Attachment 314908 Details for Bug 459830 – New patch for RHEL-3 reusing the owner field

[patch] New patch for RHEL-3 reusing the owner field

libxml2-2.5.10-billion_laught-2.patch (text/plain), 8.04 KB, created by Daniel Veillard on 2008-08-25 08:06:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Veillard

Created: 2008-08-25 08:06:01 UTC

Size: 8.04 KB

patch

obsolete

>--- include/libxml/parser.h.orig	2003-04-24 14:04:00.000000000 +0200
>+++ include/libxml/parser.h	2008-08-25 09:27:57.000000000 +0200
>@@ -234,6 +234,7 @@ struct _xmlParserCtxt {
>     void              *catalogs;       /* document's own catalog */
>     int                recovery;      /* run in recovery mode */
>     int                progressive;   /* is this a progressive parsing */
>+    unsigned long      nbentities;    /* number of entities references */
> };
> 
> /**
>Index: parserInternals.c
>===================================================================
>--- parserInternals.c	(revision 3771)
>+++ parserInternals.c	(working copy)
>@@ -1670,6 +1670,7 @@ xmlInitParserCtxt(xmlParserCtxtPtr ctxt)
>     ctxt->depth = 0;
>     ctxt->charset = XML_CHAR_ENCODING_UTF8;
>     ctxt->catalogs = NULL;
>+    ctxt->nbentities = 0;
>     xmlInitNodeInfoSeq(&ctxt->node_seq);
>     return(0);
> }
>--- entities.c.orig	2004-11-05 16:37:00.000000000 +0100
>+++ entities.c	2008-08-23 12:09:22.000000000 +0200
>@@ -92,7 +92,7 @@ xmlEntitiesErr(xmlParserErrors code, con
> static void xmlFreeEntity(xmlEntityPtr entity) {
>     if (entity == NULL) return;
> 
>-    if ((entity->children) && (entity->owner == 1) &&
>+    if ((entity->children) && (entity->owner != 0) &&
> 	(entity == (xmlEntityPtr) entity->children->parent))
> 	xmlFreeNodeList(entity->children);
>     if (entity->name != NULL)
>--- parser.c.orig	2003-08-15 01:42:29.000000000 +0200
>+++ parser.c	2008-08-25 09:44:05.000000000 +0200
>@@ -1061,7 +1061,7 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
>     if (str == NULL)
> 	return(NULL);
> 
>-    if (ctxt->depth > 40) {
>+    if ((ctxt->depth > 40) || (ctxt->nbentities >= 500000)) {
> 	ctxt->errNo = XML_ERR_ENTITY_LOOP;
> 	if ((ctxt->sax != NULL) && (ctxt->sax->error != NULL))
> 	    ctxt->sax->error(ctxt->userData,
>@@ -1102,6 +1102,11 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
> 			"String decoding Entity Reference: %.30s\n",
> 			str);
> 	    ent = xmlParseStringEntityRef(ctxt, &str);
>+	    if (ctxt->errNo == XML_ERR_ENTITY_LOOP)
>+	        goto int_error;
>+	    ctxt->nbentities++;
>+	    if (ent != NULL)
>+	        ctxt->nbentities += ent->owner;
> 	    if ((ent != NULL) &&
> 		(ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
> 		if (ent->content != NULL) {
>@@ -1146,6 +1151,11 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
> 		xmlGenericError(xmlGenericErrorContext,
> 			"String decoding PE Reference: %.30s\n", str);
> 	    ent = xmlParseStringPEReference(ctxt, &str);
>+	    if (ctxt->errNo == XML_ERR_ENTITY_LOOP)
>+	        goto int_error;
>+	    ctxt->nbentities++;
>+	    if (ent != NULL)
>+	        ctxt->nbentities += ent->owner;
> 	    if (ent != NULL) {
> 		xmlChar *rep;
> 
>@@ -1176,6 +1186,10 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
>     }
>     buffer[nbchars++] = 0;
>     return(buffer);
>+int_error:
>+    if (buffer != NULL)
>+        xmlFree(buffer);
>+    return(NULL);
> }
> 
> 
>@@ -2527,6 +2541,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr
> 		}
> 	    } else {
> 		ent = xmlParseEntityRef(ctxt);
>+		ctxt->nbentities++;
>+		if (ent != NULL)
>+		    ctxt->nbentities += ent->owner;
> 		if ((ent != NULL) && 
> 		    (ctxt->replaceEntities != 0)) {
> 		    xmlChar *rep;
>@@ -3595,6 +3612,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
>     int isParameter = 0;
>     xmlChar *orig = NULL;
>     int skipped;
>+    unsigned long oldnbent = ctxt->nbentities;
>     
>     GROW;
>     if ((RAW == '<') && (NXT(1) == '!') &&
>@@ -3870,6 +3888,11 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
> 		}
> 	    }
>             if (cur != NULL) {
>+	        if ((cur->owner != 0) || (cur->children == NULL)) {
>+		    cur->owner = ctxt->nbentities - oldnbent;
>+		    if (cur->owner ==  0)
>+		        cur->owner = 1;
>+		}
> 	        if (cur->orig != NULL)
> 		    xmlFree(orig);
> 		else
>@@ -5480,6 +5503,16 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 	if (ent == NULL) return;
> 	if (!ctxt->wellFormed)
> 	    return;
>+	ctxt->nbentities++;
>+	if (ctxt->nbentities >= 500000) {
>+	    ctxt->errNo = XML_ERR_ENTITY_LOOP;
>+	    if ((ctxt->sax != NULL) && (ctxt->sax->error != NULL))
>+	        ctxt->sax->error(ctxt->userData,
>+		    "Detected entity reference loop\n");
>+	    ctxt->wellFormed = 0;
>+	    if (ctxt->recovery == 0) ctxt->disableSAX = 1;
>+	    return;
>+	}
> 	if ((ent->name != NULL) && 
> 	    (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY)) {
> 	    xmlNodePtr list = NULL;
>@@ -5529,7 +5562,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			    (ent->children == NULL)) {
> 			    ent->children = list;
> 			    ent->last = list;
>-			    ent->owner = 1;
>+			    if (ent->owner == 0)
>+				ent->owner = 1;
> 			    list->parent = (xmlNodePtr) ent;
> 			} else {
> 			    xmlFreeNodeList(list);
>@@ -5538,6 +5572,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			xmlFreeNodeList(list);
> 		    }
> 		} else {
>+		    unsigned long oldnbent = ctxt->nbentities;
> 		    /*
> 		     * 4.3.2: An internal general parsed entity is well-formed
> 		     * if its replacement text matches the production labeled
>@@ -5560,6 +5595,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			ret = xmlParseBalancedChunkMemoryInternal(ctxt,
> 					   value, user_data, &list);
> 			ctxt->depth--;
>+
> 		    } else if (ent->etype ==
> 			       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
> 			ctxt->depth++;
>@@ -5573,6 +5609,11 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			    ctxt->sax->error(ctxt->userData,
> 				"Internal: invalid entity type\n");
> 		    }
>+		    if ((ent->owner != 0) || (ent->children == NULL)) {
>+			ent->owner = ctxt->nbentities - oldnbent;
>+			if (ent->owner == 0)
>+			    ent->owner = 1;
>+		    }
> 		    if (ret == XML_ERR_ENTITY_LOOP) {
> 			ctxt->errNo = XML_ERR_ENTITY_LOOP;
> 			if ((ctxt->sax != NULL) && (ctxt->sax->error != NULL))
>@@ -5595,7 +5636,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 				    (list->next == NULL)) {
> 				    list->parent = (xmlNodePtr) ent;
> 				    list = NULL;
>-				    ent->owner = 1;
>+				    if (ent->owner == 0)
>+					ent->owner = 1;
> 				} else {
> 				    ent->owner = 0;
> 				    while (list != NULL) {
>@@ -5610,7 +5652,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 				      xmlAddEntityReference(ent, list, NULL);
> 				}
> 			    } else {
>-				ent->owner = 1;
>+			        if (ent->owner == 0)
>+				    ent->owner = 1;
> 				while (list != NULL) {
> 				    list->parent = (xmlNodePtr) ent;
> 				    if (list->next == NULL)
>@@ -5635,6 +5678,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 		    }
> 		}
> 	    }
>+	    ctxt->nbentities += ent->owner;
> 	    if ((ctxt->sax != NULL) && (ctxt->sax->reference != NULL) &&
> 		(ctxt->replaceEntities == 0) && (!ctxt->disableSAX)) {
> 		/*
>@@ -5697,7 +5741,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 				break;
> 			    cur = next;
> 			}
>-			ent->owner = 1;
>+			if (ent->owner == 0)
>+			    ent->owner = 1;
> 			if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY)			      
> 			  xmlAddEntityReference(ent, firstChild, nw);
> 		    } else {
>@@ -9713,7 +9758,7 @@ xmlParseCtxtExternalEntity(xmlParserCtxt
>     xmlChar start[4];
>     xmlCharEncoding enc;
> 
>-    if (ctx->depth > 40) {
>+    if ((ctx->depth > 40) || (ctx->nbentities >= 500000)) {
> 	return(XML_ERR_ENTITY_LOOP);
>     }
> 
>@@ -9894,7 +9939,8 @@ xmlParseExternalEntityPrivate(xmlDocPtr 
>     xmlChar start[4];
>     xmlCharEncoding enc;
> 
>-    if (depth > 40) {
>+    if ((depth > 40) ||
>+        ((oldctxt != NULL) && (oldctxt->nbentities >= 500000))) {
> 	return(XML_ERR_ENTITY_LOOP);
>     }
> 
>@@ -10053,6 +10099,7 @@ xmlParseExternalEntityPrivate(xmlDocPtr 
>     oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
>     oldctxt->node_seq.length = ctxt->node_seq.length;
>     oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
>+    oldctxt->nbentities += ctxt->nbentities;
>     ctxt->node_seq.maximum = 0;
>     ctxt->node_seq.length = 0;
>     ctxt->node_seq.buffer = NULL;
>@@ -10149,7 +10196,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP
>     int size;
>     int ret = 0;
> 
>-    if (oldctxt->depth > 40) {
>+    if ((oldctxt->depth > 40) || (oldctxt->nbentities >= 500000)) {
> 	return(XML_ERR_ENTITY_LOOP);
>     }
> 
>@@ -10264,6 +10311,7 @@ xmlParseBalancedChunkMemoryInternal(xmlP
>         ctxt->myDoc->children = content;
>     }
> 	
>+    oldctxt->nbentities += ctxt->nbentities;
>     ctxt->sax = oldsax;
>     xmlFreeParserCtxt(ctxt);
>     if (newDoc != NULL)

Actions: View | Diff

Attachments on bug 459830: 314849 | 314860 | 314862 | 314863 | 314908