Daniel
2002-06-10 15:59:44 +00:00
Daniel Veillard
eca82810f0 another XPath conformance patch from Richard Jinks Daniel
* test/XPath/expr/floats test/XPath/expr/functions
  result/XPath/expr/floats result/XPath/expr/functions
  xpath.c: another XPath conformance patch from Richard Jinks
Daniel
2002-04-24 11:42:02 +00:00
Daniel Veillard
0eafdef988 another patch from Richard Jinks for substring conformance update of the
* xpath.c: another patch from Richard Jinks for substring conformance
* test/XPath/expr/floats test/XPath/expr/strings
  result/XPath/expr/floats result/XPath/expr/strings: update of the
  test suite to check those.
Daniel
2002-04-10 16:14:34 +00:00
Daniel Veillard
21458c85e2 more patches from Richard Jinks Updated tests though they show a
* trionan.c trionan.h xpath.c: more patches from Richard Jinks
* test/XPath/expr/compare test/XPath/expr/equality
  test/XPath/expr/floats test/XPath/expr/functions
  test/XPath/expr/strings result/XPath/expr/compare
  result/XPath/expr/equality result/XPath/expr/floats
  result/XPath/expr/functions result/XPath/expr/strings: Updated
  tests though they show a divergence on Linux
Daniel
2002-03-27 16:12:22 +00:00
Bjorn Reese
70a9da54eb trio upgrade and integration 2001-04-21 16:57:29 +00:00
Daniel Veillard
4b637079f2 - xpath.c: finally implemented xmlXPathCompareNodeSets
- test/XPath/expr/floats results/XPath/expr/floats: added
  a test for float expressions
Daniel
2001-02-21 21:52:55 +00:00
Daniel Veillard
7c1206fc06 Revamped HTML parsing, lots of bug fixes for HTML stuff,
Added xmlValidGetValidElements and xmlValidGetPotentialChildren,
Completed and cleaned up the tests,
Added doc for new modules gnome-xml-xmlmemory.html and gnome-xml-nanohttp.html,
Daniel
1999-10-14 09:10:25 +00:00
Daniel Veillard
1566d3a91b Added XPath code (http://www.w3.org/TR/xpath), updated HTML support and docs, Daniel 1999-07-15 14:24:29 +00:00