Don't follow next pointer on documents in xmlXPathRunStreamEval

RVTs from libxslt are document nodes which are linked using the 'next'
pointer. These pointers must never be used to navigate the document
tree. Otherwise, random content from other RVTs could be returned
when evaluating XPath expressions.

It's interesting that this seemingly long-standing bug wasn't
discovered earlier. This issue could also cause severe performance
degradation.

Fixes https://gitlab.gnome.org/GNOME/libxslt/-/issues/37
1 file changed
tree: 4269c0c52b1ddd728d150fe8f84194275bb0c157
  1. bakefile/
  2. doc/
  3. example/
  4. fuzz/
  5. include/
  6. macos/
  7. optim/
  8. os400/
  9. python/
  10. result/
  11. test/
  12. vms/
  13. VxWorks/
  14. win32/
  15. xstc/
  16. .gitignore
  17. .gitlab-ci.yml
  18. .travis.yml
  19. acinclude.m4
  20. AUTHORS
  21. autogen.sh
  22. buf.c
  23. buf.h
  24. build_glob.py
  25. c14n.c
  26. catalog.c
  27. ChangeLog
  28. check-relaxng-test-suite.py
  29. check-relaxng-test-suite2.py
  30. check-xinclude-test-suite.py
  31. check-xml-test-suite.py
  32. check-xsddata-test-suite.py
  33. chvalid.c
  34. chvalid.def
  35. CMakeLists.txt
  36. config.h.cmake.in
  37. configure.ac
  38. CONTRIBUTING
  39. Copyright
  40. dbgen.pl
  41. dbgenattr.pl
  42. debugXML.c
  43. dict.c
  44. DOCBparser.c
  45. elfgcchack.h
  46. enc.h
  47. encoding.c
  48. entities.c
  49. error.c
  50. genChRanges.py
  51. gentest.py
  52. genUnicode.py
  53. global.data
  54. globals.c
  55. hash.c
  56. HTMLparser.c
  57. HTMLtree.c
  58. INSTALL.libxml2
  59. legacy.c
  60. libxml-2.0-uninstalled.pc.in
  61. libxml-2.0.pc.in
  62. libxml.3
  63. libxml.h
  64. libxml.m4
  65. libxml.spec.in
  66. libxml2-config.cmake.cmake.in
  67. libxml2-config.cmake.in
  68. libxml2.doap
  69. libxml2.syms
  70. list.c
  71. MAINTAINERS
  72. Makefile.am
  73. Makefile.tests
  74. Makefile.win
  75. nanoftp.c
  76. nanohttp.c
  77. NEWS
  78. parser.c
  79. parserInternals.c
  80. pattern.c
  81. README
  82. README.cvs-commits
  83. README.tests
  84. README.zOS
  85. regressions.py
  86. regressions.xml
  87. relaxng.c
  88. rngparser.c
  89. runsuite.c
  90. runtest.c
  91. runxmlconf.c
  92. save.h
  93. SAX.c
  94. SAX2.c
  95. schematron.c
  96. testapi.c
  97. testAutomata.c
  98. testC14N.c
  99. testchar.c
  100. testdict.c
  101. testdso.c
  102. testHTML.c
  103. testlimits.c
  104. testModule.c
  105. testOOM.c
  106. testOOMlib.c
  107. testOOMlib.h
  108. testReader.c
  109. testrecurse.c
  110. testRegexp.c
  111. testRelax.c
  112. testSAX.c
  113. testSchemas.c
  114. testThreads.c
  115. testURI.c
  116. testXPath.c
  117. threads.c
  118. timsort.h
  119. TODO
  120. TODO_SCHEMAS
  121. tree.c
  122. trio.c
  123. trio.h
  124. triodef.h
  125. trionan.c
  126. trionan.h
  127. triop.h
  128. triostr.c
  129. triostr.h
  130. uri.c
  131. valid.c
  132. xinclude.c
  133. xlink.c
  134. xml2-config.1
  135. xml2-config.in
  136. xml2Conf.sh.in
  137. xmlcatalog.c
  138. xmlIO.c
  139. xmllint.c
  140. xmlmemory.c
  141. xmlmodule.c
  142. xmlreader.c
  143. xmlregexp.c
  144. xmlsave.c
  145. xmlschemas.c
  146. xmlschemastypes.c
  147. xmlstring.c
  148. xmlunicode.c
  149. xmlwriter.c
  150. xpath.c
  151. xpointer.c
  152. xzlib.c
  153. xzlib.h