diff --git a/SAX2.c b/SAX2.c index bffc65e7..15f87c6e 100644 --- a/SAX2.c +++ b/SAX2.c @@ -31,8 +31,6 @@ #include "private/parser.h" #include "private/tree.h" -#define XML_MAX_URI_LENGTH 2000 - /* * xmlSAX2ErrMemory: * @ctxt: an XML validation parser context diff --git a/include/private/parser.h b/include/private/parser.h index 1c18de24..6cd01b27 100644 --- a/include/private/parser.h +++ b/include/private/parser.h @@ -4,6 +4,8 @@ #include #include +#define XML_MAX_URI_LENGTH 2000 + /** * XML_VCTXT_DTD_VALIDATED: * diff --git a/xinclude.c b/xinclude.c index d79bada7..c7a0645c 100644 --- a/xinclude.c +++ b/xinclude.c @@ -418,6 +418,10 @@ xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) { xmlXIncludeErrMemory(ctxt); goto error; } + } else if (xmlStrlen(href) > XML_MAX_URI_LENGTH) { + xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_HREF_URI, "URI too long\n", + NULL); + goto error; } parse = xmlXIncludeGetProp(ctxt, cur, XINCLUDE_PARSE); @@ -634,7 +638,14 @@ xmlXIncludeBaseFixup(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur, xmlNodePtr copy, xmlXIncludeErrMemory(ctxt); if ((base != NULL) && !xmlStrEqual(base, targetBase)) { - if (xmlBuildRelativeURISafe(base, targetBase, &relBase) < 0) { + if ((xmlStrlen(base) > XML_MAX_URI_LENGTH) || + (xmlStrlen(targetBase) > XML_MAX_URI_LENGTH)) { + relBase = xmlStrdup(base); + if (relBase == NULL) { + xmlXIncludeErrMemory(ctxt); + goto done; + } + } else if (xmlBuildRelativeURISafe(base, targetBase, &relBase) < 0) { xmlXIncludeErrMemory(ctxt); goto done; }