Changeset 45449 in vbox for trunk/src/libs/libxml2-2.6.31

Timestamp:

Apr 10, 2013 8:39:01 AM (12 years ago)

Author:

vboxsync

Message:

libxml2: fixes from upstream

Location:

trunk/src/libs/libxml2-2.6.31

Files:

• include/libxml/parser.h (modified) (1 diff)
• include/libxml/parserInternals.h (modified) (1 diff)
• parser.c (modified) (9 diffs)
• parserInternals.c (modified) (1 diff)

trunk/src/libs/libxml2-2.6.31/include/libxml/parser.h

@@ -300 +300 @@
     unsigned long    nbentities;    /* number of entities references */
     unsigned long  sizeentities;    /* size of parsed entities */
+    unsigned long      sizeentcopy;   /* volume of entity copy */
 };
 

trunk/src/libs/libxml2-2.6.31/include/libxml/parserInternals.h

@@ -30 +30 @@
  */
 XMLPUBVAR unsigned int xmlParserMaxDepth;
+
+/**
+ * XML_MAX_TEXT_LENGTH:
+ *
+ * Maximum size allowed for a single text node when building a tree.
+ * This is not a limitation of the parser but a safety boundary feature,
+ * use XML_PARSE_HUGE option to override it.
+ */
+#define XML_MAX_TEXT_LENGTH 10000000
 
  /**

trunk/src/libs/libxml2-2.6.31/parser.c

@@ -112 +112 @@
 static int
 xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
-                     xmlEntityPtr ent)
+                     xmlEntityPtr ent, size_t replacement)
 {
     size_t consumed = 0;
@@ -120 +120 @@
     if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
         return (1);
-    if (size != 0) {
+    if (replacement != 0) {
+        if (replacement < XML_MAX_TEXT_LENGTH)
+            return(0);
+
+        /*
+         * If the volume of entity copy reaches 10 times the
+         * amount of parsed data and over the large text threshold
+         * then that's very likely to be an abuse.
+         */
+        if (ctxt->input != NULL) {
+            consumed = ctxt->input->consumed +
+                       (ctxt->input->cur - ctxt->input->base);
+        }
+        consumed += ctxt->sizeentities;
+
+        if (replacement < XML_PARSER_NON_LINEAR * consumed)
+            return(0);
+    } else if (size != 0) {
         /*
          * Do the check based on the replacement size of the entity
@@ -166 +183 @@
         return (0);
     }
-
     xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
     return (1);
@@ -2379 +2395 @@
                         buffer[nbchars++] = *current++;
                         if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
-                            if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
+                            if (xmlParserEntityCheck(ctxt, nbchars, ent, 0)) {
                                 xmlFree(rep);
                                 goto int_error;
@@ -2421 +2437 @@
                         buffer[nbchars++] = *current++;
                         if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
-                            if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
+                            if (xmlParserEntityCheck(ctxt, nbchars, ent, 0)) {
                                 xmlFree(rep);
                                 goto int_error;
@@ -6278 +6294 @@
                         return;
                     }
-                    if (xmlParserEntityCheck(ctxt, 0, ent)) {
+                    if (xmlParserEntityCheck(ctxt, 0, ent, 0)) {
                         xmlFreeNodeList(list);
                         return;
@@ -6431 +6447 @@
 
                         /*
+                         * We are copying here, make sure there is no abuse
+                         */
+                        ctxt->sizeentcopy += ent->length;
+                        if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy))
+                            return;
+
+                        /*
                          * when operating on a reader, the entities definitions
                          * are always owning the entities subtree.
@@ -6470 +6493 @@
                         xmlNodePtr nw = NULL, cur, next, last,
                                    firstChild = NULL;
+
+                        /*
+                         * We are copying here, make sure there is no abuse
+                         */
+                        ctxt->sizeentcopy += ent->length;
+                        if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy))
+                            return;
+
                         /*
                          * Copy the entity child list and make it the new
@@ -13308 +13339 @@
     ctxt->nbentities = 0;
     ctxt->sizeentities = 0;
+    ctxt->sizeentcopy = 0;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
 

trunk/src/libs/libxml2-2.6.31/parserInternals.c

@@ -1672 +1672 @@
     ctxt->catalogs = NULL;
     ctxt->nbentities = 0;
+    ctxt->sizeentities = 0;
+    ctxt->sizeentcopy = 0;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
     return(0);