organicmaps/pugixml
13
Fork 0
Code Issues 1 Pull requests Projects Releases Wiki Activity Actions

Merge pull request #370 from zeux/xpath-rec

Browse source 
XPath: Fix stack overflow in functions with long argument lists
This commit is contained in:
Arseny Kapoulkine 2020-09-11 13:06:44 -07:00 • committed by GitHub
commit c4bae8d818
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/pugixml.cpp
View file

@ -11541,6 +11541,8 @@ PUGI__NS_BEGIN
return error("Unrecognized function call");
_lexer.next();
size_t old_depth = _depth;
while (_lexer.current() != lex_close_brace)
{
if (argc > 0)
@ -11550,6 +11552,9 @@ PUGI__NS_BEGIN
_lexer.next();
}
if (++_depth > xpath_ast_depth_limit)
return error_rec();
xpath_ast_node* n = parse_expression();
if (!n) return 0;
@ -11562,6 +11567,8 @@ PUGI__NS_BEGIN
_lexer.next();
_depth = old_depth;
return parse_function(function, argc, args);
}

1
tests/test_xpath_parse.cpp
View file

@ -401,6 +401,7 @@ TEST(xpath_parse_depth_limit)
CHECK_XPATH_FAIL((STR("/foo") + rep(STR("[1]"), limit)).c_str());
CHECK_XPATH_FAIL((STR("/foo") + rep(STR("/x"), limit)).c_str());
CHECK_XPATH_FAIL((STR("1") + rep(STR("+1"), limit)).c_str());
CHECK_XPATH_FAIL((STR("concat(") + rep(STR("1,"), limit) + STR("1)")).c_str());
}
TEST_XML(xpath_parse_location_path, "<node><child/></node>")