nokogiri 1.6.2.1-x64-mingw32 → 1.6.3.rc1-x64-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e80a3d0f5e98cb38e805e20816a9dbedfd72ebdb
-  data.tar.gz: 38c9447c67d08a5759a01afcd1c7db20553d421f
+  metadata.gz: e101ca196ef0112f7f80ce3e0651f1f7d235d81d
+  data.tar.gz: fd39a994d9fb0f9cf3f7d6306b456f4b8ae94d89
 SHA512:
-  metadata.gz: 7bcb96850804a2dd7f87e1899c7ab75cdd823ee394df347a88d46e3869a00ac6627164d7e325c105fd89954e6c153cefc0172924dfc9f2053faf9b60518e8a81
-  data.tar.gz: f5034a2367ba3857467d65266f832f159f73e4502ee533c98ef6ea2ceb7c5daf90649d29ee5fb5318f47923613c2c8f2dced9497637b07f32da5918d0e4c87cf
+  metadata.gz: 198c70dcab649df02b7a7d46ceb51d579f03185e2628735cca15bc14be880f1cf2de796e42cae8f15b4be90054499df0c1adefdeb81228580cb93c91e4e1dca8
+  data.tar.gz: cab8082d82206a3c7f25ac03fd73b987f0401e4058eae8ee0047ecd9ca3dfff2f36a23d085bd24b12f3d68f1fe76132b57beaeba7ebe2e1f44a338188be9dbea

data/CHANGELOG.ja.rdoc

@@ -1,3 +1,11 @@
+=== 1.6.3 / unreleased
+
+==== Bug fixes
+
+* Fix JRuby memory exhaustion vulnerability. #1087 (Thanks, @ocher!)
+* Fix segfault during GC when using `libxml-ruby` and `nokogiri` together in multi-threaded environment. #895 (Thanks, @ender672!)
+
+
 === 1.6.2.1 / 2014年5月13日
 
 ==== バグ修正

data/CHANGELOG.rdoc

@@ -1,3 +1,11 @@
+=== 1.6.3 / unreleased
+
+==== Bug fixes
+
+* Fix JRuby memory exhaustion vulnerability. #1087 (Thanks, @ocher)
+* Fix segfault during GC when using `libxml-ruby` and `nokogiri` together in multi-threaded environment. #895 (Thanks, @ender672!)
+
+
 === 1.6.2.1 / 2014-05-13
 
 ==== Bug fixes

data/ext/nokogiri/xml_document.c

@@ -17,13 +17,29 @@ static int dealloc_node_i(xmlNodePtr key, xmlNodePtr node, xmlDocPtr doc)
   return ST_CONTINUE;
 }
 
+static void remove_private(xmlNodePtr node)
+{
+  xmlNodePtr child;
+
+  for (child = node->children; child; child = child->next)
+    remove_private(child);
+
+  if ((node->type == XML_ELEMENT_NODE ||
+       node->type == XML_XINCLUDE_START ||
+       node->type == XML_XINCLUDE_END) &&
+      node->properties) {
+    for (child = (xmlNodePtr)node->properties; child; child = child->next)
+      remove_private(child);
+  }
+
+  node->_private = NULL;
+}
+
 static void dealloc(xmlDocPtr doc)
 {
-  xmlDeregisterNodeFunc func;
   st_table *node_hash;
 
   NOKOGIRI_DEBUG_START(doc);
-  func = xmlDeregisterNodeDefault(NULL);
 
   node_hash  = DOC_UNLINKED_NODE_HASH(doc);
 
@@ -31,10 +47,17 @@ static void dealloc(xmlDocPtr doc)
   st_free_table(node_hash);
 
   free(doc->_private);
-  doc->_private = NULL;
+
+  /* When both Nokogiri and libxml-ruby are loaded, make sure that all nodes
+   * have their _private pointers cleared. This is to avoid libxml-ruby's
+   * xmlDeregisterNode callback from accessing VALUE pointers from ruby's GC
+   * free context, which can result in segfaults.
+   */
+  if (xmlDeregisterNodeDefaultValue)
+    remove_private((xmlNodePtr)doc);
+
   xmlFreeDoc(doc);
 
-  xmlDeregisterNodeDefault(func);
   NOKOGIRI_DEBUG_END(doc);
 }
 

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = '1.6.2.1'
+  VERSION = '1.6.3.rc1'
 
   class VersionInfo # :nodoc:
     def jruby?

data/test/xml/test_document.rb

@@ -625,6 +625,12 @@ module Nokogiri
         refute_empty doc.errors
       end
 
+      def test_memory_explosion_on_wrong_formatted_element_following_the_root_element
+        doc = Nokogiri::XML("<a/><\n")
+        refute_nil doc
+        refute_empty doc.errors
+      end
+
       def test_document_has_errors
         doc = Nokogiri::XML(<<-eoxml)
           <foo><bar></foo>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.6.2.1
+  version: 1.6.3.rc1
 platform: x64-mingw32
 authors:
 - Aaron Patterson
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-05-14 00:00:00.000000000 Z
+date: 2014-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile
@@ -525,9 +525,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.2
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - '>'
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: nokogiri
 rubygems_version: 2.2.2