c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Detect infinite recursion in parameter entities

Browse Source 
When expanding a parameter entity in a DTD, infinite recursion could
lead to an infinite loop or memory exhaustion.

Thanks to Wei Lei for the first of many reports.

Fixes bug 759579.
This commit is contained in:
Nick Wellnhofer 2017-07-25 14:59:49 +02:00
parent fb56f80eef
commit 899a5d9f0e
5 changed files with 34 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
parser.c
View File

@ -2250,6 +2250,13 @@ xmlPushInput(xmlParserCtxtPtr ctxt, xmlParserInputPtr input) {
xmlGenericError(xmlGenericErrorContext,
"Pushing input %d : %.30s\n", ctxt->inputNr+1, input->cur);
}
if (((ctxt->inputNr > 40) && ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
(ctxt->inputNr > 1024)) {
xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
while (ctxt->inputNr > 1)
xmlFreeInputStream(inputPop(ctxt));
return(-1);
}
ret = inputPush(ctxt, input);
if (ctxt->instate == XML_PARSER_EOF)
return(-1);
@ -7916,8 +7923,10 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
return;
input = xmlNewEntityInputStream(ctxt, entity);
if (xmlPushInput(ctxt, input) < 0)
if (xmlPushInput(ctxt, input) < 0) {
xmlFreeInputStream(input);
return;
}
if (entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) {
/*

0
result/errors/759579.xml Normal file
View File

6
result/errors/759579.xml.err Normal file
View File

@ -0,0 +1,6 @@
Entity: line 2: parser error : Detected an entity reference loop
%z; %z; %z; %z; %z;
^
Entity: line 2:
%z; %z; %z; %z; %z;
^

7
result/errors/759579.xml.str Normal file
View File

@ -0,0 +1,7 @@
Entity: line 2: parser error : Detected an entity reference loop
%z; %z; %z; %z; %z;
^
Entity: line 2:
%z; %z; %z; %z; %z;
^
./test/errors/759579.xml : failed to parse

11
test/errors/759579.xml Normal file
View File

@ -0,0 +1,11 @@
<!DOCTYPE doc [
<!ENTITY % z '
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
'>
%z;
]>
<doc/>