commit 1098c30a040e72a4654968547f415be4e4c40fe7
author Nick Wellnhofer <wellnhofer@aevum.de> Thu Apr 22 19:26:28 2021 +0200
committer Nick Wellnhofer <wellnhofer@aevum.de> Thu Apr 22 19:44:26 2021 +0200
tree 2655a5f002cc161778be10f095e705e6fe144333
parent 72b3c067cedbb80dbbac755cca79ff502c858ad5

Fix user-after-free with `xmllint --xinclude --dropdtd`

The --dropdtd option can leave dangling pointers in entity reference
nodes. Make sure to skip these nodes when processing XIncludes.

This also avoids scanning entity declarations and even modifying
them inadvertently during XInclude processing.

Move from a block list to an allow list approach to avoid descending
into other node types that can't contain elements.

Fixes #237.

xinclude.c

diff --git a/xinclude.c b/xinclude.c
index 1636caf..b2e6ea1 100644
--- a/xinclude.c
+++ b/xinclude.c
@@ -2430,9 +2430,8 @@
             ctxt->incTotal++;
             xmlXIncludePreProcessNode(ctxt, cur);
         } else if ((cur->children != NULL) &&
-                   (cur->children->type != XML_ENTITY_DECL) &&
-                   (cur->children->type != XML_XINCLUDE_START) &&
-                   (cur->children->type != XML_XINCLUDE_END)) {
+                   ((cur->type == XML_DOCUMENT_NODE) ||
+                    (cur->type == XML_ELEMENT_NODE))) {
             cur = cur->children;
             continue;
         }