c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

SAX2: Enforce size limit in xmlSAX2Text with XML_PARSE_HUGE

Browse Source
This commit is contained in:
Nick Wellnhofer 2024-01-02 17:23:59 +01:00
parent 5cb4b05c57
commit 9912c36904
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
SAX2.c
View File

@ -2378,6 +2378,10 @@ xmlSAX2Text(xmlParserCtxtPtr ctxt, const xmlChar *ch, int len,
((type != XML_TEXT_NODE) ||
(lastChild->name == xmlStringText));
if ((coalesceText) && (ctxt->nodemem != 0)) {
int maxLength = (ctxt->options & XML_PARSE_HUGE) ?
XML_MAX_HUGE_LENGTH :
XML_MAX_TEXT_LENGTH;
/*
* The whole point of maintaining nodelen and nodemem,
* xmlTextConcat is too costly, i.e. compute length,
@ -2396,12 +2400,7 @@ xmlSAX2Text(xmlParserCtxtPtr ctxt, const xmlChar *ch, int len,
xmlSAX2ErrMemory(ctxt);
return;
}
if (ctxt->nodelen > INT_MAX - len) {
xmlSAX2ErrMemory(ctxt);
return;
}
if ((ctxt->nodelen + len > XML_MAX_TEXT_LENGTH) &&
((ctxt->options & XML_PARSE_HUGE) == 0)) {
if ((len > maxLength) || (ctxt->nodelen > maxLength - len)) {
xmlFatalErr(ctxt, XML_ERR_RESOURCE_LIMIT,
"Text node too long, try XML_PARSE_HUGE");
xmlHaltParser(ctxt);