database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-07 00:04:31 +03:00
Code Activity

MDEV-5338 XML parser accepts malformed data

Browse Source
This commit is contained in:
Alexander Barkov
2014-04-23 15:53:47 +04:00
parent 213f10363e
commit a24ea50d1a
3 changed files with 40 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
strings/xml.c
View File

@@ -240,7 +240,7 @@ static void mstr(char *s,const char *src,size_t l1, size_t l2)
static int my_xml_leave(MY_XML_PARSER *p, const char *str, size_t slen)
{
char *e;
char *e, *tag;
size_t glen;
char s[32];
char g[32];
@@ -249,13 +249,14 @@ static int my_xml_leave(MY_XML_PARSER *p, const char *str, size_t slen)
/* Find previous '/' or beginning */
for (e=p->attrend; (e>p->attr) && (e[0] != '/') ; e--);
glen = (size_t) ((e[0] == '/') ? (p->attrend-e-1) : p->attrend-e);
if (str && (slen != glen))
tag= e[0] == '/' ? e + 1 : e;
if (str && (slen != glen || memcmp(str, tag, slen)))
{
mstr(s,str,sizeof(s)-1,slen);
if (glen)
{
mstr(g,e+1,sizeof(g)-1,glen),
mstr(g, tag, sizeof(g)-1, glen);
sprintf(p->errstr,"'</%s>' unexpected ('</%s>' wanted)",s,g);
}
else