Noetic: Fix XMLRPC endless loop

utilities/xmlrpcpp/include/xmlrpcpp/XmlRpcUtil.h

@@ -84,7 +84,9 @@ namespace XmlRpc {
   class XMLRPCPP_DECL XmlRpcUtil {
   public:
     // hokey xml parsing
-    //! Returns contents between <tag> and </tag>, updates offset to char after </tag>
+    //! Returns contents between <tag> and </tag>, updates offset to char after </tag>.
+    //! This method will skip *any* intermediate string to find the tag; as such, it is
+    //! unsafe to use in general, and `nextTagData` should be used instead.
     static std::string parseTag(const char* tag, std::string const& xml, int* offset);
 
     //! Returns true if the tag is found and updates offset to the char after the tag
@@ -98,6 +100,9 @@ namespace XmlRpc {
     //! and updates offset to the char after the tag
     static bool nextTagIs(const char* tag, std::string const& xml, int* offset);
 
+    //! Returns contents between <tag> and </tag> at the specified offset (modulo any whitespace),
+    //! and updates offset to char after </tag>
+    static std::string nextTagData(const char* tag, std::string const& xml, int* offset);
 
     //! Convert raw text to encoded xml.
     static std::string xmlEncode(const std::string& raw);

utilities/xmlrpcpp/src/XmlRpcUtil.cpp

@@ -106,9 +106,12 @@ void XmlRpcUtil::error(const char* fmt, ...)
 
 
 // Returns contents between <tag> and </tag>, updates offset to char after </tag>
+// This method will skip *any* intermediate string to find the tag; as such, it is
+// unsafe to use in general, and `nextTagData` should be used instead.
 std::string 
 XmlRpcUtil::parseTag(const char* tag, std::string const& xml, int* offset)
 {
+  if (offset == NULL) return std::string();
   // avoid attempting to parse overly long xml input
   if (xml.length() > size_t(INT_MAX)) return std::string();
   if (*offset >= int(xml.length())) return std::string();
@@ -129,6 +132,7 @@ XmlRpcUtil::parseTag(const char* tag, std::string const& xml, int* offset)
 bool 
 XmlRpcUtil::findTag(const char* tag, std::string const& xml, int* offset)
 {
+  if (offset == NULL) return false;
   if (xml.length() > size_t(INT_MAX)) return false;
   if (*offset >= int(xml.length())) return false;
   size_t istart = xml.find(tag, *offset);
@@ -145,6 +149,7 @@ XmlRpcUtil::findTag(const char* tag, std::string const& xml, int* offset)
 bool 
 XmlRpcUtil::nextTagIs(const char* tag, std::string const& xml, int* offset)
 {
+  if (offset == NULL) return false;
   if (xml.length() > size_t(INT_MAX)) return false;
   if (*offset >= int(xml.length())) return false;
   const char* cp = xml.c_str() + *offset;
@@ -162,11 +167,64 @@ XmlRpcUtil::nextTagIs(const char* tag, std::string const& xml, int* offset)
   return false;
 }
 
+// Returns contents between <tag> and </tag> at the specified offset (modulo any whitespace),
+// and updates offset to char after </tag>
+std::string
+XmlRpcUtil::nextTagData(const char* tag, std::string const& xml, int* offset)
+{
+  if (offset == NULL) return std::string();
+  if (xml.length() > size_t(INT_MAX)) return std::string();
+  if (*offset >= int(xml.length())) return std::string();
+
+  const char* start_cp = xml.c_str() + *offset;
+  const char* cp = start_cp;
+  while (*cp && isspace(*cp)) {
+    ++cp;
+  }
+
+  const int len = int(strnlen(tag, xml.length()));
+  // Check if the tag is next; if not, we'll get out of here
+  if (!(*cp) || (strncmp(cp, tag, len) != 0)) {
+    return std::string();
+  }
+
+  cp += len;
+
+  // Now collect all of the data up to the next tag
+  std::string ret;
+  while (*cp) {
+    if (*cp == '<') {
+      break;
+    }
+    ret += *cp;
+    cp++;
+  }
+
+  if (!(*cp)) {
+    return std::string();
+  }
+
+  // Now find the end tag
+  std::string etag = "</";
+  etag += tag + 1;
+
+  if (strncmp(cp, etag.c_str(), etag.length()) != 0) {
+    return std::string();
+  }
+
+  cp += etag.length();
+
+  *offset += (cp - start_cp);
+
+  return ret;
+}
+
 // Returns the next tag and updates offset to the char after the tag, or empty string
 // if the next non-whitespace character is not '<'
 std::string 
 XmlRpcUtil::getNextTag(std::string const& xml, int* offset)
 {
+  if (offset == NULL) return std::string();
   if (xml.length() > size_t(INT_MAX)) return std::string();
   if (*offset >= int(xml.length())) return std::string();
 

utilities/xmlrpcpp/src/XmlRpcValue.cpp

@@ -231,6 +231,8 @@ namespace XmlRpc {
   // should be the start of a <value> tag. Destroys any existing value.
   bool XmlRpcValue::fromXml(std::string const& valueXml, int* offset)
   {
+    if (offset == NULL) return false;
+
     int savedOffset = *offset;
 
     invalidate();
@@ -566,7 +568,7 @@ namespace XmlRpc {
 
     while (XmlRpcUtil::nextTagIs(MEMBER_TAG, valueXml, offset)) {
       // name
-      const std::string name = XmlRpcUtil::parseTag(NAME_TAG, valueXml, offset);
+      const std::string name = XmlRpcUtil::nextTagData(NAME_TAG, valueXml, offset);
       // value
       XmlRpcValue val(valueXml, offset);
       if ( ! val.valid()) {