xinclude: Limit recursion depth

This avoids call stack overflows.

result/XInclude/max-recurse.xml.err

@@ -0,0 +1,2 @@
+./test/XInclude/without-reader/max-recurse.xml:42: element include: XInclude error : maximum recursion depth exceeded
+./test/XInclude/without-reader/max-recurse.xml:82: element include: XInclude error : maximum recursion depth exceeded

test/XInclude/without-reader/max-recurse.xml

@@ -0,0 +1,104 @@
+<x xmlns:xi="http://www.w3.org/2001/XInclude">
+<e00><xi:include xpointer="xpointer(//e01)"/></e00>
+<e01><xi:include xpointer="xpointer(//e02)"/></e01>
+<e02><xi:include xpointer="xpointer(//e03)"/></e02>
+<e03><xi:include xpointer="xpointer(//e04)"/></e03>
+<e04><xi:include xpointer="xpointer(//e05)"/></e04>
+<e05><xi:include xpointer="xpointer(//e06)"/></e05>
+<e06><xi:include xpointer="xpointer(//e07)"/></e06>
+<e07><xi:include xpointer="xpointer(//e08)"/></e07>
+<e08><xi:include xpointer="xpointer(//e09)"/></e08>
+<e09><xi:include xpointer="xpointer(//e10)"/></e09>
+<e10><xi:include xpointer="xpointer(//e11)"/></e10>
+<e11><xi:include xpointer="xpointer(//e12)"/></e11>
+<e12><xi:include xpointer="xpointer(//e13)"/></e12>
+<e13><xi:include xpointer="xpointer(//e14)"/></e13>
+<e14><xi:include xpointer="xpointer(//e15)"/></e14>
+<e15><xi:include xpointer="xpointer(//e16)"/></e15>
+<e16><xi:include xpointer="xpointer(//e17)"/></e16>
+<e17><xi:include xpointer="xpointer(//e18)"/></e17>
+<e18><xi:include xpointer="xpointer(//e19)"/></e18>
+<e19><xi:include xpointer="xpointer(//e20)"/></e19>
+<e20><xi:include xpointer="xpointer(//e21)"/></e20>
+<e21><xi:include xpointer="xpointer(//e22)"/></e21>
+<e22><xi:include xpointer="xpointer(//e23)"/></e22>
+<e23><xi:include xpointer="xpointer(//e24)"/></e23>
+<e24><xi:include xpointer="xpointer(//e25)"/></e24>
+<e25><xi:include xpointer="xpointer(//e26)"/></e25>
+<e26><xi:include xpointer="xpointer(//e27)"/></e26>
+<e27><xi:include xpointer="xpointer(//e28)"/></e27>
+<e28><xi:include xpointer="xpointer(//e29)"/></e28>
+<e29><xi:include xpointer="xpointer(//e30)"/></e29>
+<e30><xi:include xpointer="xpointer(//e31)"/></e30>
+<e31><xi:include xpointer="xpointer(//e32)"/></e31>
+<e32><xi:include xpointer="xpointer(//e33)"/></e32>
+<e33><xi:include xpointer="xpointer(//e34)"/></e33>
+<e34><xi:include xpointer="xpointer(//e35)"/></e34>
+<e35><xi:include xpointer="xpointer(//e36)"/></e35>
+<e36><xi:include xpointer="xpointer(//e37)"/></e36>
+<e37><xi:include xpointer="xpointer(//e38)"/></e37>
+<e38><xi:include xpointer="xpointer(//e39)"/></e38>
+<e39><xi:include xpointer="xpointer(//e40)"/></e39>
+<e40><xi:include xpointer="xpointer(//e41)"/></e40>
+<e41><xi:include xpointer="xpointer(//e42)"/></e41>
+<e42><xi:include xpointer="xpointer(//e43)"/></e42>
+<e43><xi:include xpointer="xpointer(//e44)"/></e43>
+<e44><xi:include xpointer="xpointer(//e45)"/></e44>
+<e45><xi:include xpointer="xpointer(//e46)"/></e45>
+<e46><xi:include xpointer="xpointer(//e47)"/></e46>
+<e47><xi:include xpointer="xpointer(//e48)"/></e47>
+<e48><xi:include xpointer="xpointer(//e49)"/></e48>
+<e49><xi:include xpointer="xpointer(//e50)"/></e49>
+<e50><xi:include xpointer="xpointer(//e51)"/></e50>
+<e51><xi:include xpointer="xpointer(//e52)"/></e51>
+<e52><xi:include xpointer="xpointer(//e53)"/></e52>
+<e53><xi:include xpointer="xpointer(//e54)"/></e53>
+<e54><xi:include xpointer="xpointer(//e55)"/></e54>
+<e55><xi:include xpointer="xpointer(//e56)"/></e55>
+<e56><xi:include xpointer="xpointer(//e57)"/></e56>
+<e57><xi:include xpointer="xpointer(//e58)"/></e57>
+<e58><xi:include xpointer="xpointer(//e59)"/></e58>
+<e59><xi:include xpointer="xpointer(//e60)"/></e59>
+<e60><xi:include xpointer="xpointer(//e61)"/></e60>
+<e61><xi:include xpointer="xpointer(//e62)"/></e61>
+<e62><xi:include xpointer="xpointer(//e63)"/></e62>
+<e63><xi:include xpointer="xpointer(//e64)"/></e63>
+<e64><xi:include xpointer="xpointer(//e65)"/></e64>
+<e65><xi:include xpointer="xpointer(//e66)"/></e65>
+<e66><xi:include xpointer="xpointer(//e67)"/></e66>
+<e67><xi:include xpointer="xpointer(//e68)"/></e67>
+<e68><xi:include xpointer="xpointer(//e69)"/></e68>
+<e69><xi:include xpointer="xpointer(//e70)"/></e69>
+<e70><xi:include xpointer="xpointer(//e71)"/></e70>
+<e71><xi:include xpointer="xpointer(//e72)"/></e71>
+<e72><xi:include xpointer="xpointer(//e73)"/></e72>
+<e73><xi:include xpointer="xpointer(//e74)"/></e73>
+<e74><xi:include xpointer="xpointer(//e75)"/></e74>
+<e75><xi:include xpointer="xpointer(//e76)"/></e75>
+<e76><xi:include xpointer="xpointer(//e77)"/></e76>
+<e77><xi:include xpointer="xpointer(//e78)"/></e77>
+<e78><xi:include xpointer="xpointer(//e79)"/></e78>
+<e79><xi:include xpointer="xpointer(//e80)"/></e79>
+<e80><xi:include xpointer="xpointer(//e81)"/></e80>
+<e81><xi:include xpointer="xpointer(//e82)"/></e81>
+<e82><xi:include xpointer="xpointer(//e83)"/></e82>
+<e83><xi:include xpointer="xpointer(//e84)"/></e83>
+<e84><xi:include xpointer="xpointer(//e85)"/></e84>
+<e85><xi:include xpointer="xpointer(//e86)"/></e85>
+<e86><xi:include xpointer="xpointer(//e87)"/></e86>
+<e87><xi:include xpointer="xpointer(//e88)"/></e87>
+<e88><xi:include xpointer="xpointer(//e89)"/></e88>
+<e89><xi:include xpointer="xpointer(//e90)"/></e89>
+<e90><xi:include xpointer="xpointer(//e91)"/></e90>
+<e91><xi:include xpointer="xpointer(//e92)"/></e91>
+<e92><xi:include xpointer="xpointer(//e93)"/></e92>
+<e93><xi:include xpointer="xpointer(//e94)"/></e93>
+<e94><xi:include xpointer="xpointer(//e95)"/></e94>
+<e95><xi:include xpointer="xpointer(//e96)"/></e95>
+<e96><xi:include xpointer="xpointer(//e97)"/></e96>
+<e97><xi:include xpointer="xpointer(//e98)"/></e97>
+<e98><xi:include xpointer="xpointer(//e99)"/></e98>
+<e99><xi:include xpointer="xpointer(//e100)"/></e99>
+<e100><xi:include xpointer="xpointer(//e101)"/></e100>
+<e101/>
+</x>

xinclude.c

@@ -90,6 +90,7 @@ struct _xmlXIncludeCtxt {
     void            *_private; /* application data */
 
     unsigned long    incTotal; /* total number of processed inclusions */
+    int			depth; /* recursion depth */
 };
 
 static xmlXIncludeRefPtr
@@ -2036,6 +2037,12 @@ static xmlXIncludeRefPtr
 xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
     int nr, i;
 
+    if (ctxt->depth >= XINCLUDE_MAX_DEPTH) {
+        xmlXIncludeErr(ctxt, node, XML_XINCLUDE_RECURSION,
+                       "maximum recursion depth exceeded\n", NULL);
+        return(NULL);
+    }
+
     for (i = ctxt->incBase; i < ctxt->incNr; i++) {
         if (ctxt->incTab[i]->ref == node) {
             if (ctxt->incTab[i]->expanding) {
@@ -2051,7 +2058,9 @@ xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
         return(NULL);
     nr = ctxt->incNr - 1;
     ctxt->incTab[nr]->expanding = 1;
+    ctxt->depth++;
     xmlXIncludeLoadNode(ctxt, nr);
+    ctxt->depth--;
     ctxt->incTab[nr]->expanding = 0;
 
     return(ctxt->incTab[nr]);