Changeset 58076 in vbox for trunk

Timestamp:

Oct 7, 2015 9:47:57 AM (9 years ago)

Author:

vboxsync

Message:

upstream fixes post 2.9.2

Location:

trunk/src/libs/libxml2-2.9.2

Files:

• buf.c (modified) (6 diffs)
• include/libxml/tree.h (modified) (1 diff)
• parser.c (modified) (9 diffs)
• tree.c (modified) (1 diff)
• valid.c (modified) (1 diff)
• xmlmemory.c (modified) (2 diffs)
• xmlreader.c (modified) (4 diffs)
• xmlschemas.c (modified) (3 diffs)
• xpath.c (modified) (1 diff)

trunk/src/libs/libxml2-2.9.2/buf.c

@@ -28 +28 @@
 #include <libxml/globals.h>
 #include <libxml/tree.h>
+#include <libxml/parserInternals.h> /* for XML_MAX_TEXT_LENGTH */
 #include "buf.h"
 
@@ -300 +301 @@
         (scheme == XML_BUFFER_ALLOC_EXACT) ||
         (scheme == XML_BUFFER_ALLOC_HYBRID) ||
-        (scheme == XML_BUFFER_ALLOC_IMMUTABLE)) {
+        (scheme == XML_BUFFER_ALLOC_IMMUTABLE) ||
+        (scheme == XML_BUFFER_ALLOC_BOUNDED)) {
         buf->alloc = scheme;
         if (buf->buffer)
@@ -459 +461 @@
 #endif
 
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+        /*
+         * Used to provide parsing limits
+         */
+        if ((buf->use + len >= XML_MAX_TEXT_LENGTH) ||
+            (buf->size >= XML_MAX_TEXT_LENGTH)) {
+            xmlBufMemoryError(buf, "buffer error: text too long\n");
+            return(0);
+        }
+        if (size >= XML_MAX_TEXT_LENGTH)
+            size = XML_MAX_TEXT_LENGTH;
+    }
     if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) {
         size_t start_buf = buf->content - buf->contentIO;
@@ -740 +754 @@
 
     if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0);
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+        /*
+         * Used to provide parsing limits
+         */
+        if (size >= XML_MAX_TEXT_LENGTH) {
+            xmlBufMemoryError(buf, "buffer error: text too long\n");
+            return(0);
+        }
+    }
 
     /* Don't resize if we don't have to */
@@ -868 +891 @@
     needSize = buf->use + len + 2;
     if (needSize > buf->size){
+        if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+            /*
+             * Used to provide parsing limits
+             */
+            if (needSize >= XML_MAX_TEXT_LENGTH) {
+                xmlBufMemoryError(buf, "buffer error: text too long\n");
+                return(-1);
+            }
+        }
         if (!xmlBufResize(buf, needSize)){
             xmlBufMemoryError(buf, "growing buffer");
@@ -939 +971 @@
     needSize = buf->use + len + 2;
     if (needSize > buf->size){
+        if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+            /*
+             * Used to provide parsing limits
+             */
+            if (needSize >= XML_MAX_TEXT_LENGTH) {
+                xmlBufMemoryError(buf, "buffer error: text too long\n");
+                return(-1);
+            }
+        }
         if (!xmlBufResize(buf, needSize)){
             xmlBufMemoryError(buf, "growing buffer");

trunk/src/libs/libxml2-2.9.2/include/libxml/tree.h

@@ -77 +77 @@
     XML_BUFFER_ALLOC_IMMUTABLE, /* immutable buffer */
     XML_BUFFER_ALLOC_IO,        /* special allocation scheme used for I/O */
-    XML_BUFFER_ALLOC_HYBRID     /* exact up to a threshold, and doubleit thereafter */
+    XML_BUFFER_ALLOC_HYBRID,    /* exact up to a threshold, and doubleit thereafter */
+    XML_BUFFER_ALLOC_BOUNDED    /* limit the upper size of the buffer */
 } xmlBufferAllocationScheme;
 

trunk/src/libs/libxml2-2.9.2/parser.c

@@ -5659 +5659 @@
             xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
                     "xmlParseEntityDecl: entity %s not terminated\n", name);
+            xmlStopParser(ctxt);
         } else {
             if (input != ctxt->input) {
@@ -6770 +6771 @@
         if (RAW != '[') {
             xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+            xmlStopParser(ctxt);
+            return;
         } else {
             if (ctxt->input->id != id) {
@@ -6830 +6833 @@
         if (RAW != '[') {
             xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+            xmlStopParser(ctxt);
+            return;
         } else {
             if (ctxt->input->id != id) {
@@ -6885 +6890 @@
     } else {
         xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
+        xmlStopParser(ctxt);
+        return;
     }
 
@@ -7236 +7243 @@
      * the document entity by default.
      */
-    if ((ent->checked == 0) &&
+    if (((ent->checked == 0) ||
+         ((ent->children == NULL) && (ctxt->options & XML_PARSE_NOENT))) &&
         ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) ||
          (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) {
@@ -10397 +10405 @@
             if (RAW != '"') {
                 xmlFatalErr(ctxt, XML_ERR_STRING_NOT_CLOSED, NULL);
+                xmlFree((xmlChar *) encoding);
+                return(NULL);
             } else
                 NEXT;
@@ -10404 +10414 @@
             if (RAW != '\'') {
                 xmlFatalErr(ctxt, XML_ERR_STRING_NOT_CLOSED, NULL);
+                xmlFree((xmlChar *) encoding);
+                return(NULL);
             } else
                 NEXT;
@@ -10460 +10472 @@
             handler = xmlFindCharEncodingHandler((const char *) encoding);
             if (handler != NULL) {
-                xmlSwitchToEncoding(ctxt, handler);
+                if (xmlSwitchToEncoding(ctxt, handler) < 0) {
+                    /* failed to convert */
+                    ctxt->errNo = XML_ERR_UNSUPPORTED_ENCODING;
+                    return(NULL);
+                }
             } else {
                 xmlFatalErrMsgStr(ctxt, XML_ERR_UNSUPPORTED_ENCODING,
@@ -14831 +14847 @@
         xmlXPathInit();
 #endif
-#ifdef LIBXML_CATALOG_ENABLED
-        xmlInitializeCatalog();
-#endif
         xmlParserInitialized = 1;
 #ifdef LIBXML_THREAD_ENABLED

trunk/src/libs/libxml2-2.9.2/tree.c

@@ -2800 +2800 @@
             prop = tree->properties;
             while (prop != NULL) {
+                if (prop->atype == XML_ATTRIBUTE_ID) {
+                    xmlRemoveID(tree->doc, prop);
+                }
+
                 prop->doc = doc;
                 xmlSetListDoc(prop->children, doc);
+
+                if (xmlIsID(doc, tree, prop)) {
+                    xmlChar *idVal = xmlNodeListGetString(doc, prop->children,
+                                                          1);
+                    xmlAddID(NULL, doc, idVal, prop);
+                }
+
                 prop = prop->next;
             }

trunk/src/libs/libxml2-2.9.2/valid.c

@@ -2635 +2635 @@
          * The id is already defined in this DTD.
          */
-        xmlErrValidNode(ctxt, attr->parent, XML_DTD_ID_REDEFINED,
-                        "ID %s already defined\n", value, NULL, NULL);
+        if (ctxt != NULL) {
+            xmlErrValidNode(ctxt, attr->parent, XML_DTD_ID_REDEFINED,
+                            "ID %s already defined\n", value, NULL, NULL);
+        }
 #endif /* LIBXML_VALID_ENABLED */
         xmlFreeID(ret);

trunk/src/libs/libxml2-2.9.2/xmlmemory.c

@@ -555 +555 @@
 int
 xmlMemUsed(void) {
-     return(debugMemSize);
+    int res;
+
+    xmlMutexLock(xmlMemMutex);
+    res = debugMemSize;
+    xmlMutexUnlock(xmlMemMutex);
+    return(res);
 }
 
@@ -568 +573 @@
 int
 xmlMemBlocks(void) {
-     return(debugMemBlocks);
+    int res;
+
+    xmlMutexLock(xmlMemMutex);
+    res = debugMemBlocks;
+    xmlMutexUnlock(xmlMemMutex);
+    return(res);
 }
 

trunk/src/libs/libxml2-2.9.2/xmlreader.c

@@ -2092 +2092 @@
         return(NULL);
     }
+    /* no operation on a reader should require a huge buffer */
+    xmlBufSetAllocationScheme(ret->buffer,
+                              XML_BUFFER_ALLOC_BOUNDED);
     ret->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));
     if (ret->sax == NULL) {
@@ -3617 +3620 @@
         case XML_ATTRIBUTE_NODE:{
             xmlAttrPtr attr = (xmlAttrPtr) node;
+            const xmlChar *ret;
 
             if ((attr->children != NULL) &&
@@ -3630 +3634 @@
                         return (NULL);
                     }
+                    xmlBufSetAllocationScheme(reader->buffer,
+                                              XML_BUFFER_ALLOC_BOUNDED);
                 } else
                     xmlBufEmpty(reader->buffer);
                 xmlBufGetNodeContent(reader->buffer, node);
-                return(xmlBufContent(reader->buffer));
+                ret = xmlBufContent(reader->buffer);
+                if (ret == NULL) {
+                    /* error on the buffer best to reallocate */
+                    xmlBufFree(reader->buffer);
+                    reader->buffer = xmlBufCreateSize(100);
+                    xmlBufSetAllocationScheme(reader->buffer,
+                                              XML_BUFFER_ALLOC_BOUNDED);
+                    ret = BAD_CAST "";
+                }
+                return(ret);
             }
             break;
@@ -5132 +5147 @@
         return (-1);
     }
+    /* no operation on a reader should require a huge buffer */
+    xmlBufSetAllocationScheme(reader->buffer,
+                              XML_BUFFER_ALLOC_BOUNDED);
     if (reader->sax == NULL)
         reader->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));

trunk/src/libs/libxml2-2.9.2/xmlschemas.c

@@ -24187 +24187 @@
             goto pattern_and_enum;
     }
+
     /*
     * Whitespace handling is only of importance for string-based
@@ -24197 +24198 @@
     } else
         ws = XML_SCHEMA_WHITESPACE_COLLAPSE;
+
     /*
     * If the value was not computed (for string or
@@ -24202 +24204 @@
     * type.
     */
-    if (val == NULL)
-        valType = valType;
-    else
+    if (val != NULL)
         valType = xmlSchemaGetValType(val);
 

trunk/src/libs/libxml2-2.9.2/xpath.c

@@ -362 +362 @@
      * compute depth to root
      */
-    for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {
-        if (cur == node1)
+    for (depth2 = 0, cur = node2; cur->parent != NULL; cur = cur->parent) {
+        if (cur->parent == node1)
             return(1);
         depth2++;
     }
     root = cur;
-    for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {
-        if (cur == node2)
+    for (depth1 = 0, cur = node1; cur->parent != NULL; cur = cur->parent) {
+        if (cur->parent == node2)
             return(-1);
         depth1++;