Skip to content
Snippets Groups Projects
Commit a64262f72b82 authored by Nick Wellnhofer's avatar Nick Wellnhofer
Browse files

Fix use-after-free in xsltApplyTemplates

xsltApplyTemplates without a select expression could delete nodes in
the source document.

1. Text nodes with strippable whitespace

Whitespace from input documents is already stripped, so there's no
need to strip it again. Under certain circumstances, xsltApplyTemplates
could be fooled into deleting text nodes that are still referenced,
resulting in a use-after-free.

2. The DTD

The DTD was only unlinked, but there's no good reason to do this just
now. Maybe it was meant as a micro-optimization.

3. Unknown nodes

Useless and dangerous as well, especially with XInclude nodes.
See https://gitlab.gnome.org/GNOME/libxml2/-/issues/268

Simply stop trying to uselessly delete nodes when applying a template.
This part of the code is probably a leftover from a time where
xsltApplyStripSpaces wasn't implemented yet. Also note that
xsltApplyTemplates with a select expression never tried to delete
nodes.

Also stop xsltDefaultProcessOneNode from deleting nodes for the same
reasons.

This fixes CVE-2021-30560.
parent 71c854a7a5b6
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment