[CVE-2021-3518] Fix user-after-free with `xmllint --xinclude --dropdtd`

The --dropdtd option can leave dangling pointers in entity reference
nodes. Make sure to skip these nodes when processing XIncludes.

This also avoids scanning entity declarations and even modifying
them inadvertently during XInclude processing.

Move from a block list to an allow list approach to avoid descending
into other node types that can't contain elements.

Fixes #237.

Change-Id: Ifd6eee2ade87d55469e234066186921b83fe4dd6
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

diff --git a/xinclude.c b/xinclude.c
index ba850fa..74443c7 100644 (file)
--- a/xinclude.c
+++ b/xinclude.c
@@ -2397,9 +2397,8 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr tree) {
     while ((cur != NULL) && (cur != tree->parent)) {
        /* TODO: need to work on entities -> stack */
        if ((cur->children != NULL) &&
-           (cur->children->type != XML_ENTITY_DECL) &&
-           (cur->children->type != XML_XINCLUDE_START) &&
-           (cur->children->type != XML_XINCLUDE_END)) {
+           ((cur->type == XML_DOCUMENT_NODE) ||
+            (cur->type == XML_ELEMENT_NODE))) {
            cur = cur->children;
            if (xmlXIncludeTestNode(ctxt, cur))
                xmlXIncludePreProcessNode(ctxt, cur);