Niels Dossche authored Nov 02, 2023 and Nick Wellnhofer committed Apr 19, 2024

The condition size > UINT_MAX - 10 is already checked earlier, so the
check is always false.

The node type was already checked earlier.

Niels Dossche authored Nov 02, 2023 and Nick Wellnhofer committed Apr 19, 2024

This variable is already NULL checked in the previous if condition.

Niels Dossche authored Nov 02, 2023 and Nick Wellnhofer committed Apr 19, 2024

This case is already checked at the start of the function.
There it returns NULL, which seems more correct.

Niels Dossche authored Nov 02, 2023 and Nick Wellnhofer committed Apr 19, 2024

cur = node, and node cannot be NULL as it is checked at the start of the
function.

Match the behavior of xmlSplitQName and xmlSplitQName4.

Also decode entities in namespace URIs if entity substitution wasn't
requested. This should fix some corner cases when comparing namespace
URIs. The Namespaces in XML 1.0 spec says:

> In a namespace declaration, the URI reference is the normalized value
> of the attribute, so replacement of XML character and entity
> references has already been done before any comparison.

Make the serialization code escape special characters in namespace URIs
like in attribute values. This fixes serialization if entities were
substituted when parsing.

Fixes libxslt#106

Avoid false positives in real OOM situations.

Avoid fuzzer timeouts caused by this known issue.

Revert part of commit c5a8aef2 to make it safe to call the default SAX
error handlers directly. This has been deprecated for a long time but
even xmllint still uses these handlers.

Should fix #713.

Flush buffer before checking for errors.

Seiya Nakata authored Apr 04, 2024 and Nick Wellnhofer committed Apr 05, 2024

Don't create cycles in tree structure. This will lead to an infinite
loop or call stack overflow later.

Closes: #711

This would result in a spurious error.

We don't want to exceed the size limit of 1 MB in uri.c. Such errors
can't be distinguished from malloc failures.

Most string functions can assume valid UTF-8. In order to detect malloc
failures reliably, xmlUTF8Strsub should only return NULL if the start
index is out of bounds or a memory allocation failed.

See #255 and commit 85b1792e.

libxml2 has limited support for reading and writing compressed data
with the help of zlib and liblzma which used to be enabled by default.
This only works for files read from the file system and never worked
with memory buffers. My guess is that this feature is virtually unused.

In light of the recently discovered xz backdoor, it's a good time to
disable these features by default to reduce attack surface and prepare
for eventual removal.

If --with-legacy is passed to the Autotools build, compression will
be enabled by default as before.

This function can malloc and doesn't report failures.

Another design mistake is that xmlUnsetNsProp requires an xmlNs
struct.

This reverts commit 4b698dba.

lxml assumes that xmlDocSetRootElement works with non-elements.

Some users set href to NULL to unset a namespace without deleting it.

Also change the duplicate check in xmlNewNs which must agree with
xmlSearchNs.

Short-lived regression from f960c60d.

Commit 9e1c72da from 2001 introduced a bug where xmlAddPrevSibling and
xmlAddNextSibling would only try to merge text nodes with one of its
new siblings. Commit 4ccd3eb8 fixed this bug but unfortunately, lxml
and possibly other downstream code depend on text nodes not being
merged.

To avoid breaking downstream code while still having somewhat
consistent API behavior, it's probably best to make these functions
never coalesce text nodes.

Short-lived regression.

xmlSAX2AppendChild can make several assumptions which make appending
nodes more efficient. Also handle line numbers in xmlSAX2AppendChild.

Relink the node directly without calling xmlUnlinkNodeInternal.

Make xmlAddChild unlink the child before insertion. Originally, linked
children would most likely cause tree corruption. The first fix
disallowed linked nodes, but there are cases where insertion of such
nodes could succeed.

Don't abort if the node is already a child of parent. In this case,
the node will be moved to the end of the child list.

xmlUnlinkNode also removes references to DTD nodes which shouldn't be
done when moving nodes within a document. Introduce a new function
xmlUnlinkNodeInternal which only unlinks a node from the tree.
Remove references to DTD nodes in xmlNodeSetDoc. Note that moving
element and attribute declarations to another document will still leave
references in the source document.

Finding the old attribute node is a bit more involved.

Avoid timeouts with large inputs.

This was recently disabled globally:

    https://github.com/google/oss-fuzz/pull/11567

Short-lived regression.