1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-10-27 04:55:04 +03:00
Commit Graph

35 Commits

Author SHA1 Message Date
Nick Wellnhofer
c2f209c09f Disallow conditional sections in internal subset
Conditional sections are only allowed in *external* parameter entities
referenced from the internal subset.
2019-09-30 15:47:30 +02:00
Nick Wellnhofer
c51e38cb3a Make xmlParseConditionalSections non-recursive
Avoid call stack overflow in deeply nested conditional sections.

Found by OSS-Fuzz.
2019-09-30 15:47:30 +02:00
Nick Wellnhofer
62150ed2ab Make xmlParseContent and xmlParseElement non-recursive
Split xmlParseElement into subfunctions. Use nameNsPush to store prefix,
URI and nsNr on the heap, similar to the push parser.

Closes #84.
2019-09-23 17:45:50 +02:00
Nick Wellnhofer
f9fce96313 Fix unsigned integer overflow
It's defined behavior but -fsanitize=unsigned-integer-overflow is
useful to discover bugs.
2019-05-20 13:38:22 +02:00
Nick Wellnhofer
123234f2cf Free input buffer in xmlHaltParser
This avoids miscalculation of available bytes.

Thanks to Yunho Kim for the report.

Closes: #26
2018-09-11 15:06:17 +02:00
Nick Wellnhofer
69936b129f Revert "Print error messages for truncated UTF-8 sequences"
This reverts commit 79c8a6b which caused a serious regression in
streaming mode.

Also reverts part of commit 52ceced "Fix infinite loops with push
parser in recovery mode".

Fixes bug 786554.
2017-08-30 14:19:06 +02:00
Nick Wellnhofer
899a5d9f0e Detect infinite recursion in parameter entities
When expanding a parameter entity in a DTD, infinite recursion could
lead to an infinite loop or memory exhaustion.

Thanks to Wei Lei for the first of many reports.

Fixes bug 759579.
2017-07-25 15:21:12 +02:00
Nick Wellnhofer
872fea9485 Get rid of "blanks wrapper" for parameter entities
Now that replacement of parameter entities goes exclusively through
xmlSkipBlankChars, we can account for the surrounding space characters
there and remove the "blanks wrapper" hack.
2017-06-20 13:19:47 +02:00
Nick Wellnhofer
24246c7626 Fix xmlHaltParser
Pop all extra input streams before resetting the input. Otherwise,
a call to xmlPopInput could make input available again.

Also set input->end to input->cur.

Changes the test output for some error tests. Unfortunately, some
fuzzed test cases were added to the test suite without manual cleanup.
This makes it almost impossible to review the impact of later changes
on the test output.
2017-06-20 13:15:43 +02:00
Nick Wellnhofer
8bbe4508ef Spelling and grammar fixes
Fixes bug 743172, bug 743489, bug 769632, bug 782400 and a few other
misspellings.
2017-06-17 16:34:23 +02:00
Nick Wellnhofer
5f440d8cad Rework entity boundary checks
Make sure to finish all entities in the internal subset. Nevertheless,
readd a sanity check in xmlParseStartTag2 that was lost in my previous
commit. Also add a sanity check in xmlPopInput. Popping an input
unexpectedly was the source of many recent memory bugs. The check
doesn't mitigate such issues but helps with diagnosis.

Always base entity boundary checks on the input ID, not the input
pointer. The pointer could have been reallocated to the old address.

Always throw a well-formedness error if a boundary check fails. In a
few places, a validity error was thrown.

Fix a few error codes and improve indentation.
2017-06-17 13:25:53 +02:00
Nick Wellnhofer
79c8a6b105 Print error messages for truncated UTF-8 sequences
Before, truncated UTF-8 sequences at the end of a file were treated as
EOF. Create an error message containing the offending bytes.

xmlStringCurrentChar would also print characters from the input stream,
not the string it's working on.
2017-06-10 18:11:58 +02:00
Nick Wellnhofer
855c19efb7 Avoid reparsing in xmlParseStartTag2
The code in xmlParseStartTag2 must handle the case that the input
buffer was grown and reallocated which can invalidate pointers to
attribute values. Before, this was handled by detecting changes of
the input buffer "base" pointer and, in case of a change, jumping
back to the beginning of the function and reparsing the start tag.

The major problem of this approach is that whether an input buffer is
reallocated is nondeterministic, resulting in seemingly random test
failures. See the mailing list thread "runtest mystery bug: name2.xml
error case regression test" from 2012, for example.

If a reallocation was detected, the code also made no attempts to
continue parsing in case of errors which makes a difference in
the lax "recover" mode.

Now we store the current input buffer "base" pointer for each (not
separately allocated) attribute in the namespace URI field, which isn't
used until later. After the whole start tag was parsed, the pointers
to the attribute values are reconstructed using the offset between the
new and the old input buffer. This relies on arithmetic on dangling
pointers which is technically undefined behavior. But it seems like
the easiest and most efficient fix and a similar approach is used in
xmlParserInputGrow.

This changes the error output of several tests, typically making it
more verbose because we try harder to continue parsing in case of
errors.

(Another possible solution is to check not only the "base" pointer
but the size of the input buffer as well. But this would result in
even more reparsing.)
2017-06-01 14:31:28 +02:00
David Kilzer
0090675905 Heap-based buffer-underreads due to xmlParseName
For https://bugzilla.gnome.org/show_bug.cgi?id=759573

* parser.c:
(xmlParseElementDecl): Return early on invalid input to fix
non-minimized test case (759573-2.xml).  Otherwise the parser
gets into a bad state in SKIP(3) at the end of the function.
(xmlParseConditionalSections): Halt parsing when hitting invalid
input that would otherwise caused xmlParserHandlePEReference()
to recurse unexpectedly.  This fixes the minimized test case
(759573.xml).

* result/errors/759573-2.xml: Add.
* result/errors/759573-2.xml.err: Add.
* result/errors/759573-2.xml.str: Add.
* result/errors/759573.xml: Add.
* result/errors/759573.xml.err: Add.
* result/errors/759573.xml.str: Add.
* test/errors/759573-2.xml: Add.
* test/errors/759573.xml: Add.
2016-05-23 15:01:07 +08:00
Pranjal Jumde
38eae57111 Heap use-after-free in xmlSAX2AttributeNs
For https://bugzilla.gnome.org/show_bug.cgi?id=759020

* parser.c:
(xmlParseStartTag2): Attribute strings are only valid if the
base does not change, so add another check where the base may
change.  Make sure to set 'attvalue' to NULL after freeing it.
* result/errors/759020.xml: Added.
* result/errors/759020.xml.err: Added.
* result/errors/759020.xml.str: Added.
* test/errors/759020.xml: Added test case.
2016-05-23 15:01:07 +08:00
Pranjal Jumde
45752d2c33 Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398>
* parser.c:
(xmlParseNCNameComplex): Store start position instead of a
pointer to the name since the underlying buffer may change,
resulting in a stale pointer being used.
* result/errors/759398.xml: Added.
* result/errors/759398.xml.err: Added.
* result/errors/759398.xml.str: Added.
* test/errors/759398.xml: Added test case.
2016-05-23 15:01:07 +08:00
David Kilzer
db07dd613e Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588>
* parser.c:
(xmlParseEndTag2): Add bounds checks before dereferencing
ctxt->input->cur past the end of the buffer, or incrementing the
pointer past the end of the buffer.

* result/errors/758588.xml: Add test result.
* result/errors/758588.xml.err: Ditto.
* result/errors/758588.xml.str: Ditto.
* test/errors/758588.xml: Add regression test.
2016-05-23 15:01:07 +08:00
Daniel Veillard
a7a94612aa Heap-based buffer overread in xmlNextChar
For https://bugzilla.gnome.org/show_bug.cgi?id=759671

when the end of the internal subset isn't properly detected
xmlParseInternalSubset should just return instead of trying
to process input further.
2016-02-09 12:55:29 +01:00
Daniel Veillard
f1063fdbe7 CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
For https://bugzilla.gnome.org/show_bug.cgi?id=756525
handle properly the case where we popped out of the current entity
while processing a start tag
Reported by Kostya Serebryany @ Google

This slightly modifies the output of 754946 in regression tests
2015-11-20 16:06:59 +08:00
Daniel Veillard
4a5d80aded Fix a bug in CData error handling in the push parser
For https://bugzilla.gnome.org/show_bug.cgi?id=754947

The checking function was returning incorrect args in some cases
Adds the test to teh reg suite and fix one of the existing test output
2015-09-18 15:06:46 +08:00
Daniel Veillard
51f02b0a03 Fix a bug on name parsing at the end of current input buffer
For https://bugzilla.gnome.org/show_bug.cgi?id=754946

When hitting the end of the current input buffer while parsing
a name we could end up loosing the beginning of the name, which
led to various issues.
2015-09-15 16:50:32 +08:00
Daniel Veillard
e7bf892d8c Improve error reporting on parser errors
The extra string was being dismissed when provided.
* parser.c: handle bot case properly
* result/: this changes a few error reports
2012-07-30 20:09:25 +08:00
Daniel Veillard
4629ee02ac Do not fetch external parsed entities
Unless explicietely asked for when validating or replacing entities
with their value. Problem pointed out by Tom Lane <tgl@redhat.com>

* parser.c: do not load external parsed entities unless needed
* test/errors/extparsedent.xml result/errors/extparsedent.xml*:
  add a regression test to avoid change of the behaviour in the future
2012-07-23 14:15:40 +08:00
Daniel Veillard
d7af555327 rewrite the URI parser to update to rfc3986 (from 2396) removed the error
* uri.c include/libxml/uri.h: rewrite the URI parser to update to
  rfc3986 (from 2396)
* test/errors/webdav.xml result/errors/webdav.xml*: removed the
  error test, 'DAV:' is a correct URI under 3986
* Makefile.am: small cleanup in make check
Daniel

svn path=/trunk/; revision=3763
2008-08-04 15:29:44 +00:00
Daniel Veillard
373345764b added a skipped list, insert rmt-ns10-035 improve 'make check' clean up
* runxmlconf.c: added a skipped list, insert rmt-ns10-035
* Makefile.am: improve 'make check'
* include/libxml/xmlerror.h parser.c: clean up namespace errors
  checking and reporting, errors when a document is labelled
  as UTF-16 while it is parsed as UTF-8 and no encoding was given
  explicitely.
* result/errors/webdav.xml.*: some warnings are no recategorized
  as Namespace errors
Daniel

svn path=/trunk/; revision=3761
2008-07-31 08:20:02 +00:00
Daniel Veillard
c707d0b765 fix a memeory leak in internal subset parsing with a fix from Ashwin add
* parser.c: fix a memeory leak in internal subset parsing with
  a fix from Ashwin
* test/errors/content1.xml result/errors/content1.xml*:
  add test to regressions
Daniel

svn path=/trunk/; revision=3680
2008-01-24 14:48:54 +00:00
Daniel Veillard
da62934715 fixed a parser bug where invalid char in comment may not be detected,
* parser.c: fixed a parser bug where invalid char in comment may
  not be detected, reported by Ashwin Sinha
* test/errors/comment1.xml result/errors/comment1.xml*: added
  the example to the regression suite
Daniel

svn path=/trunk/; revision=3647
2007-08-01 07:49:06 +00:00
Daniel Veillard
b9e5acc490 fix bug #414846 where invalid characters in attributes would sometimes not
* parser.c: fix bug #414846 where invalid characters in attributes
  would sometimes not be detected.
* test/errors/attr4.xml result/errors/attr4.xml*: added a specific
  test case to the regression tests
Daniel

svn path=/trunk/; revision=3634
2007-06-12 13:43:00 +00:00
Daniel Veillard
dcec672439 fix the patch for unreproductable #343000 but also fix a line/column
* parser.c: fix the patch for unreproductable #343000 but
  also fix a line/column keeping error
* result/errors/attr1.xml.err result/errors/attr2.xml.err
  result/errors/name.xml.err result/errors/name2.xml.err
  result/schemas/anyAttr-processContents-err1_0_0.err
  result/schemas/bug312957_1_0.err: affected lines in error output
  of the regression tests
Daniel
2006-10-15 20:32:53 +00:00
William M. Brack
f810de0436 fixed problem with free on dupl attribute in dtd (bug309637). added
* parser.c: fixed problem with free on dupl attribute in
  dtd (bug309637).
* test/errors/attr3.xml, result/errors/attr3.*: added
  regression test for this
2005-07-06 22:48:41 +00:00
Daniel Veillard
3fa5e7e44c fixed a bug failing to detect UTF-8 violations in CData in push mode.
* parser.c: fixed a bug failing to detect UTF-8 violations in
  CData in push mode.
* result/errors/cdata.xml* test/errors/cdata.xml: added the test
  to the regressions
Daniel
2005-07-04 11:12:25 +00:00
Daniel Veillard
b8590d4c1a fixed bug #164556 where non-fatal errors stopped push parsing and
* parser.c: fixed bug #164556 where non-fatal errors stopped
  push parsing and xmlreader.
* Makefile.am: fixup
* test/errors/webdav.xml result/errors/webdav*: adding regression
  test for this problem.
Daniel
2005-01-21 15:10:23 +00:00
Daniel Veillard
4a14fb8fa2 fix from Steve Ball and update of the comment. William pointed out that
* xmlreader.c: fix from Steve Ball and update of the comment.
* Makefile.am result/errors/*.str: William pointed out that
  the streaming error checking part wasn't streaming, fixing
Daniel
2004-06-14 19:58:20 +00:00
Daniel Veillard
37fd307435 fixed a bug where invalid charrefs may not be detected sometimes as
* parser.c: fixed a bug where invalid charrefs may not be detected
  sometimes as pointed by Morus Walter.
* test/errors/charref1.xm result/errors/charref1.xml*: added the
  test in the regression suite.
Daniel
2004-06-03 11:22:31 +00:00
Daniel Veillard
6c662996b6 Beuah ! Daniel
Beuah !
Daniel
2004-02-21 11:55:44 +00:00