[libxml2] Stop using maxParserDepth in xpath.c



commit 804c52978fef3f18b8a634280bc5cc79a390c141
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Mon Aug 17 03:37:18 2020 +0200

    Stop using maxParserDepth in xpath.c
    
    Only use a single maxDepth value.

 fuzz/xpath.c | 3 +--
 xpath.c      | 9 ++++++---
 2 files changed, 7 insertions(+), 5 deletions(-)
---
diff --git a/fuzz/xpath.c b/fuzz/xpath.c
index c10151fed..097eb8ea1 100644
--- a/fuzz/xpath.c
+++ b/fuzz/xpath.c
@@ -34,8 +34,7 @@ LLVMFuzzerTestOneInput(const char *data, size_t size) {
         xmlXPathContextPtr xpctxt = xmlXPathNewContext(doc);
 
         /* Resource limits to avoid timeouts and call stack overflows */
-        xpctxt->maxParserDepth = 15;
-        xpctxt->maxDepth = 100;
+        xpctxt->maxDepth = 500;
         xpctxt->opLimit = 500000;
 
         xmlXPathFreeObject(xmlXPtrEval(BAD_CAST expr, xpctxt));
diff --git a/xpath.c b/xpath.c
index 673482a7d..c018d0315 100644
--- a/xpath.c
+++ b/xpath.c
@@ -6119,7 +6119,6 @@ xmlXPathNewContext(xmlDocPtr doc) {
     ret->proximityPosition = -1;
 
     ret->maxDepth = INT_MAX;
-    ret->maxParserDepth = INT_MAX;
 
 #ifdef XP_DEFAULT_CACHE_ON
     if (xmlXPathContextSetCache(ret, 1, -1, 0) == -1) {
@@ -10948,9 +10947,13 @@ xmlXPathCompileExpr(xmlXPathParserContextPtr ctxt, int sort) {
     xmlXPathContextPtr xpctxt = ctxt->context;
 
     if (xpctxt != NULL) {
-        if (xpctxt->depth >= xpctxt->maxParserDepth)
+        if (xpctxt->depth >= xpctxt->maxDepth)
             XP_ERROR(XPATH_RECURSION_LIMIT_EXCEEDED);
-        xpctxt->depth += 1;
+        /*
+         * Parsing a single '(' pushes about 10 functions on the call stack
+         * before recursing!
+         */
+        xpctxt->depth += 10;
     }
 
     xmlXPathCompAndExpr(ctxt);


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]