Skip to content

Commit 899a5d9

Browse files
committed
Detect infinite recursion in parameter entities
When expanding a parameter entity in a DTD, infinite recursion could lead to an infinite loop or memory exhaustion. Thanks to Wei Lei for the first of many reports. Fixes bug 759579.
1 parent fb56f80 commit 899a5d9

File tree

5 files changed

+34
-1
lines changed

5 files changed

+34
-1
lines changed

Diff for: parser.c

+10-1
Original file line numberDiff line numberDiff line change
@@ -2250,6 +2250,13 @@ xmlPushInput(xmlParserCtxtPtr ctxt, xmlParserInputPtr input) {
22502250
xmlGenericError(xmlGenericErrorContext,
22512251
"Pushing input %d : %.30s\n", ctxt->inputNr+1, input->cur);
22522252
}
2253+
if (((ctxt->inputNr > 40) && ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
2254+
(ctxt->inputNr > 1024)) {
2255+
xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
2256+
while (ctxt->inputNr > 1)
2257+
xmlFreeInputStream(inputPop(ctxt));
2258+
return(-1);
2259+
}
22532260
ret = inputPush(ctxt, input);
22542261
if (ctxt->instate == XML_PARSER_EOF)
22552262
return(-1);
@@ -7916,8 +7923,10 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
79167923
return;
79177924

79187925
input = xmlNewEntityInputStream(ctxt, entity);
7919-
if (xmlPushInput(ctxt, input) < 0)
7926+
if (xmlPushInput(ctxt, input) < 0) {
7927+
xmlFreeInputStream(input);
79207928
return;
7929+
}
79217930

79227931
if (entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) {
79237932
/*

Diff for: result/errors/759579.xml

Whitespace-only changes.

Diff for: result/errors/759579.xml.err

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Entity: line 2: parser error : Detected an entity reference loop
2+
%z; %z; %z; %z; %z;
3+
^
4+
Entity: line 2:
5+
%z; %z; %z; %z; %z;
6+
^

Diff for: result/errors/759579.xml.str

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Entity: line 2: parser error : Detected an entity reference loop
2+
%z; %z; %z; %z; %z;
3+
^
4+
Entity: line 2:
5+
%z; %z; %z; %z; %z;
6+
^
7+
./test/errors/759579.xml : failed to parse

Diff for: test/errors/759579.xml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<!DOCTYPE doc [
2+
<!ENTITY % z '
3+
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
4+
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
5+
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
6+
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
7+
&#37;z; &#37;z; &#37;z; &#37;z; &#37;z;
8+
'>
9+
%z;
10+
]>
11+
<doc/>

0 commit comments

Comments
 (0)