shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-04-24 18:50:07 +03:00
Code

html: Impose some length limits

Browse Source 
Impose length limits on names, attribute values, PIs and comments,
similar to the XML parser.
This commit is contained in:
Nick Wellnhofer 2023-03-12 17:40:55 +01:00
parent 3eb6bf0386
commit bd63d730b8
3 changed files with 43 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
HTMLparser.c
View File

@ -2671,6 +2671,9 @@ htmlParseNameComplex(xmlParserCtxtPtr ctxt) {
int len = 0, l; int len = 0, l;
int c; int c;
int count = 0; int count = 0;
int maxLength = (ctxt->options & XML_PARSE_HUGE) ?
XML_MAX_TEXT_LENGTH :
XML_MAX_NAME_LENGTH;
const xmlChar *base = ctxt->input->base; const xmlChar *base = ctxt->input->base;
/* /*
@ -2695,6 +2698,10 @@ htmlParseNameComplex(xmlParserCtxtPtr ctxt) {
GROW; GROW;
} }
len += l; len += l;
if (len > maxLength) {
htmlParseErr(ctxt, XML_ERR_NAME_TOO_LONG, "name too long", NULL, NULL);
return(NULL);
}
NEXTL(l); NEXTL(l);
c = CUR_CHAR(l); c = CUR_CHAR(l);
if (ctxt->input->base != base) { if (ctxt->input->base != base) {
@ -2732,6 +2739,9 @@ static xmlChar *
htmlParseHTMLAttribute(htmlParserCtxtPtr ctxt, const xmlChar stop) { htmlParseHTMLAttribute(htmlParserCtxtPtr ctxt, const xmlChar stop) {
xmlChar *buffer = NULL; xmlChar *buffer = NULL;
int buffer_size = 0; int buffer_size = 0;
int maxLength = (ctxt->options & XML_PARSE_HUGE) ?
XML_MAX_HUGE_LENGTH :
XML_MAX_TEXT_LENGTH;
xmlChar *out = NULL; xmlChar *out = NULL;
const xmlChar *name = NULL; const xmlChar *name = NULL;
const xmlChar *cur = NULL; const xmlChar *cur = NULL;
@ -2851,6 +2861,12 @@ htmlParseHTMLAttribute(htmlParserCtxtPtr ctxt, const xmlChar stop) {
} }
NEXT; NEXT;
} }
if (out - buffer > maxLength) {
htmlParseErr(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
"attribute value too long\n", NULL, NULL);
xmlFree(buffer);
return(NULL);
}
} }
*out = 0; *out = 0;
return(buffer); return(buffer);
@ -3345,6 +3361,9 @@ htmlParsePI(htmlParserCtxtPtr ctxt) {
int len = 0; int len = 0;
int size = HTML_PARSER_BUFFER_SIZE; int size = HTML_PARSER_BUFFER_SIZE;
int cur, l; int cur, l;
int maxLength = (ctxt->options & XML_PARSE_HUGE) ?
XML_MAX_HUGE_LENGTH :
XML_MAX_TEXT_LENGTH;
const xmlChar *target; const xmlChar *target;
xmlParserInputState state; xmlParserInputState state;
int count = 0; int count = 0;
@ -3416,6 +3435,13 @@ htmlParsePI(htmlParserCtxtPtr ctxt) {
"Invalid char in processing instruction " "Invalid char in processing instruction "
"0x%X\n", cur); "0x%X\n", cur);
} }
if (len > maxLength) {
htmlParseErr(ctxt, XML_ERR_PI_NOT_FINISHED,
"PI %s too long", target, NULL);
xmlFree(buf);
ctxt->instate = state;
return;
}
NEXTL(l); NEXTL(l);
cur = CUR_CHAR(l); cur = CUR_CHAR(l);
if (cur == 0) { if (cur == 0) {
@ -3465,6 +3491,9 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
int r, rl; int r, rl;
int cur, l; int cur, l;
int next, nl; int next, nl;
int maxLength = (ctxt->options & XML_PARSE_HUGE) ?
XML_MAX_HUGE_LENGTH :
XML_MAX_TEXT_LENGTH;
xmlParserInputState state; xmlParserInputState state;
/* /*
@ -3541,6 +3570,13 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
htmlParseErrInt(ctxt, XML_ERR_INVALID_CHAR, htmlParseErrInt(ctxt, XML_ERR_INVALID_CHAR,
"Invalid char in comment 0x%X\n", q); "Invalid char in comment 0x%X\n", q);
} }
if (len > maxLength) {
htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
"comment too long", NULL, NULL);
xmlFree(buf);
ctxt->instate = state;
return;
}
q = r; q = r;
ql = rl; ql = rl;

7
include/libxml/parserInternals.h
View File

@ -40,6 +40,13 @@ XMLPUBVAR unsigned int xmlParserMaxDepth;
*/ */
#define XML_MAX_TEXT_LENGTH 10000000 #define XML_MAX_TEXT_LENGTH 10000000
/**
* XML_MAX_HUGE_LENGTH:
*
* Maximum size allowed when XML_PARSE_HUGE is set.
*/
#define XML_MAX_HUGE_LENGTH 1000000000
/** /**
* XML_MAX_NAME_LENGTH: * XML_MAX_NAME_LENGTH:
* *

2
parser.c
View File

@ -114,8 +114,6 @@ xmlParseElementEnd(xmlParserCtxtPtr ctxt);
* * * *
************************************************************************/ ************************************************************************/
#define XML_MAX_HUGE_LENGTH 1000000000
#define XML_PARSER_BIG_ENTITY 1000 #define XML_PARSER_BIG_ENTITY 1000
#define XML_PARSER_LOT_ENTITY 5000 #define XML_PARSER_LOT_ENTITY 5000