External/pugixml
8
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #370 from zeux/xpath-rec

Browse Source 
XPath: Fix stack overflow in functions with long argument lists
This commit is contained in:
Arseny Kapoulkine 2020-09-11 13:06:44 -07:00 committed by GitHub
commit c4bae8d818
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/pugixml.cpp
View File

@ -11541,6 +11541,8 @@ PUGI__NS_BEGIN
return error("Unrecognized function call"); return error("Unrecognized function call");
_lexer.next(); _lexer.next();
size_t old_depth = _depth;
while (_lexer.current() != lex_close_brace) while (_lexer.current() != lex_close_brace)
{ {
if (argc > 0) if (argc > 0)
@ -11550,6 +11552,9 @@ PUGI__NS_BEGIN
_lexer.next(); _lexer.next();
} }
if (++_depth > xpath_ast_depth_limit)
return error_rec();
xpath_ast_node* n = parse_expression(); xpath_ast_node* n = parse_expression();
if (!n) return 0; if (!n) return 0;
@ -11562,6 +11567,8 @@ PUGI__NS_BEGIN
_lexer.next(); _lexer.next();
_depth = old_depth;
return parse_function(function, argc, args); return parse_function(function, argc, args);
} }

1
tests/test_xpath_parse.cpp
View File

@ -401,6 +401,7 @@ TEST(xpath_parse_depth_limit)
CHECK_XPATH_FAIL((STR("/foo") + rep(STR("[1]"), limit)).c_str()); CHECK_XPATH_FAIL((STR("/foo") + rep(STR("[1]"), limit)).c_str());
CHECK_XPATH_FAIL((STR("/foo") + rep(STR("/x"), limit)).c_str()); CHECK_XPATH_FAIL((STR("/foo") + rep(STR("/x"), limit)).c_str());
CHECK_XPATH_FAIL((STR("1") + rep(STR("+1"), limit)).c_str()); CHECK_XPATH_FAIL((STR("1") + rep(STR("+1"), limit)).c_str());
CHECK_XPATH_FAIL((STR("concat(") + rep(STR("1,"), limit) + STR("1)")).c_str());
} }
TEST_XML(xpath_parse_location_path, "<node><child/></node>") TEST_XML(xpath_parse_location_path, "<node><child/></node>")