Gutyina Gergő
238 lines
7.5 KiB
Diff
238 lines
7.5 KiB
Diff
diff --git a/include/libxml/relaxng.h b/include/libxml/relaxng.h
|
|
index 079b7f12..78985e5e 100644
|
|
--- a/include/libxml/relaxng.h
|
|
+++ b/include/libxml/relaxng.h
|
|
@@ -138,6 +138,10 @@ XMLPUBFUN int
|
|
xmlRelaxParserSetFlag (xmlRelaxNGParserCtxtPtr ctxt,
|
|
int flag);
|
|
|
|
+XMLPUBFUN int
|
|
+ xmlRelaxParserSetIncLImit (xmlRelaxNGParserCtxt *ctxt,
|
|
+ int limit);
|
|
+
|
|
XMLPUBFUN void
|
|
xmlRelaxNGFreeParserCtxt (xmlRelaxNGParserCtxtPtr ctxt);
|
|
XMLPUBFUN void
|
|
diff --git a/relaxng.c b/relaxng.c
|
|
index 24c3e510..eb0f2b36 100644
|
|
--- a/relaxng.c
|
|
+++ b/relaxng.c
|
|
@@ -18,6 +18,8 @@
|
|
|
|
#ifdef LIBXML_SCHEMAS_ENABLED
|
|
|
|
+#include <errno.h>
|
|
+#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <stdio.h>
|
|
#include <stddef.h>
|
|
@@ -44,6 +46,12 @@
|
|
static const xmlChar *xmlRelaxNGNs = (const xmlChar *)
|
|
"http://relaxng.org/ns/structure/1.0";
|
|
|
|
+/*
|
|
+ * Default include limit, this can be override with RNG_INCLUDE_LIMIT
|
|
+ * env variable
|
|
+ */
|
|
+static const int _xmlRelaxNGIncludeLimit = 1000;
|
|
+
|
|
#define IS_RELAXNG(node, typ) \
|
|
((node != NULL) && (node->ns != NULL) && \
|
|
(node->type == XML_ELEMENT_NODE) && \
|
|
@@ -220,6 +228,7 @@ struct _xmlRelaxNGParserCtxt {
|
|
int incNr; /* Depth of the include parsing stack */
|
|
int incMax; /* Max depth of the parsing stack */
|
|
xmlRelaxNGIncludePtr *incTab; /* array of incs */
|
|
+ int incLimit; /* Include limit, to avoid stack-overflow on parse */
|
|
|
|
int idref; /* requires idref checking */
|
|
|
|
@@ -1403,6 +1412,23 @@ xmlRelaxParserSetFlag(xmlRelaxNGParserCtxtPtr ctxt, int flags)
|
|
return(0);
|
|
}
|
|
|
|
+/**
|
|
+ * Semi private function used to set the include recursion limit to a
|
|
+ * parser context. Set to 0 to use the default value.
|
|
+ *
|
|
+ * @param ctxt a RelaxNG parser context
|
|
+ * @param limit the new include depth limit
|
|
+ * @returns 0 if success and -1 in case of error
|
|
+ */
|
|
+int
|
|
+xmlRelaxParserSetIncLImit(xmlRelaxNGParserCtxt *ctxt, int limit)
|
|
+{
|
|
+ if (ctxt == NULL) return(-1);
|
|
+ if (limit < 0) return(-1);
|
|
+ ctxt->incLimit = limit;
|
|
+ return(0);
|
|
+}
|
|
+
|
|
/************************************************************************
|
|
* *
|
|
* Document functions *
|
|
@@ -1454,7 +1480,7 @@ xmlRelaxReadMemory(xmlRelaxNGParserCtxtPtr ctxt, const char *buf, int size) {
|
|
*
|
|
* Pushes a new include on top of the include stack
|
|
*
|
|
- * Returns 0 in case of error, the index in the stack otherwise
|
|
+ * Returns -1 in case of error, the index in the stack otherwise
|
|
*/
|
|
static int
|
|
xmlRelaxNGIncludePush(xmlRelaxNGParserCtxtPtr ctxt,
|
|
@@ -1468,9 +1494,15 @@ xmlRelaxNGIncludePush(xmlRelaxNGParserCtxtPtr ctxt,
|
|
sizeof(ctxt->incTab[0]));
|
|
if (ctxt->incTab == NULL) {
|
|
xmlRngPErrMemory(ctxt);
|
|
- return (0);
|
|
+ return (-1);
|
|
}
|
|
}
|
|
+ if (ctxt->incNr >= ctxt->incLimit) {
|
|
+ xmlRngPErr(ctxt, (xmlNodePtr)value->doc, XML_RNGP_PARSE_ERROR,
|
|
+ "xmlRelaxNG: inclusion recursion limit reached\n", NULL, NULL);
|
|
+ return(-1);
|
|
+ }
|
|
+
|
|
if (ctxt->incNr >= ctxt->incMax) {
|
|
ctxt->incMax *= 2;
|
|
ctxt->incTab =
|
|
@@ -1479,7 +1511,7 @@ xmlRelaxNGIncludePush(xmlRelaxNGParserCtxtPtr ctxt,
|
|
sizeof(ctxt->incTab[0]));
|
|
if (ctxt->incTab == NULL) {
|
|
xmlRngPErrMemory(ctxt);
|
|
- return (0);
|
|
+ return (-1);
|
|
}
|
|
}
|
|
ctxt->incTab[ctxt->incNr] = value;
|
|
@@ -1649,7 +1681,9 @@ xmlRelaxNGLoadInclude(xmlRelaxNGParserCtxtPtr ctxt, const xmlChar * URL,
|
|
/*
|
|
* push it on the stack
|
|
*/
|
|
- xmlRelaxNGIncludePush(ctxt, ret);
|
|
+ if (xmlRelaxNGIncludePush(ctxt, ret) < 0) {
|
|
+ return (NULL);
|
|
+ }
|
|
|
|
/*
|
|
* Some preprocessing of the document content, this include recursing
|
|
@@ -7373,11 +7407,32 @@ xmlRelaxNGParse(xmlRelaxNGParserCtxtPtr ctxt)
|
|
xmlDocPtr doc;
|
|
xmlNodePtr root;
|
|
|
|
+ const char *include_limit_env = getenv("RNG_INCLUDE_LIMIT");
|
|
+
|
|
xmlRelaxNGInitTypes();
|
|
|
|
if (ctxt == NULL)
|
|
return (NULL);
|
|
|
|
+ if (ctxt->incLimit == 0) {
|
|
+ ctxt->incLimit = _xmlRelaxNGIncludeLimit;
|
|
+ if (include_limit_env != NULL) {
|
|
+ char *strEnd;
|
|
+ unsigned long val = 0;
|
|
+ errno = 0;
|
|
+ val = strtoul(include_limit_env, &strEnd, 10);
|
|
+ if (errno != 0 || *strEnd != 0 || val > INT_MAX) {
|
|
+ xmlRngPErr(ctxt, NULL, XML_RNGP_PARSE_ERROR,
|
|
+ "xmlRelaxNGParse: invalid RNG_INCLUDE_LIMIT %s\n",
|
|
+ (const xmlChar*)include_limit_env,
|
|
+ NULL);
|
|
+ return(NULL);
|
|
+ }
|
|
+ if (val)
|
|
+ ctxt->incLimit = val;
|
|
+ }
|
|
+ }
|
|
+
|
|
/*
|
|
* First step is to parse the input document into an DOM/Infoset
|
|
*/
|
|
diff --git a/runtest.c b/runtest.c
|
|
index 26681a3c..a41897dd 100644
|
|
--- a/runtest.c
|
|
+++ b/runtest.c
|
|
@@ -3529,6 +3529,70 @@ rngTest(const char *filename,
|
|
return(ret);
|
|
}
|
|
|
|
+/**
|
|
+ * Parse an RNG schemas with a custom RNG_INCLUDE_LIMIT
|
|
+ *
|
|
+ * @param filename the schemas file
|
|
+ * @param result the file with expected result
|
|
+ * @param err the file with error messages
|
|
+ * @returns 0 in case of success, an error code otherwise
|
|
+ */
|
|
+static int
|
|
+rngIncludeTest(const char *filename,
|
|
+ const char *resul ATTRIBUTE_UNUSED,
|
|
+ const char *errr ATTRIBUTE_UNUSED,
|
|
+ int options ATTRIBUTE_UNUSED) {
|
|
+ xmlRelaxNGParserCtxtPtr ctxt;
|
|
+ xmlRelaxNGPtr schemas;
|
|
+ int ret = 0;
|
|
+
|
|
+ /* first compile the schemas if possible */
|
|
+ ctxt = xmlRelaxNGNewParserCtxt(filename);
|
|
+ xmlRelaxNGSetParserStructuredErrors(ctxt, testStructuredErrorHandler,
|
|
+ NULL);
|
|
+
|
|
+ /* Should work */
|
|
+ schemas = xmlRelaxNGParse(ctxt);
|
|
+ if (schemas == NULL) {
|
|
+ testErrorHandler(NULL, "Relax-NG schema %s failed to compile\n",
|
|
+ filename);
|
|
+ ret = -1;
|
|
+ goto done;
|
|
+ }
|
|
+ xmlRelaxNGFree(schemas);
|
|
+ xmlRelaxNGFreeParserCtxt(ctxt);
|
|
+
|
|
+ ctxt = xmlRelaxNGNewParserCtxt(filename);
|
|
+ /* Should fail */
|
|
+ xmlRelaxParserSetIncLImit(ctxt, 2);
|
|
+ xmlRelaxNGSetParserStructuredErrors(ctxt, testStructuredErrorHandler,
|
|
+ NULL);
|
|
+ schemas = xmlRelaxNGParse(ctxt);
|
|
+ if (schemas != NULL) {
|
|
+ ret = -1;
|
|
+ xmlRelaxNGFree(schemas);
|
|
+ }
|
|
+ xmlRelaxNGFreeParserCtxt(ctxt);
|
|
+
|
|
+ ctxt = xmlRelaxNGNewParserCtxt(filename);
|
|
+ /* Should work */
|
|
+ xmlRelaxParserSetIncLImit(ctxt, 3);
|
|
+ xmlRelaxNGSetParserStructuredErrors(ctxt, testStructuredErrorHandler,
|
|
+ NULL);
|
|
+ schemas = xmlRelaxNGParse(ctxt);
|
|
+ if (schemas == NULL) {
|
|
+ testErrorHandler(NULL, "Relax-NG schema %s failed to compile\n",
|
|
+ filename);
|
|
+ ret = -1;
|
|
+ goto done;
|
|
+ }
|
|
+ xmlRelaxNGFree(schemas);
|
|
+
|
|
+done:
|
|
+ xmlRelaxNGFreeParserCtxt(ctxt);
|
|
+ return(ret);
|
|
+}
|
|
+
|
|
#ifdef LIBXML_READER_ENABLED
|
|
/**
|
|
* rngStreamTest:
|
|
@@ -4873,6 +4937,9 @@ testDesc testDescriptions[] = {
|
|
{ "Relax-NG regression tests" ,
|
|
rngTest, "./test/relaxng/*.rng", NULL, NULL, NULL,
|
|
XML_PARSE_DTDATTR | XML_PARSE_NOENT },
|
|
+ { "Relax-NG include limit tests" ,
|
|
+ rngIncludeTest, "./test/relaxng/include/include-limit.rng", NULL, NULL, NULL,
|
|
+ 0 },
|
|
#ifdef LIBXML_READER_ENABLED
|
|
{ "Relax-NG streaming regression tests" ,
|
|
rngStreamTest, "./test/relaxng/*.rng", NULL, NULL, NULL,
|