Merge commit 'de918d45e1b2276a28a4cd32bcf556bef65284e4'

Sibras · Sibras · commit d8778a4821ed · 2025-06-14T19:23:17.000+10:00
diff --git a/NEWS b/NEWS
@@ -1,5 +1,21 @@
 NEWS file for libxml2
 
+v2.13.5: Nov 12 2024
+
+### Regressions
+
+- xmlIO: Fix reading from non-regular files like pipes (Nick Wellnhofer)
+- xmlreader: Fix return value of xmlTextReaderReadString (Nick Wellnhofer)
+- parser: Fix loading of parameter entities in external DTDs (Nick Wellnhofer)
+- parser: Fix downstream code that swaps DTDs (Nick Wellnhofer)
+- parser: Fix detection of duplicate attributes (Nick Wellnhofer)
+- string: Fix va_copy fallback (Nick Wellnhofer)
+
+### Bug fixes
+
+- xpath: Fix parsing of non-ASCII names (Nick Wellnhofer)
+
+
 v2.13.4: Sep 18 2024
 
 ### Regressions
diff --git a/configure.ac b/configure.ac
@@ -3,7 +3,7 @@ AC_PREREQ([2.63])
 
 m4_define([MAJOR_VERSION], 2)
 m4_define([MINOR_VERSION], 13)
-m4_define([MICRO_VERSION], 4)
+m4_define([MICRO_VERSION], 5)
 
 AC_INIT([libxml2],[MAJOR_VERSION.MINOR_VERSION.MICRO_VERSION])
 AC_CONFIG_SRCDIR([entities.c])
diff --git a/meson.build b/meson.build
@@ -1,7 +1,7 @@
 project(
     'libxml2',
     'c',
-    version: '2.13.4',
+    version: '2.13.5',
     license: 'MIT',
     default_options: ['buildtype=debug', 'warning_level=3'],
     meson_version: '>= 0.61',
diff --git a/parser.c b/parser.c
@@ -8912,6 +8912,35 @@ xmlAttrHashInsert(xmlParserCtxtPtr ctxt, unsigned size, const xmlChar *name,
     return(INT_MAX);
 }
 
+static int
+xmlAttrHashInsertQName(xmlParserCtxtPtr ctxt, unsigned size,
+                       const xmlChar *name, const xmlChar *prefix,
+                       unsigned hashValue, int aindex) {
+    xmlAttrHashBucket *table = ctxt->attrHash;
+    xmlAttrHashBucket *bucket;
+    unsigned hindex;
+
+    hindex = hashValue & (size - 1);
+    bucket = &table[hindex];
+
+    while (bucket->index >= 0) {
+        const xmlChar **atts = &ctxt->atts[bucket->index];
+
+        if ((name == atts[0]) && (prefix == atts[1]))
+            return(bucket->index);
+
+        hindex++;
+        bucket++;
+        if (hindex >= size) {
+            hindex = 0;
+            bucket = table;
+        }
+    }
+
+    bucket->index = aindex;
+
+    return(INT_MAX);
+}
 /**
  * xmlParseStartTag2:
  * @ctxt:  an XML parser context
@@ -8960,6 +8989,8 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
     int nratts, nbatts, nbdef;
     int i, j, nbNs, nbTotalDef, attval, nsIndex, maxAtts;
     int alloc = 0;
+    int numNsErr = 0;
+    int numDupErr = 0;
 
     if (RAW != '<') return(NULL);
     NEXT1;
@@ -9338,10 +9369,12 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
             if (res < INT_MAX) {
                 if (aprefix == atts[res+1]) {
                     xmlErrAttributeDup(ctxt, aprefix, attname);
+                    numDupErr += 1;
                 } else {
                     xmlNsErr(ctxt, XML_NS_ERR_ATTRIBUTE_REDEFINED,
                              "Namespaced Attribute %s in '%s' redefined\n",
                              attname, nsuri, NULL);
+                    numNsErr += 1;
                 }
             }
         }
@@ -9440,6 +9473,43 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
 	}
     }
 
+    /*
+     * Using a single hash table for nsUri/localName pairs cannot
+     * detect duplicate QNames reliably. The following example will
+     * only result in two namespace errors.
+     *
+     * <doc xmlns:a="a" xmlns:b="a">
+     *   <elem a:a="" b:a="" b:a=""/>
+     * </doc>
+     *
+     * If we saw more than one namespace error but no duplicate QNames
+     * were found, we have to scan for duplicate QNames.
+     */
+    if ((numDupErr == 0) && (numNsErr > 1)) {
+        memset(ctxt->attrHash, -1,
+               attrHashSize * sizeof(ctxt->attrHash[0]));
+
+        for (i = 0, j = 0; j < nratts; i += 5, j++) {
+            unsigned hashValue, nameHashValue, prefixHashValue;
+            int res;
+
+            aprefix = atts[i+1];
+            if (aprefix == NULL)
+                continue;
+
+            attname = atts[i];
+            /* Hash values always have bit 31 set, see dict.c */
+            nameHashValue = ctxt->attallocs[j] | 0x80000000;
+            prefixHashValue = xmlDictComputeHash(ctxt->dict, aprefix);
+
+            hashValue = xmlDictCombineHash(nameHashValue, prefixHashValue);
+            res = xmlAttrHashInsertQName(ctxt, attrHashSize, attname,
+                                         aprefix, hashValue, i);
+            if (res < INT_MAX)
+                xmlErrAttributeDup(ctxt, aprefix, attname);
+        }
+    }
+
     /*
      * Reconstruct attribute pointers
      */
@@ -11763,6 +11833,7 @@ xmlIOParseDTD(xmlSAXHandlerPtr sax, xmlParserInputBufferPtr input,
         xmlFreeParserInputBuffer(input);
 	return(NULL);
     }
+    xmlCtxtSetOptions(ctxt, XML_PARSE_DTDLOAD);
 
     /*
      * generate a parser input from the I/O handler
@@ -11852,6 +11923,7 @@ xmlSAXParseDTD(xmlSAXHandlerPtr sax, const xmlChar *ExternalID,
     if (ctxt == NULL) {
 	return(NULL);
     }
+    xmlCtxtSetOptions(ctxt, XML_PARSE_DTDLOAD);
 
     /*
      * Canonicalise the system ID
@@ -12143,6 +12215,15 @@ xmlCtxtParseEntity(xmlParserCtxtPtr ctxt, xmlEntityPtr ent) {
 
         while (list != NULL) {
             list->parent = (xmlNodePtr) ent;
+
+            /*
+             * Downstream code like the nginx xslt module can set
+             * ctxt->myDoc->extSubset to a separate DTD, so the entity
+             * might have a different or a NULL document.
+             */
+            if (list->doc != ent->doc)
+                xmlSetTreeDoc(list, ent->doc);
+
             if (list->next == NULL)
                 ent->last = list;
             list = list->next;
diff --git a/result/XPath/tests/unicodesimple b/result/XPath/tests/unicodesimple
@@ -0,0 +1,6 @@
+
+========================
+Expression: /文書
+Object is a Node Set :
+Set contains 1 nodes:
+1  ELEMENT #E6#96#87#E6#9B#B8
diff --git a/result/errors/dup-xml-attr2.xml.ent b/result/errors/dup-xml-attr2.xml.ent
@@ -0,0 +1,9 @@
+./test/errors/dup-xml-attr2.xml:2: namespace error : Namespaced Attribute a in 'urn:a' redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
+./test/errors/dup-xml-attr2.xml:2: namespace error : Namespaced Attribute a in 'urn:a' redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
+./test/errors/dup-xml-attr2.xml:2: parser error : Attribute b:a redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
diff --git a/result/errors/dup-xml-attr2.xml.err b/result/errors/dup-xml-attr2.xml.err
@@ -0,0 +1,9 @@
+./test/errors/dup-xml-attr2.xml:2: namespace error : Namespaced Attribute a in 'urn:a' redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
+./test/errors/dup-xml-attr2.xml:2: namespace error : Namespaced Attribute a in 'urn:a' redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
+./test/errors/dup-xml-attr2.xml:2: parser error : Attribute b:a redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
diff --git a/result/errors/dup-xml-attr2.xml.str b/result/errors/dup-xml-attr2.xml.str
@@ -0,0 +1,10 @@
+./test/errors/dup-xml-attr2.xml:2: namespace error : Namespaced Attribute a in 'urn:a' redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
+./test/errors/dup-xml-attr2.xml:2: namespace error : Namespaced Attribute a in 'urn:a' redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
+./test/errors/dup-xml-attr2.xml:2: parser error : Attribute b:a redefined
+    <elem a:a="" b:a="" b:a=""/>
+                              ^
+./test/errors/dup-xml-attr2.xml : failed to parse
diff --git a/test/XPath/docs/unicode b/test/XPath/docs/unicode
@@ -0,0 +1 @@
+<文書>text1</文書>
diff --git a/test/XPath/tests/unicodesimple b/test/XPath/tests/unicodesimple
@@ -0,0 +1 @@
+/文書
diff --git a/test/errors/dup-xml-attr2.xml b/test/errors/dup-xml-attr2.xml
@@ -0,0 +1,3 @@
+<doc xmlns:a="urn:a" xmlns:b="urn:a">
+    <elem a:a="" b:a="" b:a=""/>
+</doc>
diff --git a/testparser.c b/testparser.c
@@ -125,6 +125,57 @@ testCFileIO(void) {
     return err;
 }
 
+#ifdef LIBXML_VALID_ENABLED
+static void
+testSwitchDtdExtSubset(void *vctxt, const xmlChar *name ATTRIBUTE_UNUSED,
+                       const xmlChar *externalId ATTRIBUTE_UNUSED,
+                       const xmlChar *systemId ATTRIBUTE_UNUSED) {
+    xmlParserCtxtPtr ctxt = vctxt;
+
+    ctxt->myDoc->extSubset = ctxt->_private;
+}
+
+static int
+testSwitchDtd(void) {
+    const char dtdContent[] =
+        "<!ENTITY test '<elem1/><elem2/>'>\n";
+    const char docContent[] =
+        "<!DOCTYPE doc SYSTEM 'entities.dtd'>\n"
+        "<doc>&test;</doc>\n";
+    xmlParserInputBufferPtr input;
+    xmlParserCtxtPtr ctxt;
+    xmlDtdPtr dtd;
+    xmlDocPtr doc;
+    xmlEntityPtr ent;
+    int err = 0;
+
+    input = xmlParserInputBufferCreateStatic(dtdContent,
+                                             sizeof(dtdContent) - 1,
+                                             XML_CHAR_ENCODING_NONE);
+    dtd = xmlIOParseDTD(NULL, input, XML_CHAR_ENCODING_NONE);
+
+    ctxt = xmlNewParserCtxt();
+    ctxt->_private = dtd;
+    ctxt->sax->externalSubset = testSwitchDtdExtSubset;
+    doc = xmlCtxtReadMemory(ctxt, docContent, sizeof(docContent) - 1, NULL,
+                            NULL, XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
+    xmlFreeParserCtxt(ctxt);
+
+    ent = xmlGetDocEntity(doc, BAD_CAST "test");
+    if (ent->children->doc != NULL) {
+        fprintf(stderr, "Entity content should have NULL doc\n");
+        err = 1;
+    }
+
+    /* Free doc before DTD */
+    doc->extSubset = NULL;
+    xmlFreeDoc(doc);
+    xmlFreeDtd(dtd);
+
+    return err;
+}
+#endif /* LIBXML_VALID_ENABLED */
+
 #ifdef LIBXML_SAX1_ENABLED
 static int
 testBalancedChunk(void) {
@@ -571,6 +622,9 @@ main(void) {
     err |= testUnsupportedEncoding();
     err |= testNodeGetContent();
     err |= testCFileIO();
+#ifdef LIBXML_VALID_ENABLED
+    err |= testSwitchDtd();
+#endif
 #ifdef LIBXML_SAX1_ENABLED
     err |= testBalancedChunk();
 #endif
diff --git a/xmlIO.c b/xmlIO.c
@@ -1210,7 +1210,13 @@ xmlInputDefaultOpen(xmlParserInputBufferPtr buf, const char *filename) {
         if (xzStream == NULL) {
             close(fd);
         } else {
-            if (__libxml2_xzcompressed(xzStream) > 0) {
+            /*
+             * Non-regular files like pipes can't be reopened.
+             * If a file isn't seekable, we pipe uncompressed
+             * input through xzlib.
+             */
+            if ((lseek(fd, 0, SEEK_CUR) < 0) ||
+                (__libxml2_xzcompressed(xzStream) > 0)) {
                 buf->context = xzStream;
                 buf->readcallback = xmlXzfileRead;
                 buf->closecallback = xmlXzfileClose;
@@ -1237,12 +1243,13 @@ xmlInputDefaultOpen(xmlParserInputBufferPtr buf, const char *filename) {
         if (gzStream == NULL) {
             close(fd);
         } else {
-            char buff4[4];
-
-            if ((gzread(gzStream, buff4, 4) > 0) &&
+            /*
+             * Non-regular files like pipes can't be reopened.
+             * If a file isn't seekable, we pipe uncompressed
+             * input through zlib.
+             */
+            if ((lseek(fd, 0, SEEK_CUR) < 0) ||
                 (gzdirect(gzStream) == 0)) {
-                gzrewind(gzStream);
-
                 buf->context = gzStream;
                 buf->readcallback = xmlGzfileRead;
                 buf->closecallback = xmlGzfileClose;
diff --git a/xmlreader.c b/xmlreader.c
@@ -58,7 +58,7 @@
   #ifdef __va_copy
     #define va_copy(dest, src) __va_copy(dest, src)
   #else
-    #define va_copy(dest, src) memcpy(dest, src, sizeof(va_list))
+    #define va_copy(dest, src) memcpy(&(dest), &(src), sizeof(va_list))
   #endif
 #endif
 
@@ -1750,7 +1750,8 @@ xmlTextReaderReadString(xmlTextReaderPtr reader)
         case XML_CDATA_SECTION_NODE:
             break;
         case XML_ELEMENT_NODE:
-            if (xmlTextReaderDoExpand(reader) == -1)
+            if ((xmlTextReaderDoExpand(reader) == -1) ||
+                (node->children == NULL))
                 return(NULL);
             break;
         case XML_ATTRIBUTE_NODE:
diff --git a/xmlstring.c b/xmlstring.c
@@ -30,7 +30,7 @@
   #ifdef __va_copy
     #define va_copy(dest, src) __va_copy(dest, src)
   #else
-    #define va_copy(dest, src) memcpy(dest, src, sizeof(va_list))
+    #define va_copy(dest, src) memcpy(&(dest), &(src), sizeof(va_list))
   #endif
 #endif
 
diff --git a/xmlwriter.c b/xmlwriter.c
@@ -36,7 +36,7 @@
   #ifdef __va_copy
     #define va_copy(dest, src) __va_copy(dest, src)
   #else
-    #define va_copy(dest, src) memcpy(dest, src, sizeof(va_list))
+    #define va_copy(dest, src) memcpy(&(dest), &(src), sizeof(va_list))
   #endif
 #endif
 
diff --git a/xpath.c b/xpath.c
@@ -10434,8 +10434,9 @@ xmlXPathCompLocationPath(xmlXPathParserContextPtr ctxt) {
 	    } else if (CUR == '/') {
 		NEXT;
 		SKIP_BLANKS;
-		if ((CUR != 0 ) &&
-		    ((IS_ASCII_LETTER(CUR)) || (CUR == '_') || (CUR == '.') ||
+		if ((CUR != 0) &&
+		    ((IS_ASCII_LETTER(CUR)) || (CUR >= 0x80) ||
+                     (CUR == '_') || (CUR == '.') ||
 		     (CUR == '@') || (CUR == '*')))
 		    xmlXPathCompRelativeLocationPath(ctxt);
 	    }
