nokogiri 1.6.7.2 → 1.6.8.rc1

data/patches/libxml2/0010-Fix-parsering-short-unclosed-comment-uninitialized-access.patch

@@ -1,64 +0,0 @@
-From e724879d964d774df9b7969fc846605aa1bac54c Mon Sep 17 00:00:00 2001
-From: Daniel Veillard <veillard@redhat.com>
-Date: Fri, 30 Oct 2015 21:14:55 +0800
-Subject: Fix parsing short unclosed comment uninitialized access
-
-For https://bugzilla.gnome.org/show_bug.cgi?id=746048
-The HTML parser was too optimistic when processing comments and
-didn't check for the end of the stream on the first 2 characters
----
- HTMLparser.c | 21 ++++++++++++++-------
- 1 file changed, 14 insertions(+), 7 deletions(-)
-
-diff --git a/HTMLparser.c b/HTMLparser.c
-index 19c10c3..bdf7807 100644
---- a/HTMLparser.c
-+++ b/HTMLparser.c
-@@ -3264,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
- 	ctxt->instate = state;
- 	return;
-     }
-+    len = 0;
-+    buf[len] = 0;
-     q = CUR_CHAR(ql);
-+    if (!IS_CHAR(q))
-+        goto unfinished;
-     NEXTL(ql);
-     r = CUR_CHAR(rl);
-+    if (!IS_CHAR(r))
-+        goto unfinished;
-     NEXTL(rl);
-     cur = CUR_CHAR(l);
--    len = 0;
-     while (IS_CHAR(cur) &&
-            ((cur != '>') ||
- 	    (r != '-') || (q != '-'))) {
-@@ -3300,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
- 	}
-     }
-     buf[len] = 0;
--    if (!IS_CHAR(cur)) {
--	htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
--	             "Comment not terminated \n<!--%.50s\n", buf, NULL);
--	xmlFree(buf);
--    } else {
-+    if (IS_CHAR(cur)) {
-         NEXT;
- 	if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
- 	    (!ctxt->disableSAX))
- 	    ctxt->sax->comment(ctxt->userData, buf);
- 	xmlFree(buf);
-+	ctxt->instate = state;
-+	return;
-     }
--    ctxt->instate = state;
-+
-+unfinished:
-+    htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-+		 "Comment not terminated \n<!--%.50s\n", buf, NULL);
-+    xmlFree(buf);
- }
- 
- /**
--- 
-cgit v0.11.2

data/patches/libxml2/0011-Avoid-extra-processing-of-MarkupDecl-when-EOF.patch

@@ -1,35 +0,0 @@
-From b57e4be41ab56653d45ce212cacf4640b55dd589 Mon Sep 17 00:00:00 2001
-From: Hugh Davenport <hugh@allthethings.co.nz>
-Date: Tue, 3 Nov 2015 20:40:49 +0800
-Subject: [PATCH 11/18] Avoid extra processing of MarkupDecl when EOF
-
-For https://bugzilla.gnome.org/show_bug.cgi?id=756263
-
-One place where ctxt->instate == XML_PARSER_EOF whic was set up
-by entity detection issues doesn't get noticed, and even overrided
----
- parser.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/parser.c b/parser.c
-index d67b300..134afe7 100644
---- a/parser.c
-+++ b/parser.c
-@@ -6972,6 +6972,14 @@ xmlParseMarkupDecl(xmlParserCtxtPtr ctxt) {
- 	    xmlParsePI(ctxt);
- 	}
-     }
-+
-+    /*
-+     * detect requirement to exit there and act accordingly
-+     * and avoid having instate overriden later on
-+     */
-+    if (ctxt->instate == XML_PARSER_EOF)
-+        return;
-+
-     /*
-      * This is only for internal subset. On external entities,
-      * the replacement is done before parsing stage
--- 
-2.5.0
-

data/patches/libxml2/0012-Avoid-processing-entities-after-encoding-conversion-.patch

@@ -1,83 +0,0 @@
-From 17e50819d6c5b2596ec54f2ae910b7403f29e976 Mon Sep 17 00:00:00 2001
-From: Daniel Veillard <veillard@redhat.com>
-Date: Mon, 9 Nov 2015 18:07:18 +0800
-Subject: [PATCH 12/18] Avoid processing entities after encoding conversion
- failures
-
-For https://bugzilla.gnome.org/show_bug.cgi?id=756527
-and was also raised by Chromium team in the past
-
-When we hit a convwersion failure when switching encoding
-it is bestter to stop parsing there, this was treated as a
-fatal error but the parser was continuing to process to extract
-more errors, unfortunately that makes little sense as the data
-is obviously corrupt and can potentially lead to unexpected behaviour.
----
- parser.c          |  7 +++++--
- parserInternals.c | 11 ++++++++++-
- 2 files changed, 15 insertions(+), 3 deletions(-)
-
-diff --git a/parser.c b/parser.c
-index 134afe7..c79b4e8 100644
---- a/parser.c
-+++ b/parser.c
-@@ -10665,7 +10665,8 @@ xmlParseXMLDecl(xmlParserCtxtPtr ctxt) {
- 	xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, "Blank needed here\n");
-     }
-     xmlParseEncodingDecl(ctxt);
--    if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
-+    if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
-+         (ctxt->instate == XML_PARSER_EOF)) {
- 	/*
- 	 * The XML REC instructs us to stop parsing right here
- 	 */
-@@ -10789,6 +10790,7 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
- 
-     if (CUR == 0) {
- 	xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-+	return(-1);
-     }
- 
-     /*
-@@ -10806,7 +10808,8 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
- 	 * Note that we will switch encoding on the fly.
- 	 */
- 	xmlParseXMLDecl(ctxt);
--	if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
-+	if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
-+	    (ctxt->instate == XML_PARSER_EOF)) {
- 	    /*
- 	     * The XML REC instructs us to stop parsing right here
- 	     */
-diff --git a/parserInternals.c b/parserInternals.c
-index df204fd..c8230c1 100644
---- a/parserInternals.c
-+++ b/parserInternals.c
-@@ -937,6 +937,7 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
- {
-     xmlCharEncodingHandlerPtr handler;
-     int len = -1;
-+    int ret;
- 
-     if (ctxt == NULL) return(-1);
-     switch (enc) {
-@@ -1097,7 +1098,15 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
-     if (handler == NULL)
- 	return(-1);
-     ctxt->charset = XML_CHAR_ENCODING_UTF8;
--    return(xmlSwitchToEncodingInt(ctxt, handler, len));
-+    ret = xmlSwitchToEncodingInt(ctxt, handler, len);
-+    if ((ret < 0) || (ctxt->errNo == XML_I18N_CONV_FAILED)) {
-+        /*
-+	 * on encoding conversion errors, stop the parser
-+	 */
-+        xmlStopParser(ctxt);
-+	ctxt->errNo = XML_I18N_CONV_FAILED;
-+    }
-+    return(ret);
- }
- 
- /**
--- 
-2.5.0
-

data/patches/libxml2/0013-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch

@@ -1,33 +0,0 @@
-From 71ff91d66ecae4145a7c99476d1a0d1fa620b9f7 Mon Sep 17 00:00:00 2001
-From: David Drysdale <drysdale@google.com>
-Date: Fri, 20 Nov 2015 10:47:12 +0800
-Subject: [PATCH 13/18] CVE-2015-7497 Avoid an heap buffer overflow in
- xmlDictComputeFastQKey
-
-For https://bugzilla.gnome.org/show_bug.cgi?id=756528
-It was possible to hit a negative offset in the name indexing
-used to randomize the dictionary key generation
-Reported and fix provided by David Drysdale @ Google
----
- dict.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/dict.c b/dict.c
-index 5f71d55..8c8f931 100644
---- a/dict.c
-+++ b/dict.c
-@@ -486,7 +486,10 @@ xmlDictComputeFastQKey(const xmlChar *prefix, int plen,
- 	value += 30 * (*prefix);
- 
-     if (len > 10) {
--        value += name[len - (plen + 1 + 1)];
-+        int offset = len - (plen + 1 + 1);
-+	if (offset < 0)
-+	    offset = len - (10 + 1);
-+	value += name[offset];
-         len = 10;
- 	if (plen > 10)
- 	    plen = 10;
--- 
-2.5.0
-

data/patches/libxml2/0014-CVE-2015-5312-Another-entity-expansion-issue.patch

@@ -1,32 +0,0 @@
-From d50faeefb87856fb19aee2029e952ea095300d90 Mon Sep 17 00:00:00 2001
-From: David Drysdale <drysdale@google.com>
-Date: Fri, 20 Nov 2015 11:13:45 +0800
-Subject: [PATCH 14/18] CVE-2015-5312 Another entity expansion issue
-
-For https://bugzilla.gnome.org/show_bug.cgi?id=756733
-It is one case where the code in place to detect entities expansions
-failed to exit when the situation was detected, leading to DoS
-Problem reported by Kostya Serebryany @ Google
-Patch provided by David Drysdale @ Google
----
- parser.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/parser.c b/parser.c
-index c79b4e8..4054ed1 100644
---- a/parser.c
-+++ b/parser.c
-@@ -2806,6 +2806,10 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 			                      0, 0, 0);
- 		ctxt->depth--;
- 
-+		if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
-+		    (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
-+		    goto int_error;
-+
- 		if (rep != NULL) {
- 		    current = rep;
- 		    while (*current != 0) { /* non input consuming loop */
--- 
-2.5.0
-

data/patches/libxml2/0015-Add-xmlHaltParser-to-stop-the-parser.patch

@@ -1,81 +0,0 @@
-From 88c307f3f7b4767018b57e91cb07b78b43d98230 Mon Sep 17 00:00:00 2001
-From: Daniel Veillard <veillard@redhat.com>
-Date: Fri, 20 Nov 2015 14:55:30 +0800
-Subject: [PATCH 15/18] Add xmlHaltParser() to stop the parser
-
-The problem is doing it in a consistent and safe fashion
-It's more complex than just setting ctxt->instate = XML_PARSER_EOF
-Update the public function to reuse that new internal routine
----
- parser.c | 34 +++++++++++++++++++++++++++++-----
- 1 file changed, 29 insertions(+), 5 deletions(-)
-
-diff --git a/parser.c b/parser.c
-index 4054ed1..0b8282b 100644
---- a/parser.c
-+++ b/parser.c
-@@ -94,6 +94,8 @@ static xmlParserCtxtPtr
- xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
- 	                  const xmlChar *base, xmlParserCtxtPtr pctx);
- 
-+static void xmlHaltParser(xmlParserCtxtPtr ctxt);
-+
- /************************************************************************
-  *									*
-  *	Arbitrary limits set in the parser. See XML_PARSE_HUGE		*
-@@ -12622,25 +12624,47 @@ xmlCreatePushParserCtxt(xmlSAXHandlerPtr sax, void *user_data,
- #endif /* LIBXML_PUSH_ENABLED */
- 
- /**
-- * xmlStopParser:
-+ * xmlHaltParser:
-  * @ctxt:  an XML parser context
-  *
-- * Blocks further parser processing
-+ * Blocks further parser processing don't override error
-+ * for internal use
-  */
--void
--xmlStopParser(xmlParserCtxtPtr ctxt) {
-+static void
-+xmlHaltParser(xmlParserCtxtPtr ctxt) {
-     if (ctxt == NULL)
-         return;
-     ctxt->instate = XML_PARSER_EOF;
--    ctxt->errNo = XML_ERR_USER_STOP;
-     ctxt->disableSAX = 1;
-     if (ctxt->input != NULL) {
-+        /*
-+	 * in case there was a specific allocation deallocate before
-+	 * overriding base
-+	 */
-+        if (ctxt->input->free != NULL) {
-+	    ctxt->input->free((xmlChar *) ctxt->input->base);
-+	    ctxt->input->free = NULL;
-+	}
- 	ctxt->input->cur = BAD_CAST"";
- 	ctxt->input->base = ctxt->input->cur;
-     }
- }
- 
- /**
-+ * xmlStopParser:
-+ * @ctxt:  an XML parser context
-+ *
-+ * Blocks further parser processing
-+ */
-+void
-+xmlStopParser(xmlParserCtxtPtr ctxt) {
-+    if (ctxt == NULL)
-+        return;
-+    xmlHaltParser(ctxt);
-+    ctxt->errNo = XML_ERR_USER_STOP;
-+}
-+
-+/**
-  * xmlCreateIOParserCtxt:
-  * @sax:  a SAX handler
-  * @user_data:  The user data returned on SAX callbacks
--- 
-2.5.0
-

data/patches/libxml2/0016-Detect-incoherency-on-GROW.patch

@@ -1,36 +0,0 @@
-From 770bbd3016efa2ed73516136d8fed5faf849cbfc Mon Sep 17 00:00:00 2001
-From: Daniel Veillard <veillard@redhat.com>
-Date: Fri, 20 Nov 2015 15:04:09 +0800
-Subject: [PATCH 16/18] Detect incoherency on GROW
-
-the current pointer to the input has to be between the base and end
-if not stop everything we have an internal state error.
----
- parser.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/parser.c b/parser.c
-index 0b8282b..aef618f 100644
---- a/parser.c
-+++ b/parser.c
-@@ -2075,9 +2075,16 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
-          ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
-         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
-         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
--        ctxt->instate = XML_PARSER_EOF;
-+        xmlHaltParser(ctxt);
-+	return;
-     }
-     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
-+    if ((ctxt->input->cur > ctxt->input->end) ||
-+        (ctxt->input->cur < ctxt->input->base)) {
-+        xmlHaltParser(ctxt);
-+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
-+	return;
-+    }
-     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
-         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
- 	    xmlPopInput(ctxt);
--- 
-2.5.0
-

data/patches/libxml2/0017-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch

@@ -1,105 +0,0 @@
-From d6fea24a7fa952a9d9d919431ba355f684d683ba Mon Sep 17 00:00:00 2001
-From: Daniel Veillard <veillard@redhat.com>
-Date: Fri, 20 Nov 2015 16:06:59 +0800
-Subject: [PATCH 17/18] CVE-2015-7500 Fix memory access error due to incorrect
- entities boundaries
-
-For https://bugzilla.gnome.org/show_bug.cgi?id=756525
-handle properly the case where we popped out of the current entity
-while processing a start tag
-Reported by Kostya Serebryany @ Google
-
-This slightly modifies the output of 754946 in regression tests
----
- parser.c                     | 28 ++++++++++++++++++++++------
- result/errors/754946.xml.err |  7 +++++--
- 2 files changed, 27 insertions(+), 8 deletions(-)
-
-diff --git a/parser.c b/parser.c
-index aef618f..f3c3117 100644
---- a/parser.c
-+++ b/parser.c
-@@ -9346,7 +9346,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
-     const xmlChar **atts = ctxt->atts;
-     int maxatts = ctxt->maxatts;
-     int nratts, nbatts, nbdef;
--    int i, j, nbNs, attval, oldline, oldcol;
-+    int i, j, nbNs, attval, oldline, oldcol, inputNr;
-     const xmlChar *base;
-     unsigned long cur;
-     int nsNr = ctxt->nsNr;
-@@ -9365,6 +9365,7 @@ reparse:
-     SHRINK;
-     base = ctxt->input->base;
-     cur = ctxt->input->cur - ctxt->input->base;
-+    inputNr = ctxt->inputNr;
-     oldline = ctxt->input->line;
-     oldcol = ctxt->input->col;
-     nbatts = 0;
-@@ -9390,7 +9391,8 @@ reparse:
-      */
-     SKIP_BLANKS;
-     GROW;
--    if (ctxt->input->base != base) goto base_changed;
-+    if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
-+        goto base_changed;
- 
-     while (((RAW != '>') &&
- 	   ((RAW != '/') || (NXT(1) != '>')) &&
-@@ -9401,7 +9403,7 @@ reparse:
- 
- 	attname = xmlParseAttribute2(ctxt, prefix, localname,
- 	                             &aprefix, &attvalue, &len, &alloc);
--	if (ctxt->input->base != base) {
-+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
- 	    if ((attvalue != NULL) && (alloc != 0))
- 	        xmlFree(attvalue);
- 	    attvalue = NULL;
-@@ -9550,7 +9552,8 @@ skip_ns:
- 		    break;
- 		}
- 		SKIP_BLANKS;
--		if (ctxt->input->base != base) goto base_changed;
-+		if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
-+		    goto base_changed;
- 		continue;
- 	    }
- 
-@@ -9587,7 +9590,8 @@ failed:
- 	GROW
-         if (ctxt->instate == XML_PARSER_EOF)
-             break;
--	if (ctxt->input->base != base) goto base_changed;
-+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
-+	    goto base_changed;
- 	if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
- 	    break;
- 	if (!IS_BLANK_CH(RAW)) {
-@@ -9603,7 +9607,8 @@ failed:
- 	    break;
- 	}
-         GROW;
--	if (ctxt->input->base != base) goto base_changed;
-+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
-+	    goto base_changed;
-     }
- 
-     /*
-@@ -9770,6 +9775,17 @@ base_changed:
- 	    if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
- 	        xmlFree((xmlChar *) atts[i]);
-     }
-+
-+    /*
-+     * We can't switch from one entity to another in the middle
-+     * of a start tag
-+     */
-+    if (inputNr != ctxt->inputNr) {
-+        xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
-+		    "Start tag doesn't start and stop in the same entity\n");
-+	return(NULL);
-+    }
-+
-     ctxt->input->cur = ctxt->input->base + cur;
-     ctxt->input->line = oldline;
-     ctxt->input->col = oldcol;