m fccef3cc822af74699cca84cd202719ae61ca3b9 Mon Sep 17 00:00:00 2001
From: Philip Withnall <withnall@endlessm.com>
Date: Mon, 30 Jul 2018 18:33:39 +0100
Subject: [PATCH] gmarkup: Fix crash in error handling path for closing
 elements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If something which looks like a closing tag is left unfinished, but
isn’t paired to an opening tag in the document, the error handling code
would do a null pointer dereference. Avoid that, at the cost of
introducing a new translatable error message.

Includes a test case, courtesy of pdknsk.

Signed-off-by: Philip Withnall <withnall@endlessm.com>

https://gitlab.gnome.org/GNOME/glib/issues/1461
---
glib/gmarkup.c                      | 11 ++++++++---
 glib/tests/markups/fail-51.expected |  1 +
 glib/tests/markups/fail-51.gmarkup  |  1 +
 3 files changed, 10 insertions(+), 3 deletions(-)
 create mode 100644 glib/tests/markups/fail-51.expected
 create mode 100644 glib/tests/markups/fail-51.gmarkup

diff --git a/glib/gmarkup.c b/glib/gmarkup.c
index ed30ed2..a159d7b 100644
--- a/glib/gmarkup.c
+++ b/glib/gmarkup.c
@@ -1832,9 +1832,14 @@ g_markup_parse_context_end_parse (GMarkupParseContext  *context,
     case STATE_AFTER_CLOSE_TAG_SLASH:
     case STATE_INSIDE_CLOSE_TAG_NAME:
     case STATE_AFTER_CLOSE_TAG_NAME:
-      set_error (context, error, G_MARKUP_ERROR_PARSE,
-                 _("Document ended unexpectedly inside the close tag for "
-                   "element '%s'"), current_element (context));
+      if (context->tag_stack != NULL)
+        set_error (context, error, G_MARKUP_ERROR_PARSE,
+                   _("Document ended unexpectedly inside the close tag for "
+                     "element '%s'"), current_element (context));
+      else
+        set_error (context, error, G_MARKUP_ERROR_PARSE,
+                   _("Document ended unexpectedly inside the close tag for an "
+                     "unopened element"));
       break;
 
     case STATE_INSIDE_PASSTHROUGH:
diff --git a/glib/tests/markups/fail-51.expected b/glib/tests/markups/fail-51.expected
new file mode 100644
index 0000000..1c7e8d4
--- /dev/null
+++ b/glib/tests/markups/fail-51.expected
@@ -0,0 +1 @@
+ERROR Error on line 1 char 5: Document ended unexpectedly inside the close tag for an unopened element
diff --git a/glib/tests/markups/fail-51.gmarkup b/glib/tests/markups/fail-51.gmarkup
new file mode 100644
index 0000000..860e1e6
--- /dev/null
+++ b/glib/tests/markups/fail-51.gmarkup
@@ -0,0 +1 @@
+</0<
\ No newline at end of file
-- 
2.7.4