nokogiri 1.6.2.1 → 1.6.3.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ee984648f9481f1283c2192b4fb8c391c651467f
-  data.tar.gz: 4678ac3a7de1ddb63b8b8f9a47f8e17b03dade98
+  metadata.gz: 3f15d5c4aca361550efa06491baf53fd4b484cc5
+  data.tar.gz: 634abab8e86ba78a409db511cedc11f93df8e4ed
 SHA512:
-  metadata.gz: 1fa29889e10147c3b5eeec6d675ce2e375331b18ef9ff40ed5b3e22322f4a59da197682d2a35811fb1d971f036b7b30940f7c8d51142e5149e614090bcbeda44
-  data.tar.gz: e071cf483354ffd1e90805c448fdcc6abef6bb2888d21714ebd7f81775bd3aaf52763433fa68dad0545376a8f7ba7d0db229d256d9e474a8d4a25b1fe89b493b
+  metadata.gz: e9d3304fba12c81cdc59d2d886e3809eeea99ab7bab3a77ae11e6b829c605193efc2069b43ef14ae996b37251b6793696bfab3fde69a3f225fb4d419da8f5e4d
+  data.tar.gz: f899da3226ae33bd00f1a13ad2e7ebda503bfd24384ca110c7e8d796a669428dd4af2e57b7b7980ff41bc910cfa1238576a08ef469920f1c4d4d072a261e46e4

data/CHANGELOG.ja.rdoc

@@ -1,3 +1,11 @@
+=== 1.6.3 / unreleased
+
+==== Bug fixes
+
+* Fix JRuby memory exhaustion vulnerability. #1087 (Thanks, @ocher!)
+* Fix segfault during GC when using `libxml-ruby` and `nokogiri` together in multi-threaded environment. #895 (Thanks, @ender672!)
+
+
 === 1.6.2.1 / 2014年5月13日
 
 ==== バグ修正

data/CHANGELOG.rdoc

@@ -1,3 +1,11 @@
+=== 1.6.3 / unreleased
+
+==== Bug fixes
+
+* Fix JRuby memory exhaustion vulnerability. #1087 (Thanks, @ocher)
+* Fix segfault during GC when using `libxml-ruby` and `nokogiri` together in multi-threaded environment. #895 (Thanks, @ender672!)
+
+
 === 1.6.2.1 / 2014-05-13
 
 ==== Bug fixes

data/ext/nokogiri/xml_document.c

@@ -17,13 +17,29 @@ static int dealloc_node_i(xmlNodePtr key, xmlNodePtr node, xmlDocPtr doc)
   return ST_CONTINUE;
 }
 
+static void remove_private(xmlNodePtr node)
+{
+  xmlNodePtr child;
+
+  for (child = node->children; child; child = child->next)
+    remove_private(child);
+
+  if ((node->type == XML_ELEMENT_NODE ||
+       node->type == XML_XINCLUDE_START ||
+       node->type == XML_XINCLUDE_END) &&
+      node->properties) {
+    for (child = (xmlNodePtr)node->properties; child; child = child->next)
+      remove_private(child);
+  }
+
+  node->_private = NULL;
+}
+
 static void dealloc(xmlDocPtr doc)
 {
-  xmlDeregisterNodeFunc func;
   st_table *node_hash;
 
   NOKOGIRI_DEBUG_START(doc);
-  func = xmlDeregisterNodeDefault(NULL);
 
   node_hash  = DOC_UNLINKED_NODE_HASH(doc);
 
@@ -31,10 +47,17 @@ static void dealloc(xmlDocPtr doc)
   st_free_table(node_hash);
 
   free(doc->_private);
-  doc->_private = NULL;
+
+  /* When both Nokogiri and libxml-ruby are loaded, make sure that all nodes
+   * have their _private pointers cleared. This is to avoid libxml-ruby's
+   * xmlDeregisterNode callback from accessing VALUE pointers from ruby's GC
+   * free context, which can result in segfaults.
+   */
+  if (xmlDeregisterNodeDefaultValue)
+    remove_private((xmlNodePtr)doc);
+
   xmlFreeDoc(doc);
 
-  xmlDeregisterNodeDefault(func);
   NOKOGIRI_DEBUG_END(doc);
 }
 

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = '1.6.2.1'
+  VERSION = '1.6.3.rc1'
 
   class VersionInfo # :nodoc:
     def jruby?

data/test/xml/test_document.rb

@@ -625,6 +625,12 @@ module Nokogiri
         refute_empty doc.errors
       end
 
+      def test_memory_explosion_on_wrong_formatted_element_following_the_root_element
+        doc = Nokogiri::XML("<a/><\n")
+        refute_nil doc
+        refute_empty doc.errors
+      end
+
       def test_document_has_errors
         doc = Nokogiri::XML(<<-eoxml)
           <foo><bar></foo>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.6.2.1
+  version: 1.6.3.rc1
 platform: ruby
 authors:
 - Aaron Patterson
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-05-14 00:00:00.000000000 Z
+date: 2014-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile
@@ -548,9 +548,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.2
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - '>'
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: nokogiri
 rubygems_version: 2.2.2