From 6273df6c6d84b6be8a62a62abf1d9b79cc2035f8 Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer Date: Tue, 30 May 2023 12:30:27 +0200 Subject: [PATCH] xpath: Ignore entity ref nodes when computing node hash XPath queries only work reliably if entities are substituted. Nevertheless, it's possible to query a document with entity reference nodes. xmllint even deletes entities when the `--dropdtd` option is passed, resulting in dangling pointers, so it's best to skip entity reference nodes to avoid a use-after-free. Fixes #550. Reference:https://github.com/GNOME/libxml2/commit/6273df6c6d84b6be8a62a62abf1d9b79cc2035f8 Conflict:NA --- xpath.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/xpath.c b/xpath.c index 3d1ca71..3128efb 100644 --- a/xpath.c +++ b/xpath.c @@ -6396,11 +6396,12 @@ xmlXPathNodeValHash(xmlNodePtr node) { /* * Skip to next node */ - if ((tmp->children != NULL) && (tmp->type != XML_DTD_NODE)) { - if (tmp->children->type != XML_ENTITY_DECL) { - tmp = tmp->children; - continue; - } + if ((tmp->children != NULL) && + (tmp->type != XML_DTD_NODE) && + (tmp->type != XML_ENTITY_REF_NODE) && + (tmp->children->type != XML_ENTITY_DECL)) { + tmp = tmp->children; + continue; } if (tmp == node) break; -- 2.27.0