From 7ca19df892ca22d9314e95d59ce2abdeff46b617 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Thu, 29 Oct 2015 19:33:23 +0800
Subject: [PATCH] Fix for type confusion in preprocessing attributes

CVE-2015-7995 http://www.openwall.com/lists/oss-security/2015/10/27/10
We need to check that the parent node is an element before dereferencing
its namespace
---
 libxslt/preproc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libxslt/preproc.c b/libxslt/preproc.c
index 0eb80a0..7f69325 100644
--- a/libxslt/preproc.c
+++ b/libxslt/preproc.c
@@ -2249,7 +2249,8 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr inst) {
 	} else if (IS_XSLT_NAME(inst, "attribute")) {
 	    xmlNodePtr parent = inst->parent;
 
-	    if ((parent == NULL) || (parent->ns == NULL) ||
+	    if ((parent == NULL) ||
+	        (parent->type != XML_ELEMENT_NODE) || (parent->ns == NULL) ||
 		((parent->ns != inst->ns) &&
 		 (!xmlStrEqual(parent->ns->href, inst->ns->href))) ||
 		(!xmlStrEqual(parent->name, BAD_CAST "attribute-set"))) {
-- 
2.6.3

uix/refs/?id=e921993c25626541385f191f0463cad8e5e5c5c7'>refs</a><a class='active' href='/guix/log/tests/elpa.scm'>log</a><a href='/guix/tree/tests/elpa.scm?id=e921993c25626541385f191f0463cad8e5e5c5c7'>tree</a><a href='/guix/commit/tests/elpa.scm?id=e921993c25626541385f191f0463cad8e5e5c5c7'>commit</a><a href='/guix/diff/tests/elpa.scm?id=e921993c25626541385f191f0463cad8e5e5c5c7'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/tests/elpa.scm'>
<input type='hidden' name='id' value='e921993c25626541385f191f0463cad8e5e5c5c7'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=e921993c25626541385f191f0463cad8e5e5c5c7'>root</a>/<a href='/guix/log/tests?id=e921993c25626541385f191f0463cad8e5e5c5c7'>tests</a>/<a href='/guix/log/tests/elpa.scm?id=e921993c25626541385f191f0463cad8e5e5c5c7'>elpa.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/elpa.scm?id=e921993c25626541385f191f0463cad8e5e5c5c7&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2018-03-18 22:33:41 +0100'>2018-03-18</span></td><td><a href='/guix/commit/tests/elpa.scm?id=17cdd3d0fe1987d0272f2c3496123be1ef772d6b'>tests: elpa: Don't actually download files.</a><span class='msg-avail'>...<span class='msg-tooltip'>* tests/elpa.scm (eval-test-with-elpa): Mock 'url-fetch'.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-03-18 22:25:54 +0100'>2018-03-18</span></td><td><a href='/guix/commit/tests/elpa.scm?id=e5425ed950d06f8e75697b7e8562f71704094453'>import: elpa: Adjust test for HTTPS URLs.</a><span class='msg-avail'>...<span class='msg-tooltip'>This is a followup to 44dd3d579db3aa467e41d0b431029e46cae8e12d.

* tests/elpa.scm (eval-test-with-elpa): Use https.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2016-04-03 14:19:09 +0200'>2016-04-03</span></td><td><a href='/guix/commit/tests/elpa.scm?id=a9edb211e733b8b34e67ec3b4450567e9376986f'>build: Add a Guile custom test driver using SRFI-64.</a><span class='msg-avail'>...<span class='msg-tooltip'>Before that '.log' files for scheme tests were fragmented and not
included in test-suite.log.  This unifies the semantics of SRFI-64 API
with Automake test suite.

* build-aux/test-driver.scm: New file.
* Makefile.am (SCM_LOG_DRIVER, AM_SCM_LOG_DRIVER_FLAGS): New variables.
(SCM_LOG_COMPILER, AM_SCM_LOG_FLAGS): Delete variables.
(AM_TESTS_ENVIRONMENT): Set GUILE_AUTO_COMPILE to 0.
* test-env.in: Silence guix-daemon.
* doc/guix.texi (Running the Test Suite): Describe how to display the
detailed results.  Bug reports require only 'test-suite.log' file.
* tests/base32.scm, tests/build-utils.scm, tests/builders.scm,
tests/challenge.scm, tests/cpan.scm, tests/cpio.scm, tests/cran.scm,
tests/cve.scm, tests/derivations.scm, tests/elpa.scm,
tests/file-systems.scm, tests/gem.scm, tests/gexp.scm,
tests/gnu-maintenance.scm, tests/grafts.scm, tests/graph.scm,
tests/gremlin.scm, tests/hackage.scm, tests/hash.scm,
tests/import-utils.scm, tests/lint.scm, tests/monads.scm, tests/nar.scm,
tests/packages.scm, tests/pk-crypto.scm, tests/pki.scm,
tests/profiles.scm, tests/publish.scm, tests/pypi.scm,
tests/records.scm, tests/scripts-build.scm, tests/scripts.scm,
tests/services.scm, tests/sets.scm, tests/size.scm, tests/snix.scm,
tests/store.scm, tests/substitute.scm, tests/syscalls.scm,
tests/system.scm, tests/ui.scm, tests/union.scm, tests/upstream.scm,
tests/utils.scm: Don't exit at the end of test groups.
* tests/containers.scm: Likewise.  Use 'test-skip' instead of exiting
with error code 77.
</span></span></td><td>Mathieu Lirzin</td></tr>