Skip to content

Commit fcfbbb2

Browse files
arun-josephkevinrushforth
arun-joseph
authored and
kevinrushforth
committedOct 20, 2020
8248177: Improve XML support
Reviewed-by: kcr, ahgross, rhalade
·
15.0.1+1
1 parent 9e2a2f2 commit fcfbbb2

File tree

6 files changed

+104
-26
lines changed

6 files changed

+104
-26
lines changed
 

‎modules/javafx.web/src/main/native/Source/ThirdParty/libxml/src/HTMLparser.c

+30-18
Original file line numberDiff line numberDiff line change
@@ -3400,13 +3400,16 @@ htmlParseCharRef(htmlParserCtxtPtr ctxt) {
34003400
((NXT(2) == 'x') || NXT(2) == 'X')) {
34013401
SKIP(3);
34023402
while (CUR != ';') {
3403-
if ((CUR >= '0') && (CUR <= '9'))
3404-
val = val * 16 + (CUR - '0');
3405-
else if ((CUR >= 'a') && (CUR <= 'f'))
3406-
val = val * 16 + (CUR - 'a') + 10;
3407-
else if ((CUR >= 'A') && (CUR <= 'F'))
3408-
val = val * 16 + (CUR - 'A') + 10;
3409-
else {
3403+
if ((CUR >= '0') && (CUR <= '9')) {
3404+
if (val < 0x110000)
3405+
val = val * 16 + (CUR - '0');
3406+
} else if ((CUR >= 'a') && (CUR <= 'f')) {
3407+
if (val < 0x110000)
3408+
val = val * 16 + (CUR - 'a') + 10;
3409+
} else if ((CUR >= 'A') && (CUR <= 'F')) {
3410+
if (val < 0x110000)
3411+
val = val * 16 + (CUR - 'A') + 10;
3412+
} else {
34103413
htmlParseErr(ctxt, XML_ERR_INVALID_HEX_CHARREF,
34113414
"htmlParseCharRef: missing semicolon\n",
34123415
NULL, NULL);
@@ -3419,9 +3422,10 @@ htmlParseCharRef(htmlParserCtxtPtr ctxt) {
34193422
} else if ((CUR == '&') && (NXT(1) == '#')) {
34203423
SKIP(2);
34213424
while (CUR != ';') {
3422-
if ((CUR >= '0') && (CUR <= '9'))
3423-
val = val * 10 + (CUR - '0');
3424-
else {
3425+
if ((CUR >= '0') && (CUR <= '9')) {
3426+
if (val < 0x110000)
3427+
val = val * 10 + (CUR - '0');
3428+
} else {
34253429
htmlParseErr(ctxt, XML_ERR_INVALID_DEC_CHARREF,
34263430
"htmlParseCharRef: missing semicolon\n",
34273431
NULL, NULL);
@@ -3440,6 +3444,9 @@ htmlParseCharRef(htmlParserCtxtPtr ctxt) {
34403444
*/
34413445
if (IS_CHAR(val)) {
34423446
return(val);
3447+
} else if (val >= 0x110000) {
3448+
htmlParseErr(ctxt, XML_ERR_INVALID_CHAR,
3449+
"htmlParseCharRef: value too large\n", NULL, NULL);
34433450
} else {
34443451
htmlParseErrInt(ctxt, XML_ERR_INVALID_CHAR,
34453452
"htmlParseCharRef: invalid xmlChar value %d\n",
@@ -5332,7 +5339,7 @@ static int
53325339
htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
53335340
int ret = 0;
53345341
htmlParserInputPtr in;
5335-
int avail = 0;
5342+
ptrdiff_t avail = 0;
53365343
xmlChar cur, next;
53375344

53385345
htmlParserNodeInfo node_info;
@@ -5397,7 +5404,8 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
53975404
if (in->buf == NULL)
53985405
avail = in->length - (in->cur - in->base);
53995406
else
5400-
avail = xmlBufUse(in->buf->buffer) - (in->cur - in->base);
5407+
avail = (ptrdiff_t)xmlBufUse(in->buf->buffer) -
5408+
(in->cur - in->base);
54015409
if ((avail == 0) && (terminate)) {
54025410
htmlAutoCloseOnEnd(ctxt);
54035411
if ((ctxt->nameNr == 0) && (ctxt->instate != XML_PARSER_EOF)) {
@@ -5433,7 +5441,8 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
54335441
if (in->buf == NULL)
54345442
avail = in->length - (in->cur - in->base);
54355443
else
5436-
avail = xmlBufUse(in->buf->buffer) - (in->cur - in->base);
5444+
avail = (ptrdiff_t)xmlBufUse(in->buf->buffer) -
5445+
(in->cur - in->base);
54375446
}
54385447
if ((ctxt->sax) && (ctxt->sax->setDocumentLocator))
54395448
ctxt->sax->setDocumentLocator(ctxt->userData,
@@ -5475,7 +5484,8 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
54755484
if (in->buf == NULL)
54765485
avail = in->length - (in->cur - in->base);
54775486
else
5478-
avail = xmlBufUse(in->buf->buffer) - (in->cur - in->base);
5487+
avail = (ptrdiff_t)xmlBufUse(in->buf->buffer) -
5488+
(in->cur - in->base);
54795489
/*
54805490
* no chars in buffer
54815491
*/
@@ -5548,7 +5558,8 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
55485558
if (in->buf == NULL)
55495559
avail = in->length - (in->cur - in->base);
55505560
else
5551-
avail = xmlBufUse(in->buf->buffer) - (in->cur - in->base);
5561+
avail = (ptrdiff_t)xmlBufUse(in->buf->buffer) -
5562+
(in->cur - in->base);
55525563
if (avail < 2)
55535564
goto done;
55545565
cur = in->cur[0];
@@ -5589,7 +5600,8 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
55895600
if (in->buf == NULL)
55905601
avail = in->length - (in->cur - in->base);
55915602
else
5592-
avail = xmlBufUse(in->buf->buffer) - (in->cur - in->base);
5603+
avail = (ptrdiff_t)xmlBufUse(in->buf->buffer) -
5604+
(in->cur - in->base);
55935605
if (avail < 1)
55945606
goto done;
55955607
cur = in->cur[0];
@@ -6124,12 +6136,12 @@ htmlParseChunk(htmlParserCtxtPtr ctxt, const char *chunk, int size,
61246136
int res;
61256137

61266138
res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
6139+
xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
61276140
if (res < 0) {
61286141
ctxt->errNo = XML_PARSER_EOF;
61296142
ctxt->disableSAX = 1;
61306143
return (XML_PARSER_EOF);
61316144
}
6132-
xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
61336145
#ifdef DEBUG_PUSH
61346146
xmlGenericError(xmlGenericErrorContext, "HPP: pushed %d\n", size);
61356147
#endif
@@ -6148,12 +6160,12 @@ htmlParseChunk(htmlParserCtxtPtr ctxt, const char *chunk, int size,
61486160
size_t current = ctxt->input->cur - ctxt->input->base;
61496161

61506162
nbchars = xmlCharEncInput(in, terminate);
6163+
xmlBufSetInputBaseCur(in->buffer, ctxt->input, base, current);
61516164
if (nbchars < 0) {
61526165
htmlParseErr(ctxt, XML_ERR_INVALID_ENCODING,
61536166
"encoder error\n", NULL, NULL);
61546167
return(XML_ERR_INVALID_ENCODING);
61556168
}
6156-
xmlBufSetInputBaseCur(in->buffer, ctxt->input, base, current);
61576169
}
61586170
}
61596171
}

‎modules/javafx.web/src/main/native/Source/ThirdParty/libxml/src/buf.c

+9-3
Original file line numberDiff line numberDiff line change
@@ -1233,10 +1233,12 @@ xmlBufBackToBuffer(xmlBufPtr buf) {
12331233
* Keep the buffer but provide a truncated size value.
12341234
*/
12351235
xmlBufOverflowError(buf, "Allocated size too big for xmlBuffer");
1236+
ret->use = (int) buf->use;
12361237
ret->size = INT_MAX;
1238+
} else {
1239+
ret->use = (int) buf->use;
1240+
ret->size = (int) buf->size;
12371241
}
1238-
ret->use = (int) buf->use;
1239-
ret->size = (int) buf->size;
12401242
ret->alloc = buf->alloc;
12411243
ret->content = buf->content;
12421244
ret->contentIO = buf->contentIO;
@@ -1332,8 +1334,12 @@ xmlBufGetInputBase(xmlBufPtr buf, xmlParserInputPtr input) {
13321334
int
13331335
xmlBufSetInputBaseCur(xmlBufPtr buf, xmlParserInputPtr input,
13341336
size_t base, size_t cur) {
1335-
if ((input == NULL) || (buf == NULL) || (buf->error))
1337+
if (input == NULL)
13361338
return(-1);
1339+
if ((buf == NULL) || (buf->error)) {
1340+
input->base = input->cur = input->end = BAD_CAST "";
1341+
return(-1);
1342+
}
13371343
CHECK_COMPAT(buf)
13381344
input->base = &buf->content[base];
13391345
input->cur = input->base + cur;

‎modules/javafx.web/src/main/native/Source/ThirdParty/libxml/src/parser.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -12231,12 +12231,12 @@ xmlParseChunk(xmlParserCtxtPtr ctxt, const char *chunk, int size,
1223112231
}
1223212232
}
1223312233
res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
12234+
xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
1223412235
if (res < 0) {
1223512236
ctxt->errNo = XML_PARSER_EOF;
1223612237
xmlHaltParser(ctxt);
1223712238
return (XML_PARSER_EOF);
1223812239
}
12239-
xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
1224012240
#ifdef DEBUG_PUSH
1224112241
xmlGenericError(xmlGenericErrorContext, "PP: pushed %d\n", size);
1224212242
#endif
@@ -12251,14 +12251,14 @@ xmlParseChunk(xmlParserCtxtPtr ctxt, const char *chunk, int size,
1225112251
size_t current = ctxt->input->cur - ctxt->input->base;
1225212252

1225312253
nbchars = xmlCharEncInput(in, terminate);
12254+
xmlBufSetInputBaseCur(in->buffer, ctxt->input, base, current);
1225412255
if (nbchars < 0) {
1225512256
/* TODO 2.6.0 */
1225612257
xmlGenericError(xmlGenericErrorContext,
1225712258
"xmlParseChunk: encoder error\n");
1225812259
xmlHaltParser(ctxt);
1225912260
return(XML_ERR_INVALID_ENCODING);
1226012261
}
12261-
xmlBufSetInputBaseCur(in->buffer, ctxt->input, base, current);
1226212262
}
1226312263
}
1226412264
}

‎modules/javafx.web/src/main/native/Source/ThirdParty/libxml/src/tree.c

+7-2
Original file line numberDiff line numberDiff line change
@@ -7417,12 +7417,17 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
74177417
if (size < buf->size)
74187418
return 1;
74197419

7420+
if (size > UINT_MAX - 10) {
7421+
xmlTreeErrMemory("growing buffer");
7422+
return 0;
7423+
}
7424+
74207425
/* figure out new size */
74217426
switch (buf->alloc){
74227427
case XML_BUFFER_ALLOC_IO:
74237428
case XML_BUFFER_ALLOC_DOUBLEIT:
74247429
/*take care of empty case*/
7425-
newSize = (buf->size ? buf->size*2 : size + 10);
7430+
newSize = (buf->size ? buf->size : size + 10);
74267431
while (size > newSize) {
74277432
if (newSize > UINT_MAX / 2) {
74287433
xmlTreeErrMemory("growing buffer");
@@ -7438,7 +7443,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
74387443
if (buf->use < BASE_BUFFER_SIZE)
74397444
newSize = size;
74407445
else {
7441-
newSize = buf->size * 2;
7446+
newSize = buf->size;
74427447
while (size > newSize) {
74437448
if (newSize > UINT_MAX / 2) {
74447449
xmlTreeErrMemory("growing buffer");

‎modules/javafx.web/src/main/native/Source/ThirdParty/libxml/src/xmlreader.c

+55
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,59 @@ xmlTextReaderRemoveID(xmlDocPtr doc, xmlAttrPtr attr) {
278278
return(0);
279279
}
280280

281+
/**
282+
* xmlTextReaderWalkRemoveRef:
283+
* @data: Contents of current link
284+
* @user: Value supplied by the user
285+
*
286+
* Returns 0 to abort the walk or 1 to continue
287+
*/
288+
static int
289+
xmlTextReaderWalkRemoveRef(const void *data, void *user)
290+
{
291+
xmlRefPtr ref = (xmlRefPtr)data;
292+
xmlAttrPtr attr = (xmlAttrPtr)user;
293+
294+
if (ref->attr == attr) { /* Matched: remove and terminate walk */
295+
ref->name = xmlStrdup(attr->name);
296+
ref->attr = NULL;
297+
return 0;
298+
}
299+
return 1;
300+
}
301+
302+
/**
303+
* xmlTextReaderRemoveRef:
304+
* @doc: the document
305+
* @attr: the attribute
306+
*
307+
* Remove the given attribute from the Ref table maintained internally.
308+
*
309+
* Returns -1 if the lookup failed and 0 otherwise
310+
*/
311+
static int
312+
xmlTextReaderRemoveRef(xmlDocPtr doc, xmlAttrPtr attr) {
313+
xmlListPtr ref_list;
314+
xmlRefTablePtr table;
315+
xmlChar *ID;
316+
317+
if (doc == NULL) return(-1);
318+
if (attr == NULL) return(-1);
319+
table = (xmlRefTablePtr) doc->refs;
320+
if (table == NULL)
321+
return(-1);
322+
323+
ID = xmlNodeListGetString(doc, attr->children, 1);
324+
if (ID == NULL)
325+
return(-1);
326+
ref_list = xmlHashLookup(table, ID);
327+
xmlFree(ID);
328+
if(ref_list == NULL)
329+
return (-1);
330+
xmlListWalk(ref_list, xmlTextReaderWalkRemoveRef, attr);
331+
return(0);
332+
}
333+
281334
/**
282335
* xmlTextReaderFreeProp:
283336
* @reader: the xmlTextReaderPtr used
@@ -304,6 +357,8 @@ xmlTextReaderFreeProp(xmlTextReaderPtr reader, xmlAttrPtr cur) {
304357
(cur->parent->doc->extSubset != NULL))) {
305358
if (xmlIsID(cur->parent->doc, cur->parent, cur))
306359
xmlTextReaderRemoveID(cur->parent->doc, cur);
360+
if (xmlIsRef(cur->parent->doc, cur->parent, cur))
361+
xmlTextReaderRemoveRef(cur->parent->doc, cur);
307362
}
308363
if (cur->children != NULL)
309364
xmlTextReaderFreeNodeList(reader, cur->children);

‎modules/javafx.web/src/main/native/Source/ThirdParty/libxml/src/xmlsave.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -2197,7 +2197,7 @@ xmlNodeDump(xmlBufferPtr buf, xmlDocPtr doc, xmlNodePtr cur, int level,
21972197
int format)
21982198
{
21992199
xmlBufPtr buffer;
2200-
int ret;
2200+
size_t ret;
22012201

22022202
if ((buf == NULL) || (cur == NULL))
22032203
return(-1);

0 commit comments

Comments
 (0)
Please sign in to comment.