shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-31 06:50:06 +03:00
Code

xinclude: Avoid timeouts when fuzzing

Browse Source 
Fix the check for maximum number of inclusions.
This commit is contained in:
Nick Wellnhofer 2023-02-03 14:55:53 +01:00
parent be0ec005f3
commit a96312db51
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
xinclude.c
View File

@ -103,7 +103,9 @@ struct _xmlXIncludeCtxt {
void *_private; /* application data */
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
unsigned long incTotal; /* total number of processed inclusions */
#endif
int depth; /* recursion depth */
int isStream; /* streaming mode */
};
@ -1875,6 +1877,17 @@ xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
return(NULL);
}
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
/*
* The XInclude engine offers no protection against exponential
* expansion attacks similar to "billion laughs". Avoid timeouts by
* limiting the total number of replacements when fuzzing.
*/
if (ctxt->incTotal >= 20)
return(NULL);
ctxt->incTotal++;
#endif
for (i = 0; i < ctxt->incNr; i++) {
if (ctxt->incTab[i]->elem == node) {
if (ctxt->incTab[i]->expanding) {
@ -2257,15 +2270,6 @@ xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlNodePtr tree) {
do {
/* TODO: need to work on entities -> stack */
if (xmlXIncludeTestNode(ctxt, cur) == 1) {
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
/*
* Avoid superlinear expansion by limiting the total number
* of replacements.
*/
if (ctxt->incTotal >= 20)
break;
#endif
ctxt->incTotal++;
ref = xmlXIncludeExpandNode(ctxt, cur);
/*
* Mark direct includes.