From d0b03aa202ae620bbaa57b04198b89474fe7affc Mon Sep 17 00:00:00 2001 From: Alexandre Julliard Date: Tue, 8 Nov 2022 11:02:46 +0100 Subject: [PATCH] xml2: Import upstream release 2.10.3. --- libs/xml2/HTMLparser.c | 27 +--- libs/xml2/SAX2.c | 24 ++- libs/xml2/entities.c | 55 ++----- libs/xml2/include/win32config.h | 8 +- libs/xml2/parser.c | 249 ++++++++++++++++---------------- libs/xml2/tree.c | 3 +- libs/xml2/xpath.c | 3 +- 7 files changed, 164 insertions(+), 205 deletions(-) diff --git a/libs/xml2/HTMLparser.c b/libs/xml2/HTMLparser.c index abc4e90575c..ba886908e44 100644 --- a/libs/xml2/HTMLparser.c +++ b/libs/xml2/HTMLparser.c @@ -5056,8 +5056,7 @@ htmlInitParserCtxt(htmlParserCtxtPtr ctxt) htmlErrMemory(NULL, "htmlInitParserCtxt: out of memory\n"); return(-1); } - else - memset(sax, 0, sizeof(htmlSAXHandler)); + memset(sax, 0, sizeof(htmlSAXHandler)); /* Allocate the Input stack */ ctxt->inputTab = (htmlParserInputPtr *) @@ -5116,11 +5115,9 @@ htmlInitParserCtxt(htmlParserCtxtPtr ctxt) ctxt->nodeInfoNr = 0; ctxt->nodeInfoMax = 0; - if (sax == NULL) ctxt->sax = (xmlSAXHandlerPtr) &htmlDefaultSAXHandler; - else { - ctxt->sax = sax; - memcpy(sax, &htmlDefaultSAXHandler, sizeof(xmlSAXHandlerV1)); - } + ctxt->sax = sax; + xmlSAX2InitHtmlDefaultSAXHandler(sax); + ctxt->userData = ctxt; ctxt->myDoc = NULL; ctxt->wellFormed = 1; @@ -7116,22 +7113,10 @@ htmlDocPtr htmlCtxtReadDoc(htmlParserCtxtPtr ctxt, const xmlChar * cur, const char *URL, const char *encoding, int options) { - xmlParserInputPtr stream; - if (cur == NULL) return (NULL); - if (ctxt == NULL) - return (NULL); - xmlInitParser(); - - htmlCtxtReset(ctxt); - - stream = xmlNewStringInputStream(ctxt, cur); - if (stream == NULL) { - return (NULL); - } - inputPush(ctxt, stream); - return (htmlDoRead(ctxt, URL, encoding, options, 1)); + return (htmlCtxtReadMemory(ctxt, (const char *) cur, xmlStrlen(cur), URL, + encoding, options)); } /** diff --git a/libs/xml2/SAX2.c b/libs/xml2/SAX2.c index ec89046b1d6..9faf5b461dd 100644 --- a/libs/xml2/SAX2.c +++ b/libs/xml2/SAX2.c @@ -28,11 +28,6 @@ #include #include -/* Define SIZE_T_MAX unless defined through . */ -#ifndef SIZE_T_MAX -# define SIZE_T_MAX ((size_t)-1) -#endif /* !SIZE_T_MAX */ - /* #define DEBUG_SAX2 */ /* #define DEBUG_SAX2_TREE */ @@ -2596,22 +2591,23 @@ xmlSAX2Text(xmlParserCtxtPtr ctxt, const xmlChar *ch, int len, xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters: xmlStrdup returned NULL"); return; } - if (((size_t)ctxt->nodelen + (size_t)len > XML_MAX_TEXT_LENGTH) && + if (ctxt->nodelen > INT_MAX - len) { + xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented"); + return; + } + if ((ctxt->nodelen + len > XML_MAX_TEXT_LENGTH) && ((ctxt->options & XML_PARSE_HUGE) == 0)) { xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters: huge text node"); return; } - if ((size_t)ctxt->nodelen > SIZE_T_MAX - (size_t)len || - (size_t)ctxt->nodemem + (size_t)len > SIZE_T_MAX / 2) { - xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented"); - return; - } if (ctxt->nodelen + len >= ctxt->nodemem) { xmlChar *newbuf; - size_t size; + int size; - size = ctxt->nodemem + len; - size *= 2; + size = ctxt->nodemem > INT_MAX - len ? + INT_MAX : + ctxt->nodemem + len; + size = size > INT_MAX / 2 ? INT_MAX : size * 2; newbuf = (xmlChar *) xmlRealloc(lastChild->content,size); if (newbuf == NULL) { xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters"); diff --git a/libs/xml2/entities.c b/libs/xml2/entities.c index 84435515f73..d4e5412efed 100644 --- a/libs/xml2/entities.c +++ b/libs/xml2/entities.c @@ -128,36 +128,19 @@ xmlFreeEntity(xmlEntityPtr entity) if ((entity->children) && (entity->owner == 1) && (entity == (xmlEntityPtr) entity->children->parent)) xmlFreeNodeList(entity->children); - if (dict != NULL) { - if ((entity->name != NULL) && (!xmlDictOwns(dict, entity->name))) - xmlFree((char *) entity->name); - if ((entity->ExternalID != NULL) && - (!xmlDictOwns(dict, entity->ExternalID))) - xmlFree((char *) entity->ExternalID); - if ((entity->SystemID != NULL) && - (!xmlDictOwns(dict, entity->SystemID))) - xmlFree((char *) entity->SystemID); - if ((entity->URI != NULL) && (!xmlDictOwns(dict, entity->URI))) - xmlFree((char *) entity->URI); - if ((entity->content != NULL) - && (!xmlDictOwns(dict, entity->content))) - xmlFree((char *) entity->content); - if ((entity->orig != NULL) && (!xmlDictOwns(dict, entity->orig))) - xmlFree((char *) entity->orig); - } else { - if (entity->name != NULL) - xmlFree((char *) entity->name); - if (entity->ExternalID != NULL) - xmlFree((char *) entity->ExternalID); - if (entity->SystemID != NULL) - xmlFree((char *) entity->SystemID); - if (entity->URI != NULL) - xmlFree((char *) entity->URI); - if (entity->content != NULL) - xmlFree((char *) entity->content); - if (entity->orig != NULL) - xmlFree((char *) entity->orig); - } + if ((entity->name != NULL) && + ((dict == NULL) || (!xmlDictOwns(dict, entity->name)))) + xmlFree((char *) entity->name); + if (entity->ExternalID != NULL) + xmlFree((char *) entity->ExternalID); + if (entity->SystemID != NULL) + xmlFree((char *) entity->SystemID); + if (entity->URI != NULL) + xmlFree((char *) entity->URI); + if (entity->content != NULL) + xmlFree((char *) entity->content); + if (entity->orig != NULL) + xmlFree((char *) entity->orig); xmlFree(entity); } @@ -193,18 +176,12 @@ xmlCreateEntity(xmlDictPtr dict, const xmlChar *name, int type, ret->SystemID = xmlStrdup(SystemID); } else { ret->name = xmlDictLookup(dict, name, -1); - if (ExternalID != NULL) - ret->ExternalID = xmlDictLookup(dict, ExternalID, -1); - if (SystemID != NULL) - ret->SystemID = xmlDictLookup(dict, SystemID, -1); + ret->ExternalID = xmlStrdup(ExternalID); + ret->SystemID = xmlStrdup(SystemID); } if (content != NULL) { ret->length = xmlStrlen(content); - if ((dict != NULL) && (ret->length < 5)) - ret->content = (xmlChar *) - xmlDictLookup(dict, content, ret->length); - else - ret->content = xmlStrndup(content, ret->length); + ret->content = xmlStrndup(content, ret->length); } else { ret->length = 0; ret->content = NULL; diff --git a/libs/xml2/include/win32config.h b/libs/xml2/include/win32config.h index d3e19a1bbb5..a558f67eba2 100644 --- a/libs/xml2/include/win32config.h +++ b/libs/xml2/include/win32config.h @@ -15,9 +15,13 @@ #define HAVE_STDINT_H #endif -#if defined(_MSC_VER) && _MSC_VER < 1900 +#if defined(_MSC_VER) +#if _MSC_VER < 1900 #define snprintf _snprintf -#define vsnprintf _vsnprintf +#endif +#if _MSC_VER < 1500 +#define vsnprintf(b,c,f,a) _vsnprintf(b,c,f,a) +#endif #endif #endif /* __LIBXML_WIN32_CONFIG__ */ diff --git a/libs/xml2/parser.c b/libs/xml2/parser.c index e660b0a7d49..794799794f1 100644 --- a/libs/xml2/parser.c +++ b/libs/xml2/parser.c @@ -102,6 +102,8 @@ xmlParseElementEnd(xmlParserCtxtPtr ctxt); * * ************************************************************************/ +#define XML_MAX_HUGE_LENGTH 1000000000 + #define XML_PARSER_BIG_ENTITY 1000 #define XML_PARSER_LOT_ENTITY 5000 @@ -552,7 +554,7 @@ xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info) errmsg = "Malformed declaration expecting version"; break; case XML_ERR_NAME_TOO_LONG: - errmsg = "Name too long use XML_PARSE_HUGE option"; + errmsg = "Name too long"; break; #if 0 case: @@ -3202,6 +3204,9 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) { int len = 0, l; int c; int count = 0; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; #ifdef DEBUG nbParseNameComplex++; @@ -3267,7 +3272,8 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) { if (ctxt->instate == XML_PARSER_EOF) return(NULL); } - len += l; + if (len <= INT_MAX - l) + len += l; NEXTL(l); c = CUR_CHAR(l); } @@ -3293,13 +3299,13 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) { if (ctxt->instate == XML_PARSER_EOF) return(NULL); } - len += l; + if (len <= INT_MAX - l) + len += l; NEXTL(l); c = CUR_CHAR(l); } } - if ((len > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if (len > maxLength) { xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name"); return(NULL); } @@ -3338,7 +3344,10 @@ const xmlChar * xmlParseName(xmlParserCtxtPtr ctxt) { const xmlChar *in; const xmlChar *ret; - int count = 0; + size_t count = 0; + size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; GROW; @@ -3362,8 +3371,7 @@ xmlParseName(xmlParserCtxtPtr ctxt) { in++; if ((*in > 0) && (*in < 0x80)) { count = in - ctxt->input->cur; - if ((count > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if (count > maxLength) { xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name"); return(NULL); } @@ -3384,6 +3392,9 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { int len = 0, l; int c; int count = 0; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; size_t startPosition = 0; #ifdef DEBUG @@ -3404,17 +3415,13 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { while ((c != ' ') && (c != '>') && (c != '/') && /* test bigname.xml */ (xmlIsNameChar(ctxt, c) && (c != ':'))) { if (count++ > XML_PARSER_CHUNK_SIZE) { - if ((len > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName"); - return(NULL); - } count = 0; GROW; if (ctxt->instate == XML_PARSER_EOF) return(NULL); } - len += l; + if (len <= INT_MAX - l) + len += l; NEXTL(l); c = CUR_CHAR(l); if (c == 0) { @@ -3432,8 +3439,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) { c = CUR_CHAR(l); } } - if ((len > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if (len > maxLength) { xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName"); return(NULL); } @@ -3459,7 +3465,10 @@ static const xmlChar * xmlParseNCName(xmlParserCtxtPtr ctxt) { const xmlChar *in, *e; const xmlChar *ret; - int count = 0; + size_t count = 0; + size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; #ifdef DEBUG nbParseNCName++; @@ -3484,8 +3493,7 @@ xmlParseNCName(xmlParserCtxtPtr ctxt) { goto complex; if ((*in > 0) && (*in < 0x80)) { count = in - ctxt->input->cur; - if ((count > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if (count > maxLength) { xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName"); return(NULL); } @@ -3567,6 +3575,9 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) { const xmlChar *cur = *str; int len = 0, l; int c; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; #ifdef DEBUG nbParseStringName++; @@ -3602,12 +3613,6 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) { if (len + 10 > max) { xmlChar *tmp; - if ((len > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName"); - xmlFree(buffer); - return(NULL); - } max *= 2; tmp = (xmlChar *) xmlRealloc(buffer, max * sizeof(xmlChar)); @@ -3621,14 +3626,18 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) { COPY_BUF(l,buffer,len,c); cur += l; c = CUR_SCHAR(cur, l); + if (len > maxLength) { + xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName"); + xmlFree(buffer); + return(NULL); + } } buffer[len] = 0; *str = cur; return(buffer); } } - if ((len > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if (len > maxLength) { xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName"); return(NULL); } @@ -3655,6 +3664,9 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) { int len = 0, l; int c; int count = 0; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; #ifdef DEBUG nbParseNmToken++; @@ -3706,12 +3718,6 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) { if (len + 10 > max) { xmlChar *tmp; - if ((max > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken"); - xmlFree(buffer); - return(NULL); - } max *= 2; tmp = (xmlChar *) xmlRealloc(buffer, max * sizeof(xmlChar)); @@ -3725,6 +3731,11 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) { COPY_BUF(l,buffer,len,c); NEXTL(l); c = CUR_CHAR(l); + if (len > maxLength) { + xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken"); + xmlFree(buffer); + return(NULL); + } } buffer[len] = 0; return(buffer); @@ -3732,8 +3743,7 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) { } if (len == 0) return(NULL); - if ((len > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if (len > maxLength) { xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken"); return(NULL); } @@ -3759,6 +3769,9 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) { int len = 0; int size = XML_PARSER_BUFFER_SIZE; int c, l; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_HUGE_LENGTH : + XML_MAX_TEXT_LENGTH; xmlChar stop; xmlChar *ret = NULL; const xmlChar *cur = NULL; @@ -3818,6 +3831,12 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) { GROW; c = CUR_CHAR(l); } + + if (len > maxLength) { + xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_NOT_FINISHED, + "entity value too long\n"); + goto error; + } } buf[len] = 0; if (ctxt->instate == XML_PARSER_EOF) @@ -3905,6 +3924,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) { xmlChar *rep = NULL; size_t len = 0; size_t buf_size = 0; + size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_HUGE_LENGTH : + XML_MAX_TEXT_LENGTH; int c, l, in_space = 0; xmlChar *current = NULL; xmlEntityPtr ent; @@ -3936,16 +3958,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) { while (((NXT(0) != limit) && /* checked */ (IS_CHAR(c)) && (c != '<')) && (ctxt->instate != XML_PARSER_EOF)) { - /* - * Impose a reasonable limit on attribute size, unless XML_PARSE_HUGE - * special option is given - */ - if ((len > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, - "AttValue length too long\n"); - goto mem_error; - } if (c == '&') { in_space = 0; if (NXT(1) == '#') { @@ -4093,6 +4105,11 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) { } GROW; c = CUR_CHAR(l); + if (len > maxLength) { + xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, + "AttValue length too long\n"); + goto mem_error; + } } if (ctxt->instate == XML_PARSER_EOF) goto error; @@ -4114,16 +4131,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) { } else NEXT; - /* - * There we potentially risk an overflow, don't allow attribute value of - * length more than INT_MAX it is a very reasonable assumption ! - */ - if (len >= INT_MAX) { - xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, - "AttValue length too long\n"); - goto mem_error; - } - if (attlen != NULL) *attlen = (int) len; return(buf); @@ -4194,6 +4201,9 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) { int len = 0; int size = XML_PARSER_BUFFER_SIZE; int cur, l; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; xmlChar stop; int state = ctxt->instate; int count = 0; @@ -4221,13 +4231,6 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) { if (len + 5 >= size) { xmlChar *tmp; - if ((size > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "SystemLiteral"); - xmlFree(buf); - ctxt->instate = (xmlParserInputState) state; - return(NULL); - } size *= 2; tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar)); if (tmp == NULL) { @@ -4256,6 +4259,12 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) { SHRINK; cur = CUR_CHAR(l); } + if (len > maxLength) { + xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "SystemLiteral"); + xmlFree(buf); + ctxt->instate = (xmlParserInputState) state; + return(NULL); + } } buf[len] = 0; ctxt->instate = (xmlParserInputState) state; @@ -4283,6 +4292,9 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) { xmlChar *buf = NULL; int len = 0; int size = XML_PARSER_BUFFER_SIZE; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_TEXT_LENGTH : + XML_MAX_NAME_LENGTH; xmlChar cur; xmlChar stop; int count = 0; @@ -4310,12 +4322,6 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) { if (len + 1 >= size) { xmlChar *tmp; - if ((size > XML_MAX_NAME_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Public ID"); - xmlFree(buf); - return(NULL); - } size *= 2; tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar)); if (tmp == NULL) { @@ -4343,6 +4349,11 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) { SHRINK; cur = CUR; } + if (len > maxLength) { + xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Public ID"); + xmlFree(buf); + return(NULL); + } } buf[len] = 0; if (cur != stop) { @@ -4742,6 +4753,9 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf, int r, rl; int cur, l; size_t count = 0; + size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_HUGE_LENGTH : + XML_MAX_TEXT_LENGTH; int inputid; inputid = ctxt->input->id; @@ -4787,13 +4801,6 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf, if ((r == '-') && (q == '-')) { xmlFatalErr(ctxt, XML_ERR_HYPHEN_IN_COMMENT, NULL); } - if ((len > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, - "Comment too big found", NULL); - xmlFree (buf); - return; - } if (len + 5 >= size) { xmlChar *new_buf; size_t new_size; @@ -4831,6 +4838,13 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf, GROW; cur = CUR_CHAR(l); } + + if (len > maxLength) { + xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, + "Comment too big found", NULL); + xmlFree (buf); + return; + } } buf[len] = 0; if (cur == 0) { @@ -4875,6 +4889,9 @@ xmlParseComment(xmlParserCtxtPtr ctxt) { xmlChar *buf = NULL; size_t size = XML_PARSER_BUFFER_SIZE; size_t len = 0; + size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_HUGE_LENGTH : + XML_MAX_TEXT_LENGTH; xmlParserInputState state; const xmlChar *in; size_t nbchar = 0; @@ -4958,8 +4975,7 @@ get_more: buf[len] = 0; } } - if ((len > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if (len > maxLength) { xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, "Comment too big found", NULL); xmlFree (buf); @@ -5159,6 +5175,9 @@ xmlParsePI(xmlParserCtxtPtr ctxt) { xmlChar *buf = NULL; size_t len = 0; size_t size = XML_PARSER_BUFFER_SIZE; + size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_HUGE_LENGTH : + XML_MAX_TEXT_LENGTH; int cur, l; const xmlChar *target; xmlParserInputState state; @@ -5234,14 +5253,6 @@ xmlParsePI(xmlParserCtxtPtr ctxt) { return; } count = 0; - if ((len > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED, - "PI %s too big found", target); - xmlFree(buf); - ctxt->instate = state; - return; - } } COPY_BUF(l,buf,len,cur); NEXTL(l); @@ -5251,15 +5262,14 @@ xmlParsePI(xmlParserCtxtPtr ctxt) { GROW; cur = CUR_CHAR(l); } + if (len > maxLength) { + xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED, + "PI %s too big found", target); + xmlFree(buf); + ctxt->instate = state; + return; + } } - if ((len > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED, - "PI %s too big found", target); - xmlFree(buf); - ctxt->instate = state; - return; - } buf[len] = 0; if (cur != '?') { xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED, @@ -8954,6 +8964,9 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc, const xmlChar *in = NULL, *start, *end, *last; xmlChar *ret = NULL; int line, col; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_HUGE_LENGTH : + XML_MAX_TEXT_LENGTH; GROW; in = (xmlChar *) CUR_PTR; @@ -8993,8 +9006,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc, start = in; if (in >= end) { GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end) - if (((in - start) > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if ((in - start) > maxLength) { xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, "AttValue length too long\n"); return(NULL); @@ -9007,8 +9019,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc, if ((*in++ == 0x20) && (*in == 0x20)) break; if (in >= end) { GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end) - if (((in - start) > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if ((in - start) > maxLength) { xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, "AttValue length too long\n"); return(NULL); @@ -9041,16 +9052,14 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc, last = last + delta; } end = ctxt->input->end; - if (((in - start) > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if ((in - start) > maxLength) { xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, "AttValue length too long\n"); return(NULL); } } } - if (((in - start) > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if ((in - start) > maxLength) { xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, "AttValue length too long\n"); return(NULL); @@ -9063,8 +9072,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc, col++; if (in >= end) { GROW_PARSE_ATT_VALUE_INTERNAL(ctxt, in, start, end) - if (((in - start) > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if ((in - start) > maxLength) { xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, "AttValue length too long\n"); return(NULL); @@ -9072,8 +9080,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc, } } last = in; - if (((in - start) > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { + if ((in - start) > maxLength) { xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, "AttValue length too long\n"); return(NULL); @@ -9763,6 +9770,9 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) { int s, sl; int cur, l; int count = 0; + int maxLength = (ctxt->options & XML_PARSE_HUGE) ? + XML_MAX_HUGE_LENGTH : + XML_MAX_TEXT_LENGTH; /* Check 2.6.0 was NXT(0) not RAW */ if (CMP9(CUR_PTR, '<', '!', '[', 'C', 'D', 'A', 'T', 'A', '[')) { @@ -9796,13 +9806,6 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) { if (len + 5 >= size) { xmlChar *tmp; - if ((size > XML_MAX_TEXT_LENGTH) && - ((ctxt->options & XML_PARSE_HUGE) == 0)) { - xmlFatalErrMsgStr(ctxt, XML_ERR_CDATA_NOT_FINISHED, - "CData section too big found", NULL); - xmlFree (buf); - return; - } tmp = (xmlChar *) xmlRealloc(buf, size * 2 * sizeof(xmlChar)); if (tmp == NULL) { xmlFree(buf); @@ -9829,6 +9832,12 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) { } NEXTL(l); cur = CUR_CHAR(l); + if (len > maxLength) { + xmlFatalErrMsg(ctxt, XML_ERR_CDATA_NOT_FINISHED, + "CData section too big found\n"); + xmlFree(buf); + return; + } } buf[len] = 0; ctxt->instate = XML_PARSER_CONTENT; @@ -15359,22 +15368,10 @@ xmlDocPtr xmlCtxtReadDoc(xmlParserCtxtPtr ctxt, const xmlChar * cur, const char *URL, const char *encoding, int options) { - xmlParserInputPtr stream; - if (cur == NULL) return (NULL); - if (ctxt == NULL) - return (NULL); - xmlInitParser(); - - xmlCtxtReset(ctxt); - - stream = xmlNewStringInputStream(ctxt, cur); - if (stream == NULL) { - return (NULL); - } - inputPush(ctxt, stream); - return (xmlDoRead(ctxt, URL, encoding, options, 1)); + return (xmlCtxtReadMemory(ctxt, (const char *) cur, xmlStrlen(cur), URL, + encoding, options)); } /** diff --git a/libs/xml2/tree.c b/libs/xml2/tree.c index b53fa37ef41..4c9f00d784e 100644 --- a/libs/xml2/tree.c +++ b/libs/xml2/tree.c @@ -9604,7 +9604,8 @@ xmlDOMWrapCloneNode(xmlDOMWrapCtxtPtr ctxt, /* * Attributes (xmlAttr). */ - clone = (xmlNodePtr) xmlMalloc(sizeof(xmlAttr)); + /* Use xmlRealloc to avoid -Warray-bounds warning */ + clone = (xmlNodePtr) xmlRealloc(NULL, sizeof(xmlAttr)); if (clone == NULL) { xmlTreeErrMemory("xmlDOMWrapCloneNode(): allocating an attr-node"); goto internal_error; diff --git a/libs/xml2/xpath.c b/libs/xml2/xpath.c index 4a6f0e216e7..fbee6a52b12 100644 --- a/libs/xml2/xpath.c +++ b/libs/xml2/xpath.c @@ -10503,7 +10503,7 @@ xmlXPathCompFilterExpr(xmlXPathParserContextPtr ctxt) { static xmlChar * xmlXPathScanName(xmlXPathParserContextPtr ctxt) { - int len = 0, l; + int l; int c; const xmlChar *cur; xmlChar *ret; @@ -10523,7 +10523,6 @@ xmlXPathScanName(xmlXPathParserContextPtr ctxt) { (c == '_') || (c == ':') || (IS_COMBINING(c)) || (IS_EXTENDER(c)))) { - len += l; NEXTL(l); c = CUR_CHAR(l); }