[libxml2] Stop using maxParserDepth in xpath.c
- From: Nick Wellnhofer <nwellnhof src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [libxml2] Stop using maxParserDepth in xpath.c
- Date: Mon, 17 Aug 2020 12:11:28 +0000 (UTC)
commit 804c52978fef3f18b8a634280bc5cc79a390c141
Author: Nick Wellnhofer <wellnhofer aevum de>
Date: Mon Aug 17 03:37:18 2020 +0200
Stop using maxParserDepth in xpath.c
Only use a single maxDepth value.
fuzz/xpath.c | 3 +--
xpath.c | 9 ++++++---
2 files changed, 7 insertions(+), 5 deletions(-)
---
diff --git a/fuzz/xpath.c b/fuzz/xpath.c
index c10151fed..097eb8ea1 100644
--- a/fuzz/xpath.c
+++ b/fuzz/xpath.c
@@ -34,8 +34,7 @@ LLVMFuzzerTestOneInput(const char *data, size_t size) {
xmlXPathContextPtr xpctxt = xmlXPathNewContext(doc);
/* Resource limits to avoid timeouts and call stack overflows */
- xpctxt->maxParserDepth = 15;
- xpctxt->maxDepth = 100;
+ xpctxt->maxDepth = 500;
xpctxt->opLimit = 500000;
xmlXPathFreeObject(xmlXPtrEval(BAD_CAST expr, xpctxt));
diff --git a/xpath.c b/xpath.c
index 673482a7d..c018d0315 100644
--- a/xpath.c
+++ b/xpath.c
@@ -6119,7 +6119,6 @@ xmlXPathNewContext(xmlDocPtr doc) {
ret->proximityPosition = -1;
ret->maxDepth = INT_MAX;
- ret->maxParserDepth = INT_MAX;
#ifdef XP_DEFAULT_CACHE_ON
if (xmlXPathContextSetCache(ret, 1, -1, 0) == -1) {
@@ -10948,9 +10947,13 @@ xmlXPathCompileExpr(xmlXPathParserContextPtr ctxt, int sort) {
xmlXPathContextPtr xpctxt = ctxt->context;
if (xpctxt != NULL) {
- if (xpctxt->depth >= xpctxt->maxParserDepth)
+ if (xpctxt->depth >= xpctxt->maxDepth)
XP_ERROR(XPATH_RECURSION_LIMIT_EXCEEDED);
- xpctxt->depth += 1;
+ /*
+ * Parsing a single '(' pushes about 10 functions on the call stack
+ * before recursing!
+ */
+ xpctxt->depth += 10;
}
xmlXPathCompAndExpr(ctxt);
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]