diff --git a/ChangeLog b/ChangeLog index cc75e5a0..05ba4574 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +Tue Jun 12 11:12:50 CEST 2007 Daniel Veillard + + * catalog.c: fixed bug #383687, some case of recursion on next + were not caught in the catalog code. + Tue Jun 12 10:37:42 CEST 2007 Daniel Veillard * HTMLparser.c: fixed bug #381877, avoid reading over the end diff --git a/catalog.c b/catalog.c index 95ebee8f..ee3f8f2b 100644 --- a/catalog.c +++ b/catalog.c @@ -1828,6 +1828,8 @@ xmlCatalogXMLResolve(xmlCatalogEntryPtr catal, const xmlChar *pubID, if (ret != NULL) { catal->depth--; return(ret); + } else if (catal->depth > MAX_CATAL_DEPTH) { + return(NULL); } } } @@ -1868,6 +1870,13 @@ xmlCatalogXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) { if (URI == NULL) return(NULL); + if (catal->depth > MAX_CATAL_DEPTH) { + xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION, + "Detected recursion in catalog %s\n", + catal->name, NULL, NULL); + return(NULL); + } + /* * First tries steps 2/ 3/ 4/ if a system ID is provided. */ @@ -2053,16 +2062,18 @@ xmlCatalogListXMLResolve(xmlCatalogEntryPtr catal, const xmlChar *pubID, if (catal->children != NULL) { ret = xmlCatalogXMLResolve(catal->children, pubID, sysID); if (ret != NULL) { - if (normid != NULL) - xmlFree(normid); - return(ret); - } + break; + } else if ((catal->children != NULL) && + (catal->children->depth > MAX_CATAL_DEPTH)) { + ret = NULL; + break; + } } } catal = catal->next; } - if (normid != NULL) - xmlFree(normid); + if (normid != NULL) + xmlFree(normid); return(ret); }