lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-26 00:37:43 +03:00
Code Activity

xinclude: Limit recursion depth

Browse Source 
This avoids call stack overflows.
This commit is contained in:
Nick Wellnhofer
2022-10-22 16:50:18 +02:00
parent 34496f26db
commit d2ed1e4f99
3 changed files with 115 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
result/XInclude/max-recurse.xml.err Normal file
View File

@@ -0,0 +1,2 @@
./test/XInclude/without-reader/max-recurse.xml:42: element include: XInclude error : maximum recursion depth exceeded
./test/XInclude/without-reader/max-recurse.xml:82: element include: XInclude error : maximum recursion depth exceeded

104
test/XInclude/without-reader/max-recurse.xml Normal file
View File

@@ -0,0 +1,104 @@
<x xmlns:xi="http://www.w3.org/2001/XInclude">
<e00><xi:include xpointer="xpointer(//e01)"/></e00>
<e01><xi:include xpointer="xpointer(//e02)"/></e01>
<e02><xi:include xpointer="xpointer(//e03)"/></e02>
<e03><xi:include xpointer="xpointer(//e04)"/></e03>
<e04><xi:include xpointer="xpointer(//e05)"/></e04>
<e05><xi:include xpointer="xpointer(//e06)"/></e05>
<e06><xi:include xpointer="xpointer(//e07)"/></e06>
<e07><xi:include xpointer="xpointer(//e08)"/></e07>
<e08><xi:include xpointer="xpointer(//e09)"/></e08>
<e09><xi:include xpointer="xpointer(//e10)"/></e09>
<e10><xi:include xpointer="xpointer(//e11)"/></e10>
<e11><xi:include xpointer="xpointer(//e12)"/></e11>
<e12><xi:include xpointer="xpointer(//e13)"/></e12>
<e13><xi:include xpointer="xpointer(//e14)"/></e13>
<e14><xi:include xpointer="xpointer(//e15)"/></e14>
<e15><xi:include xpointer="xpointer(//e16)"/></e15>
<e16><xi:include xpointer="xpointer(//e17)"/></e16>
<e17><xi:include xpointer="xpointer(//e18)"/></e17>
<e18><xi:include xpointer="xpointer(//e19)"/></e18>
<e19><xi:include xpointer="xpointer(//e20)"/></e19>
<e20><xi:include xpointer="xpointer(//e21)"/></e20>
<e21><xi:include xpointer="xpointer(//e22)"/></e21>
<e22><xi:include xpointer="xpointer(//e23)"/></e22>
<e23><xi:include xpointer="xpointer(//e24)"/></e23>
<e24><xi:include xpointer="xpointer(//e25)"/></e24>
<e25><xi:include xpointer="xpointer(//e26)"/></e25>
<e26><xi:include xpointer="xpointer(//e27)"/></e26>
<e27><xi:include xpointer="xpointer(//e28)"/></e27>
<e28><xi:include xpointer="xpointer(//e29)"/></e28>
<e29><xi:include xpointer="xpointer(//e30)"/></e29>
<e30><xi:include xpointer="xpointer(//e31)"/></e30>
<e31><xi:include xpointer="xpointer(//e32)"/></e31>
<e32><xi:include xpointer="xpointer(//e33)"/></e32>
<e33><xi:include xpointer="xpointer(//e34)"/></e33>
<e34><xi:include xpointer="xpointer(//e35)"/></e34>
<e35><xi:include xpointer="xpointer(//e36)"/></e35>
<e36><xi:include xpointer="xpointer(//e37)"/></e36>
<e37><xi:include xpointer="xpointer(//e38)"/></e37>
<e38><xi:include xpointer="xpointer(//e39)"/></e38>
<e39><xi:include xpointer="xpointer(//e40)"/></e39>
<e40><xi:include xpointer="xpointer(//e41)"/></e40>
<e41><xi:include xpointer="xpointer(//e42)"/></e41>
<e42><xi:include xpointer="xpointer(//e43)"/></e42>
<e43><xi:include xpointer="xpointer(//e44)"/></e43>
<e44><xi:include xpointer="xpointer(//e45)"/></e44>
<e45><xi:include xpointer="xpointer(//e46)"/></e45>
<e46><xi:include xpointer="xpointer(//e47)"/></e46>
<e47><xi:include xpointer="xpointer(//e48)"/></e47>
<e48><xi:include xpointer="xpointer(//e49)"/></e48>
<e49><xi:include xpointer="xpointer(//e50)"/></e49>
<e50><xi:include xpointer="xpointer(//e51)"/></e50>
<e51><xi:include xpointer="xpointer(//e52)"/></e51>
<e52><xi:include xpointer="xpointer(//e53)"/></e52>
<e53><xi:include xpointer="xpointer(//e54)"/></e53>
<e54><xi:include xpointer="xpointer(//e55)"/></e54>
<e55><xi:include xpointer="xpointer(//e56)"/></e55>
<e56><xi:include xpointer="xpointer(//e57)"/></e56>
<e57><xi:include xpointer="xpointer(//e58)"/></e57>
<e58><xi:include xpointer="xpointer(//e59)"/></e58>
<e59><xi:include xpointer="xpointer(//e60)"/></e59>
<e60><xi:include xpointer="xpointer(//e61)"/></e60>
<e61><xi:include xpointer="xpointer(//e62)"/></e61>
<e62><xi:include xpointer="xpointer(//e63)"/></e62>
<e63><xi:include xpointer="xpointer(//e64)"/></e63>
<e64><xi:include xpointer="xpointer(//e65)"/></e64>
<e65><xi:include xpointer="xpointer(//e66)"/></e65>
<e66><xi:include xpointer="xpointer(//e67)"/></e66>
<e67><xi:include xpointer="xpointer(//e68)"/></e67>
<e68><xi:include xpointer="xpointer(//e69)"/></e68>
<e69><xi:include xpointer="xpointer(//e70)"/></e69>
<e70><xi:include xpointer="xpointer(//e71)"/></e70>
<e71><xi:include xpointer="xpointer(//e72)"/></e71>
<e72><xi:include xpointer="xpointer(//e73)"/></e72>
<e73><xi:include xpointer="xpointer(//e74)"/></e73>
<e74><xi:include xpointer="xpointer(//e75)"/></e74>
<e75><xi:include xpointer="xpointer(//e76)"/></e75>
<e76><xi:include xpointer="xpointer(//e77)"/></e76>
<e77><xi:include xpointer="xpointer(//e78)"/></e77>
<e78><xi:include xpointer="xpointer(//e79)"/></e78>
<e79><xi:include xpointer="xpointer(//e80)"/></e79>
<e80><xi:include xpointer="xpointer(//e81)"/></e80>
<e81><xi:include xpointer="xpointer(//e82)"/></e81>
<e82><xi:include xpointer="xpointer(//e83)"/></e82>
<e83><xi:include xpointer="xpointer(//e84)"/></e83>
<e84><xi:include xpointer="xpointer(//e85)"/></e84>
<e85><xi:include xpointer="xpointer(//e86)"/></e85>
<e86><xi:include xpointer="xpointer(//e87)"/></e86>
<e87><xi:include xpointer="xpointer(//e88)"/></e87>
<e88><xi:include xpointer="xpointer(//e89)"/></e88>
<e89><xi:include xpointer="xpointer(//e90)"/></e89>
<e90><xi:include xpointer="xpointer(//e91)"/></e90>
<e91><xi:include xpointer="xpointer(//e92)"/></e91>
<e92><xi:include xpointer="xpointer(//e93)"/></e92>
<e93><xi:include xpointer="xpointer(//e94)"/></e93>
<e94><xi:include xpointer="xpointer(//e95)"/></e94>
<e95><xi:include xpointer="xpointer(//e96)"/></e95>
<e96><xi:include xpointer="xpointer(//e97)"/></e96>
<e97><xi:include xpointer="xpointer(//e98)"/></e97>
<e98><xi:include xpointer="xpointer(//e99)"/></e98>
<e99><xi:include xpointer="xpointer(//e100)"/></e99>
<e100><xi:include xpointer="xpointer(//e101)"/></e100>
<e101/>
</x>

9
xinclude.c
View File

@@ -90,6 +90,7 @@ struct _xmlXIncludeCtxt {
void *_private; /* application data */
unsigned long incTotal; /* total number of processed inclusions */
int depth; /* recursion depth */
};
static xmlXIncludeRefPtr
@@ -2036,6 +2037,12 @@ static xmlXIncludeRefPtr
xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
int nr, i;
if (ctxt->depth >= XINCLUDE_MAX_DEPTH) {
xmlXIncludeErr(ctxt, node, XML_XINCLUDE_RECURSION,
"maximum recursion depth exceeded\n", NULL);
return(NULL);
}
for (i = ctxt->incBase; i < ctxt->incNr; i++) {
if (ctxt->incTab[i]->ref == node) {
if (ctxt->incTab[i]->expanding) {
@@ -2051,7 +2058,9 @@ xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
return(NULL);
nr = ctxt->incNr - 1;
ctxt->incTab[nr]->expanding = 1;
ctxt->depth++;
xmlXIncludeLoadNode(ctxt, nr);
ctxt->depth--;
ctxt->incTab[nr]->expanding = 0;
return(ctxt->incTab[nr]);