6ce3da
From 1358d157d0bd83be1dfe356a69213df9fac0b539 Mon Sep 17 00:00:00 2001
6ce3da
From: Nick Wellnhofer <wellnhofer@aevum.de>
6ce3da
Date: Wed, 21 Apr 2021 13:23:27 +0200
6ce3da
Subject: [PATCH] Fix use-after-free with `xmllint --html --push`
6ce3da
6ce3da
Call htmlCtxtUseOptions to make sure that names aren't stored in
6ce3da
dictionaries.
6ce3da
6ce3da
Note that this issue only affects xmllint using the HTML push parser.
6ce3da
6ce3da
Fixes #230.
6ce3da
---
6ce3da
 xmllint.c | 2 +-
6ce3da
 1 file changed, 1 insertion(+), 1 deletion(-)
6ce3da
6ce3da
diff --git a/xmllint.c b/xmllint.c
6ce3da
index 6ca1bf54..dbef273a 100644
6ce3da
--- a/xmllint.c
6ce3da
+++ b/xmllint.c
6ce3da
@@ -2213,7 +2213,7 @@ static void parseAndPrintFile(char *filename, xmlParserCtxtPtr rectxt) {
6ce3da
             if (res > 0) {
6ce3da
                 ctxt = htmlCreatePushParserCtxt(NULL, NULL,
6ce3da
                             chars, res, filename, XML_CHAR_ENCODING_NONE);
6ce3da
-                xmlCtxtUseOptions(ctxt, options);
6ce3da
+                htmlCtxtUseOptions(ctxt, options);
6ce3da
                 while ((res = fread(chars, 1, pushsize, f)) > 0) {
6ce3da
                     htmlParseChunk(ctxt, chars, res, 0);
6ce3da
                 }
6ce3da
-- 
6ce3da
GitLab
6ce3da