From 690089bbc9fe0229b6ec64c7a913b02f2b6dec4d Mon Sep 17 00:00:00 2001 From: Daniel Veillard <veillard@redhat.com> Date: Thu, 9 Aug 2012 16:18:51 +0800 Subject: [PATCH] Hardening of code checking node types in various entry point To: libvir-list@redhat.com Followup on CVE-2012-2870 Signed-off-by: Daniel Veillard <veillard@redhat.com> --- libxslt/attributes.c | 5 +++-- libxslt/preproc.c | 45 +++++++++++++++++++++++---------------------- libxslt/templates.c | 15 ++++++++++----- libxslt/transform.c | 2 +- libxslt/variables.c | 10 +++++----- libxslt/xslt.c | 43 +++++++++++++++++++++++++------------------ libxslt/xsltutils.c | 27 +++++++++++++++++++-------- 7 files changed, 86 insertions(+), 61 deletions(-) diff --git a/libxslt/attributes.c b/libxslt/attributes.c index ce47df7..11d558b 100644 --- a/libxslt/attributes.c +++ b/libxslt/attributes.c @@ -293,7 +293,7 @@ xsltParseStylesheetAttributeSet(xsltStylesheetPtr style, xmlNodePtr cur) { xmlNodePtr child; xsltAttrElemPtr attrItems; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; value = xmlGetNsProp(cur, (const xmlChar *)"name", NULL); @@ -656,7 +656,8 @@ xsltAttributeInternal(xsltTransformContextPtr ctxt, xmlNsPtr ns = NULL; xmlAttrPtr attr; - if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL)) + if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) || + (inst->type != XML_ELEMENT_NODE) ) return; /* diff --git a/libxslt/preproc.c b/libxslt/preproc.c index b47d809..0d79976 100644 --- a/libxslt/preproc.c +++ b/libxslt/preproc.c @@ -669,7 +669,7 @@ xsltSortComp(xsltStylesheetPtr style, xmlNodePtr inst) { #else xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -777,7 +777,7 @@ xsltCopyComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED comp = (xsltStyleItemCopyPtr) xsltNewStylePreComp(style, XSLT_FUNC_COPY); @@ -821,7 +821,7 @@ xsltTextComp(xsltStylesheetPtr style, xmlNodePtr inst) { #endif const xmlChar *prop; - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -874,7 +874,7 @@ xsltElementComp(xsltStylesheetPtr style, xmlNodePtr inst) { * <!-- Content: template --> * </xsl:element> */ - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -991,7 +991,7 @@ xsltAttributeComp(xsltStylesheetPtr style, xmlNodePtr inst) { * <!-- Content: template --> * </xsl:attribute> */ - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1111,7 +1111,7 @@ xsltCommentComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1141,7 +1141,7 @@ xsltProcessingInstructionComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1175,7 +1175,7 @@ xsltCopyOfComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1222,7 +1222,7 @@ xsltValueOfComp(xsltStylesheetPtr style, xmlNodePtr inst) { #endif const xmlChar *prop; - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1347,7 +1347,7 @@ xsltWithParamComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1406,7 +1406,7 @@ xsltNumberComp(xsltStylesheetPtr style, xmlNodePtr cur) { #endif const xmlChar *prop; - if ((style == NULL) || (cur == NULL)) + if ((style == NULL) || (cur == NULL) || (cur->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1520,7 +1520,7 @@ xsltApplyImportsComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1550,7 +1550,7 @@ xsltCallTemplateComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1589,7 +1589,7 @@ xsltApplyTemplatesComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1641,7 +1641,7 @@ xsltChooseComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1672,7 +1672,7 @@ xsltIfComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1718,7 +1718,7 @@ xsltWhenComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1764,7 +1764,7 @@ xsltForEachComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1812,7 +1812,7 @@ xsltVariableComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1875,7 +1875,7 @@ xsltParamComp(xsltStylesheetPtr style, xmlNodePtr inst) { xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1967,7 +1967,7 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr node) { * the parsing mechanism for all elements in the XSLT namespace. */ if (style == NULL) { - if (node != NULL) + if ((node != NULL) && (node->type == XML_ELEMENT_NODE)) node->psvi = NULL; return; } @@ -2182,7 +2182,8 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr inst) { * namespace- and local-name of the node, but can evaluate this * using cctxt->style->inode->category; */ - if (inst->psvi != NULL) + if ((inst == NULL) || (inst->type != XML_ELEMENT_NODE) || + (inst->psvi != NULL)) return; if (IS_XSLT_ELEM(inst)) { diff --git a/libxslt/templates.c b/libxslt/templates.c index c6250dc..81de93c 100644 --- a/libxslt/templates.c +++ b/libxslt/templates.c @@ -198,7 +198,8 @@ xsltEvalTemplateString(xsltTransformContextPtr ctxt, xmlNodePtr oldInsert, insert = NULL; xmlChar *ret; - if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL)) + if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) || + (inst->type != XML_ELEMENT_NODE)) return(NULL); if (inst->children == NULL) @@ -380,7 +381,8 @@ xsltEvalAttrValueTemplate(xsltTransformContextPtr ctxt, xmlNodePtr inst, xmlChar *ret; xmlChar *expr; - if ((ctxt == NULL) || (inst == NULL) || (name == NULL)) + if ((ctxt == NULL) || (inst == NULL) || (name == NULL) || + (inst->type != XML_ELEMENT_NODE)) return(NULL); expr = xsltGetNsProp(inst, name, ns); @@ -424,7 +426,8 @@ xsltEvalStaticAttrValueTemplate(xsltStylesheetPtr style, xmlNodePtr inst, const xmlChar *ret; xmlChar *expr; - if ((style == NULL) || (inst == NULL) || (name == NULL)) + if ((style == NULL) || (inst == NULL) || (name == NULL) || + (inst->type != XML_ELEMENT_NODE)) return(NULL); expr = xsltGetNsProp(inst, name, ns); @@ -465,7 +468,8 @@ xsltAttrTemplateProcess(xsltTransformContextPtr ctxt, xmlNodePtr target, const xmlChar *value; xmlAttrPtr ret; - if ((ctxt == NULL) || (attr == NULL) || (target == NULL)) + if ((ctxt == NULL) || (attr == NULL) || (target == NULL) || + (target->type != XML_ELEMENT_NODE)) return(NULL); if (attr->type != XML_ATTRIBUTE_NODE) @@ -622,7 +626,8 @@ xsltAttrListTemplateProcess(xsltTransformContextPtr ctxt, const xmlChar *value; xmlChar *valueAVT; - if ((ctxt == NULL) || (target == NULL) || (attrs == NULL)) + if ((ctxt == NULL) || (target == NULL) || (attrs == NULL) || + (target->type != XML_ELEMENT_NODE)) return(NULL); oldInsert = ctxt->insert; diff --git a/libxslt/transform.c b/libxslt/transform.c index 04d0468..38fbad6 100644 --- a/libxslt/transform.c +++ b/libxslt/transform.c @@ -726,7 +726,7 @@ xsltCopyTextString(xsltTransformContextPtr ctxt, xmlNodePtr target, #endif /* - * Play save and reset the merging mechanism for every new + * Play safe and reset the merging mechanism for every new * target node. */ if ((target == NULL) || (target->children == NULL)) { diff --git a/libxslt/variables.c b/libxslt/variables.c index 43a6156..df207c7 100644 --- a/libxslt/variables.c +++ b/libxslt/variables.c @@ -1926,7 +1926,7 @@ xsltParseStylesheetCallerParam(xsltTransformContextPtr ctxt, xmlNodePtr inst) the instruction itself. */ xsltStackElemPtr param = NULL; - if ((ctxt == NULL) || (inst == NULL)) + if ((ctxt == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return(NULL); #ifdef XSLT_REFACTORED @@ -1985,7 +1985,7 @@ xsltParseGlobalVariable(xsltStylesheetPtr style, xmlNodePtr cur) xsltStylePreCompPtr comp; #endif - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -2047,7 +2047,7 @@ xsltParseGlobalParam(xsltStylesheetPtr style, xmlNodePtr cur) { xsltStylePreCompPtr comp; #endif - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -2110,7 +2110,7 @@ xsltParseStylesheetVariable(xsltTransformContextPtr ctxt, xmlNodePtr inst) xsltStylePreCompPtr comp; #endif - if ((inst == NULL) || (ctxt == NULL)) + if ((inst == NULL) || (ctxt == NULL) || (inst->type != XML_ELEMENT_NODE)) return; comp = inst->psvi; @@ -2152,7 +2152,7 @@ xsltParseStylesheetParam(xsltTransformContextPtr ctxt, xmlNodePtr cur) xsltStylePreCompPtr comp; #endif - if ((cur == NULL) || (ctxt == NULL)) + if ((cur == NULL) || (ctxt == NULL) || (cur->type != XML_ELEMENT_NODE)) return; comp = cur->psvi; diff --git a/libxslt/xslt.c b/libxslt/xslt.c index 28c8c59..07a72c5 100644 --- a/libxslt/xslt.c +++ b/libxslt/xslt.c @@ -1153,9 +1153,9 @@ xsltParseStylesheetOutput(xsltStylesheetPtr style, xmlNodePtr cur) xmlChar *element, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; - + prop = xmlGetNsProp(cur, (const xmlChar *) "version", NULL); if (prop != NULL) { if (style->version != NULL) @@ -1368,12 +1368,12 @@ xsltParseStylesheetDecimalFormat(xsltStylesheetPtr style, xmlNodePtr cur) xmlChar *prop; xsltDecimalFormatPtr format; xsltDecimalFormatPtr iter; - - if ((cur == NULL) || (style == NULL)) + + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; format = style->decimalFormat; - + prop = xmlGetNsProp(cur, BAD_CAST("name"), NULL); if (prop != NULL) { format = xsltDecimalFormatGetByName(style, prop); @@ -1475,7 +1475,7 @@ xsltParseStylesheetPreserveSpace(xsltStylesheetPtr style, xmlNodePtr cur) { xmlChar *elements; xmlChar *element, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL); @@ -1549,7 +1549,7 @@ xsltParseStylesheetExtPrefix(xsltStylesheetPtr style, xmlNodePtr cur, xmlChar *prefixes; xmlChar *prefix, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; if (isXsltElem) { @@ -1614,7 +1614,7 @@ xsltParseStylesheetStripSpace(xsltStylesheetPtr style, xmlNodePtr cur) { xmlChar *elements; xmlChar *element, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL); @@ -1687,7 +1687,7 @@ xsltParseStylesheetExcludePrefix(xsltStylesheetPtr style, xmlNodePtr cur, xmlChar *prefixes; xmlChar *prefix, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return(0); if (isXsltElem) @@ -4278,7 +4278,7 @@ static int xsltParseUnknownXSLTElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node) { - if ((cctxt == NULL) || (node == NULL)) + if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE)) return(-1); /* @@ -4375,7 +4375,7 @@ xsltParseSequenceConstructor(xsltCompilerCtxtPtr cctxt, xmlNodePtr cur) if (cctxt->inode->category == XSLT_ELEMENT_CATEGORY_EXTENSION) { cctxt->inode->extContentHandled = 1; } - if (cur == NULL) + if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL)) return; /* * This is the content reffered to as a "template". @@ -4780,7 +4780,8 @@ xsltParseSequenceConstructor(xsltCompilerCtxtPtr cctxt, xmlNodePtr cur) */ void xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) { - if ((style == NULL) || (templ == NULL)) + if ((style == NULL) || (templ == NULL) || + (templ->type == XML_NAMESPACE_DECL)) return; /* @@ -4829,6 +4830,10 @@ xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) { void xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) { xmlNodePtr cur, delete; + + if ((style == NULL) || (templ == NULL) || + (templ->type == XML_NAMESPACE_DECL)) return; + /* * This content comes from the stylesheet * For stylesheets, the set of whitespace-preserving @@ -5048,7 +5053,7 @@ xsltParseStylesheetKey(xsltStylesheetPtr style, xmlNodePtr key) { xmlChar *name = NULL; xmlChar *nameURI = NULL; - if ((style == NULL) || (key == NULL)) + if ((style == NULL) || (key == NULL) || (key->type != XML_ELEMENT_NODE)) return; /* @@ -5138,7 +5143,8 @@ xsltParseXSLTTemplate(xsltCompilerCtxtPtr cctxt, xmlNodePtr templNode) { xmlChar *prop; double priority; - if ((cctxt == NULL) || (templNode == NULL)) + if ((cctxt == NULL) || (templNode == NULL) || + (templNode->type != XML_ELEMENT_NODE)) return; /* @@ -5299,7 +5305,8 @@ xsltParseStylesheetTemplate(xsltStylesheetPtr style, xmlNodePtr template) { xmlChar *modeURI = NULL; double priority; - if (template == NULL) + if ((style == NULL) || (template == NULL) || + (template->type != XML_ELEMENT_NODE)) return; /* @@ -5431,7 +5438,7 @@ static xsltStyleItemIncludePtr xsltCompileXSLTIncludeElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node) { xsltStyleItemIncludePtr item; - if ((cctxt == NULL) || (node == NULL)) + if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE)) return(NULL); node->psvi = NULL; @@ -5951,7 +5958,7 @@ xsltParseXSLTStylesheetElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node) { xmlNodePtr cur, start; - if ((cctxt == NULL) || (node == NULL)) + if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE)) return(-1); if (node->children == NULL) @@ -6039,7 +6046,7 @@ xsltParseStylesheetTop(xsltStylesheetPtr style, xmlNodePtr top) { int templates = 0; #endif - if (top == NULL) + if ((top == NULL) || (top->type != XML_ELEMENT_NODE)) return; prop = xmlGetNsProp(top, (const xmlChar *)"version", NULL); diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c index 749a768..487f195 100644 --- a/libxslt/xsltutils.c +++ b/libxslt/xsltutils.c @@ -90,10 +90,15 @@ xsltGetCNsProp(xsltStylesheetPtr style, xmlNodePtr node, if ((node == NULL) || (style == NULL) || (style->dict == NULL)) return(NULL); - prop = node->properties; - if (nameSpace == NULL) { + if (nameSpace == NULL) return xmlGetProp(node, name); - } + + if (node->type == XML_NAMESPACE_DECL) + return(NULL); + if (node->type == XML_ELEMENT_NODE) + prop = node->properties; + else + prop = NULL; while (prop != NULL) { /* * One need to have @@ -130,7 +135,7 @@ xsltGetCNsProp(xsltStylesheetPtr style, xmlNodePtr node, attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name); if ((attrDecl == NULL) && (doc->extSubset != NULL)) attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name); - + if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) { /* * The DTD declaration only allows a prefix search @@ -172,7 +177,15 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) { if (node == NULL) return(NULL); - prop = node->properties; + if (nameSpace == NULL) + return xmlGetProp(node, name); + + if (node->type == XML_NAMESPACE_DECL) + return(NULL); + if (node->type == XML_ELEMENT_NODE) + prop = node->properties; + else + prop = NULL; /* * TODO: Substitute xmlGetProp() for xmlGetNsProp(), since the former * is not namespace-aware and will return an attribute with equal @@ -182,8 +195,6 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) { * So this would return "myName" even if an attribute @name * in the XSLT was requested. */ - if (nameSpace == NULL) - return(xmlGetProp(node, name)); while (prop != NULL) { /* * One need to have @@ -216,7 +227,7 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) { attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name); if ((attrDecl == NULL) && (doc->extSubset != NULL)) attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name); - + if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) { /* * The DTD declaration only allows a prefix search -- 1.7.11.4