Attachment 315298 Details for Bug 460396 – RHEL-3 Patch corresponding to the new upstream fix

[patch] RHEL-3 Patch corresponding to the new upstream fix

billion_laught.patch (text/plain), 12.03 KB, created by Daniel Veillard on 2008-08-28 21:13:46 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Veillard

Created: 2008-08-28 21:13:46 UTC

Size: 12.03 KB

patch

obsolete

>--- entities.c.orig	2004-11-05 16:37:00.000000000 +0100
>+++ entities.c	2008-08-28 22:15:17.000000000 +0200
>@@ -92,7 +92,7 @@ xmlEntitiesErr(xmlParserErrors code, con
> static void xmlFreeEntity(xmlEntityPtr entity) {
>     if (entity == NULL) return;
> 
>-    if ((entity->children) && (entity->owner == 1) &&
>+    if ((entity->children) && (entity->owner != 0) &&
> 	(entity == (xmlEntityPtr) entity->children->parent))
> 	xmlFreeNodeList(entity->children);
>     if (entity->name != NULL)
>Index: parserInternals.c
>===================================================================
>--- parserInternals.c	(revision 3771)
>+++ parserInternals.c	(working copy)
>@@ -1670,6 +1670,7 @@ xmlInitParserCtxt(xmlParserCtxtPtr ctxt)
>     ctxt->depth = 0;
>     ctxt->charset = XML_CHAR_ENCODING_UTF8;
>     ctxt->catalogs = NULL;
>+    ctxt->nbentities = 0;
>     xmlInitNodeInfoSeq(&ctxt->node_seq);
>     return(0);
> }
>--- include/libxml/parser.h.orig	2003-04-24 14:04:00.000000000 +0200
>+++ include/libxml/parser.h	2008-08-28 22:39:37.000000000 +0200
>@@ -234,6 +234,8 @@ struct _xmlParserCtxt {
>     void              *catalogs;       /* document's own catalog */
>     int                recovery;      /* run in recovery mode */
>     int                progressive;   /* is this a progressive parsing */
>+    unsigned long    nbentities;    /* number of entities references */
>+    unsigned long  sizeentities;    /* size of parsed entities */
> };
> 
> /**
>--- parser.c.orig	2003-08-15 01:42:29.000000000 +0200
>+++ parser.c	2008-08-28 23:02:54.000000000 +0200
>@@ -76,6 +76,97 @@
> #include <zlib.h>
> #endif
> 
>+/************************************************************************
>+ *									*
>+ *	Arbitrary limits set in the parser.				*
>+ *									*
>+ ************************************************************************/
>+
>+#define XML_PARSER_BIG_ENTITY 1000
>+#define XML_PARSER_LOT_ENTITY 5000
>+
>+/*
>+ * XML_PARSER_NON_LINEAR is the threshold where the ratio of parsed entity
>+ *    replacement over the size in byte of the input indicates that you have
>+ *    and eponential behaviour. A value of 10 correspond to at least 3 entity
>+ *    replacement per byte of input.
>+ */
>+#define XML_PARSER_NON_LINEAR 10
>+
>+/*
>+ * xmlParserEntityCheck
>+ *
>+ * Function to check non-linear entity expansion behaviour
>+ * This is here to detect and stop exponential linear entity expansion
>+ * This is not a limitation of the parser but a safety
>+ * boundary feature.
>+ */
>+static int
>+xmlParserEntityCheck(xmlParserCtxtPtr ctxt, unsigned long size,
>+                     xmlEntityPtr ent)
>+{
>+    unsigned long consumed = 0;
>+
>+    if (ctxt == NULL)
>+        return (0);
>+    if (ctxt->errNo == XML_ERR_ENTITY_LOOP)
>+        return (1);
>+    if (size != 0) {
>+        /*
>+         * Do the check based on the replacement size of the entity
>+         */
>+        if (size < XML_PARSER_BIG_ENTITY)
>+	    return(0);
>+
>+        /*
>+         * A limit on the amount of text data reasonably used
>+         */
>+        if (ctxt->input != NULL) {
>+            consumed = ctxt->input->consumed +
>+                (ctxt->input->cur - ctxt->input->base);
>+        }
>+        consumed += ctxt->sizeentities;
>+
>+        if ((size < XML_PARSER_NON_LINEAR * consumed) &&
>+	    (ctxt->nbentities * 3 < XML_PARSER_NON_LINEAR * consumed))
>+            return (0);
>+    } else if (ent != NULL) {
>+        /*
>+         * use the number of parsed entities in the replacement
>+         */
>+        size = ent->owner;
>+
>+        /*
>+         * The amount of data parsed counting entities size only once
>+         */
>+        if (ctxt->input != NULL) {
>+            consumed = ctxt->input->consumed +
>+                (ctxt->input->cur - ctxt->input->base);
>+        }
>+        consumed += ctxt->sizeentities;
>+
>+        /*
>+         * Check the density of entities for the amount of data
>+	 * knowing an entity reference will take at least 3 bytes
>+         */
>+        if (size * 3 < consumed * XML_PARSER_NON_LINEAR)
>+            return (0);
>+    } else {
>+        /*
>+         * strange we got no data for checking just return
>+         */
>+        return (0);
>+    }
>+
>+    ctxt->errNo = XML_ERR_ENTITY_LOOP;
>+    if ((ctxt->sax != NULL) && (ctxt->sax->error != NULL))
>+        ctxt->sax->error(ctxt->userData,
>+	    "Detected entity reference loop\n");
>+    ctxt->wellFormed = 0;
>+    if (ctxt->recovery == 0) ctxt->disableSAX = 1;
>+    return (1);
>+}
>+
> /**
>  * MAX_DEPTH:
>  *
>@@ -1102,6 +1193,10 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
> 			"String decoding Entity Reference: %.30s\n",
> 			str);
> 	    ent = xmlParseStringEntityRef(ctxt, &str);
>+	    if (ctxt->errNo == XML_ERR_ENTITY_LOOP)
>+	        goto int_error;
>+	    if (ent != NULL)
>+	        ctxt->nbentities += ent->owner;
> 	    if ((ent != NULL) &&
> 		(ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
> 		if (ent->content != NULL) {
>@@ -1124,6 +1219,10 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
> 			buffer[nbchars++] = *current++;
> 			if (nbchars >
> 		            buffer_size - XML_PARSER_BUFFER_SIZE) {
>+			    if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
>+			        xmlFree(rep);
>+			        goto int_error;
>+			    }
> 			    growBuffer(buffer);
> 			}
> 		    }
>@@ -1146,6 +1245,10 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
> 		xmlGenericError(xmlGenericErrorContext,
> 			"String decoding PE Reference: %.30s\n", str);
> 	    ent = xmlParseStringPEReference(ctxt, &str);
>+	    if (ctxt->errNo == XML_ERR_ENTITY_LOOP)
>+	        goto int_error;
>+	    if (ent != NULL)
>+	        ctxt->nbentities += ent->owner;
> 	    if (ent != NULL) {
> 		xmlChar *rep;
> 
>@@ -1159,6 +1262,10 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
> 			buffer[nbchars++] = *current++;
> 			if (nbchars >
> 		            buffer_size - XML_PARSER_BUFFER_SIZE) {
>+			    if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
>+			        xmlFree(rep);
>+			        goto int_error;
>+			    }
> 			    growBuffer(buffer);
> 			}
> 		    }
>@@ -1176,6 +1283,10 @@ xmlStringDecodeEntities(xmlParserCtxtPtr
>     }
>     buffer[nbchars++] = 0;
>     return(buffer);
>+int_error:
>+    if (buffer != NULL)
>+        xmlFree(buffer);
>+    return(NULL);
> }
> 
> 
>@@ -3595,6 +3706,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
>     int isParameter = 0;
>     xmlChar *orig = NULL;
>     int skipped;
>+    unsigned long oldnbent = ctxt->nbentities;
>     
>     GROW;
>     if ((RAW == '<') && (NXT(1) == '!') &&
>@@ -3870,6 +3982,11 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt
> 		}
> 	    }
>             if (cur != NULL) {
>+	        if ((cur->owner != 0) || (cur->children == NULL)) {
>+		    cur->owner = ctxt->nbentities - oldnbent;
>+		    if (cur->owner ==  0)
>+		        cur->owner = 1;
>+		}
> 	        if (cur->orig != NULL)
> 		    xmlFree(orig);
> 		else
>@@ -5529,7 +5646,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			    (ent->children == NULL)) {
> 			    ent->children = list;
> 			    ent->last = list;
>-			    ent->owner = 1;
>+			    if (ent->owner == 0)
>+				ent->owner = 1;
> 			    list->parent = (xmlNodePtr) ent;
> 			} else {
> 			    xmlFreeNodeList(list);
>@@ -5538,6 +5656,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			xmlFreeNodeList(list);
> 		    }
> 		} else {
>+		    unsigned long oldnbent = ctxt->nbentities;
> 		    /*
> 		     * 4.3.2: An internal general parsed entity is well-formed
> 		     * if its replacement text matches the production labeled
>@@ -5560,6 +5679,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			ret = xmlParseBalancedChunkMemoryInternal(ctxt,
> 					   value, user_data, &list);
> 			ctxt->depth--;
>+
> 		    } else if (ent->etype ==
> 			       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
> 			ctxt->depth++;
>@@ -5573,6 +5693,29 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			    ctxt->sax->error(ctxt->userData,
> 				"Internal: invalid entity type\n");
> 		    }
>+		    /*
>+		     * Store the number of entities needing parsing for entity
>+		     * content and do checkings
>+		     */
>+		    if ((ent->owner != 0) || (ent->children == NULL)) {
>+			ent->owner = ctxt->nbentities - oldnbent;
>+			if (ent->owner == 0)
>+			    ent->owner = 1;
>+		    }
>+		    if (ret == XML_ERR_ENTITY_LOOP) {
>+			ctxt->errNo = XML_ERR_ENTITY_LOOP;
>+			if ((ctxt->sax != NULL) && (ctxt->sax->error != NULL))
>+			    ctxt->sax->error(ctxt->userData,
>+				"Detected entity reference loop\n");
>+			ctxt->wellFormed = 0;
>+			if (ctxt->recovery == 0) ctxt->disableSAX = 1;
>+			xmlFreeNodeList(list);
>+			return;
>+		    }
>+		    if (xmlParserEntityCheck(ctxt, 0, ent)) {
>+			xmlFreeNodeList(list);
>+			return;
>+		    }
> 		    if (ret == XML_ERR_ENTITY_LOOP) {
> 			ctxt->errNo = XML_ERR_ENTITY_LOOP;
> 			if ((ctxt->sax != NULL) && (ctxt->sax->error != NULL))
>@@ -5595,7 +5738,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 				    (list->next == NULL)) {
> 				    list->parent = (xmlNodePtr) ent;
> 				    list = NULL;
>-				    ent->owner = 1;
>+				    if (ent->owner == 0)
>+					ent->owner = 1;
> 				} else {
> 				    ent->owner = 0;
> 				    while (list != NULL) {
>@@ -5610,7 +5754,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 				      xmlAddEntityReference(ent, list, NULL);
> 				}
> 			    } else {
>-				ent->owner = 1;
>+			        if (ent->owner == 0)
>+				    ent->owner = 1;
> 				while (list != NULL) {
> 				    list->parent = (xmlNodePtr) ent;
> 				    if (list->next == NULL)
>@@ -5634,6 +5779,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
> 			list = NULL;
> 		    }
> 		}
>+	    } else if (ent->owner != 1) {
>+		ctxt->nbentities += ent->owner;
> 	    }
> 	    if ((ctxt->sax != NULL) && (ctxt->sax->reference != NULL) &&
> 		(ctxt->replaceEntities == 0) && (!ctxt->disableSAX)) {
>@@ -5815,6 +5962,11 @@ xmlParseEntityRef(xmlParserCtxtPtr ctxt)
> 	    if (RAW == ';') {
> 	        NEXT;
> 		/*
>+		 * Increase the number of entity references parsed
>+		 */
>+		ctxt->nbentities++;
>+
>+		/*
> 		 * Ask first SAX for entity resolution, otherwise try the
> 		 * predefined set.
> 		 */
>@@ -6013,6 +6165,10 @@ xmlParseStringEntityRef(xmlParserCtxtPtr
> 	    if (*ptr == ';') {
> 	        ptr++;
> 		/*
>+		 * Increase the number of entity references parsed
>+		 */
>+		ctxt->nbentities++;
>+		/*
> 		 * Ask first SAX for entity resolution, otherwise try the
> 		 * predefined set.
> 		 */
>@@ -6200,6 +6356,11 @@ xmlParsePEReference(xmlParserCtxtPtr ctx
> 	} else {
> 	    if (RAW == ';') {
> 	        NEXT;
>+		/*
>+		 * Increase the number of entity references parsed
>+		 */
>+		ctxt->nbentities++;
>+
> 		if ((ctxt->sax != NULL) &&
> 		    (ctxt->sax->getParameterEntity != NULL))
> 		    entity = ctxt->sax->getParameterEntity(ctxt->userData,
>@@ -6345,6 +6506,11 @@ xmlParseStringPEReference(xmlParserCtxtP
> 	    if (cur == ';') {
> 		ptr++;
> 		cur = *ptr;
>+		/*
>+		 * Increase the number of entity references parsed
>+		 */
>+		ctxt->nbentities++;
>+
> 		if ((ctxt->sax != NULL) &&
> 		    (ctxt->sax->getParameterEntity != NULL))
> 		    entity = ctxt->sax->getParameterEntity(ctxt->userData,
>@@ -10048,11 +10214,31 @@ xmlParseExternalEntityPrivate(xmlDocPtr 
> 	}
> 	ret = 0;
>     }
>+
>+    /*
>+     * Record in the parent context the number of entities replacement
>+     * done when parsing that reference.
>+     */
>+    oldctxt->nbentities += ctxt->nbentities;
>+    /*
>+     * Also record the size of the entity parsed
>+     */
>+    if (ctxt->input != NULL) {
>+	oldctxt->sizeentities += ctxt->input->consumed;
>+	oldctxt->sizeentities += (ctxt->input->cur - ctxt->input->base);
>+    }
>+    /*
>+     * And record the last error if any
>+     */
>+    if (ctxt->errNo != XML_ERR_OK)
>+        oldctxt->errNo = ctxt->errNo;
>+
>     if (sax != NULL) 
> 	ctxt->sax = oldsax;
>     oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
>     oldctxt->node_seq.length = ctxt->node_seq.length;
>     oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
>+    oldctxt->nbentities += ctxt->nbentities;
>     ctxt->node_seq.maximum = 0;
>     ctxt->node_seq.length = 0;
>     ctxt->node_seq.buffer = NULL;
>@@ -10264,6 +10450,17 @@ xmlParseBalancedChunkMemoryInternal(xmlP
>         ctxt->myDoc->children = content;
>     }
> 	
>+    /*
>+     * Record in the parent context the number of entities replacement
>+     * done when parsing that reference.
>+     */
>+    oldctxt->nbentities += ctxt->nbentities;
>+    /*
>+     * Also record the last error if any
>+     */
>+    if (ctxt->errNo != XML_ERR_OK)
>+        oldctxt->errNo = ctxt->errNo;
>+
>     ctxt->sax = oldsax;
>     xmlFreeParserCtxt(ctxt);
>     if (newDoc != NULL)

Actions: View | Diff

Attachments on bug 460396: 315291 | 315294 | 315298 | 315310 | 315351 | 315476 | 315477 | 315478 | 315479 | 315480 | 315481 | 315482