diff options
| -rw-r--r-- | .mailmap | 1 | ||||
| -rw-r--r-- | expat/examples/elements.c | 2 | ||||
| -rw-r--r-- | expat/examples/outline.c | 2 | ||||
| -rw-r--r-- | expat/lib/xmlparse.c | 118 | ||||
| -rw-r--r-- | expat/lib/xmlrole.c | 2 | ||||
| -rw-r--r-- | expat/lib/xmltok.c | 2 | ||||
| -rw-r--r-- | expat/tests/benchmark/benchmark.c | 2 | ||||
| -rw-r--r-- | expat/tests/runtests.c | 2 | ||||
| -rw-r--r-- | expat/xmlwf/xmlfile.c | 2 | ||||
| -rw-r--r-- | expat/xmlwf/xmlwf.c | 2 |
10 files changed, 89 insertions, 46 deletions
@@ -12,6 +12,7 @@ Rolf Eike Beer <eike@sf-mail.de> <eb@emlix.com> Sebastian Pipping <sebastian@pipping.org> <hartwork@users.sourceforge.net> S. P. Zeidler <spz@netbsd.org> Stephen Groat <stephen@groat.us> <stephengroat@Stephens-MacBook-Pro.local> +Steven Solie <steven@solie.ca> <ssolie@users.sourceforge.net> Thomas Beutlich <tc@tbeu.de> Viktor Szakats <commit@vsz.me> <vszakats@users.noreply.github.com> Zhongyuan Zhou <zhouzhongyuan@huawei.com> diff --git a/expat/examples/elements.c b/expat/examples/elements.c index 2b664561..481d4447 100644 --- a/expat/examples/elements.c +++ b/expat/examples/elements.c @@ -13,7 +13,7 @@ Copyright (c) 1997-2000 Thai Open Source Software Center Ltd Copyright (c) 2001-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> Copyright (c) 2004-2006 Karl Waclawek <karl@waclawek.net> - Copyright (c) 2005-2007 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2007 Steven Solie <steven@solie.ca> Copyright (c) 2016-2019 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> Copyright (c) 2019 Zhongyuan Zhou <zhouzhongyuan@huawei.com> diff --git a/expat/examples/outline.c b/expat/examples/outline.c index 4ed041fe..936f0e09 100644 --- a/expat/examples/outline.c +++ b/expat/examples/outline.c @@ -10,7 +10,7 @@ Copyright (c) 2000 Clark Cooper <coopercc@users.sourceforge.net> Copyright (c) 2001-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> - Copyright (c) 2005-2007 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2007 Steven Solie <steven@solie.ca> Copyright (c) 2005-2006 Karl Waclawek <karl@waclawek.net> Copyright (c) 2016-2019 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c index f34d6ab5..8bd5b077 100644 --- a/expat/lib/xmlparse.c +++ b/expat/lib/xmlparse.c @@ -11,7 +11,7 @@ Copyright (c) 2000-2006 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> Copyright (c) 2001-2002 Greg Stein <gstein@users.sourceforge.net> Copyright (c) 2002-2016 Karl Waclawek <karl@waclawek.net> - Copyright (c) 2005-2009 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2009 Steven Solie <steven@solie.ca> Copyright (c) 2016 Eric Rahm <erahm@mozilla.com> Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2016 Gaurav <g.gupta@samsung.com> @@ -7322,44 +7322,15 @@ nextScaffoldPart(XML_Parser parser) { return next; } -static void -build_node(XML_Parser parser, int src_node, XML_Content *dest, - XML_Content **contpos, XML_Char **strpos) { - DTD *const dtd = parser->m_dtd; /* save one level of indirection */ - dest->type = dtd->scaffold[src_node].type; - dest->quant = dtd->scaffold[src_node].quant; - if (dest->type == XML_CTYPE_NAME) { - const XML_Char *src; - dest->name = *strpos; - src = dtd->scaffold[src_node].name; - for (;;) { - *(*strpos)++ = *src; - if (! *src) - break; - src++; - } - dest->numchildren = 0; - dest->children = NULL; - } else { - unsigned int i; - int cn; - dest->numchildren = dtd->scaffold[src_node].childcnt; - dest->children = *contpos; - *contpos += dest->numchildren; - for (i = 0, cn = dtd->scaffold[src_node].firstchild; i < dest->numchildren; - i++, cn = dtd->scaffold[cn].nextsib) { - build_node(parser, cn, &(dest->children[i]), contpos, strpos); - } - dest->name = NULL; - } -} - static XML_Content * build_model(XML_Parser parser) { + /* Function build_model transforms the existing parser->m_dtd->scaffold + * array of CONTENT_SCAFFOLD tree nodes into a new array of + * XML_Content tree nodes followed by a gapless list of zero-terminated + * strings. */ DTD *const dtd = parser->m_dtd; /* save one level of indirection */ XML_Content *ret; - XML_Content *cpos; - XML_Char *str; + XML_Char *str; /* the current string writing location */ /* Detect and prevent integer overflow. * The preprocessor guard addresses the "always false" warning @@ -7385,10 +7356,81 @@ build_model(XML_Parser parser) { if (! ret) return NULL; - str = (XML_Char *)(&ret[dtd->scaffCount]); - cpos = &ret[1]; + /* What follows is an iterative implementation (of what was previously done + * recursively in a dedicated function called "build_node". The old recursive + * build_node could be forced into stack exhaustion from input as small as a + * few megabyte, and so that was a security issue. Hence, a function call + * stack is avoided now by resolving recursion.) + * + * The iterative approach works as follows: + * + * - We use space in the target array for building a temporary stack structure + * while that space is still unused. + * The stack grows from the array's end downwards and the "actual data" + * grows from the start upwards, sequentially. + * (Because stack grows downwards, pushing onto the stack is a decrement + * while popping off the stack is an increment.) + * + * - A stack element appears as a regular XML_Content node on the outside, + * but only uses a single field -- numchildren -- to store the source + * tree node array index. These are the breadcrumbs leading the way back + * during pre-order (node first) depth-first traversal. + * + * - The reason we know the stack will never grow into (or overlap with) + * the area with data of value at the start of the array is because + * the overall number of elements to process matches the size of the array, + * and the sum of fully processed nodes and yet-to-be processed nodes + * on the stack, cannot be more than the total number of nodes. + * It is possible for the top of the stack and the about-to-write node + * to meet, but that is safe because we get the source index out + * before doing any writes on that node. + */ + XML_Content *dest = ret; /* tree node writing location, moves upwards */ + XML_Content *const destLimit = &ret[dtd->scaffCount]; + XML_Content *const stackBottom = &ret[dtd->scaffCount]; + XML_Content *stackTop = stackBottom; /* i.e. stack is initially empty */ + str = (XML_Char *)&ret[dtd->scaffCount]; + + /* Push source tree root node index onto the stack */ + (--stackTop)->numchildren = 0; + + for (; dest < destLimit; dest++) { + /* Pop source tree node index off the stack */ + const int src_node = (int)(stackTop++)->numchildren; + + /* Convert item */ + dest->type = dtd->scaffold[src_node].type; + dest->quant = dtd->scaffold[src_node].quant; + if (dest->type == XML_CTYPE_NAME) { + const XML_Char *src; + dest->name = str; + src = dtd->scaffold[src_node].name; + for (;;) { + *str++ = *src; + if (! *src) + break; + src++; + } + dest->numchildren = 0; + dest->children = NULL; + } else { + unsigned int i; + int cn; + dest->name = NULL; + dest->numchildren = dtd->scaffold[src_node].childcnt; + dest->children = &dest[1]; + + /* Push children to the stack + * in a way where the first child ends up at the top of the + * (downwards growing) stack, in order to be processed first. */ + stackTop -= dest->numchildren; + for (i = 0, cn = dtd->scaffold[src_node].firstchild; + i < dest->numchildren; i++, cn = dtd->scaffold[cn].nextsib) { + (stackTop + i)->numchildren = (unsigned int)cn; + } + } + } - build_node(parser, 0, ret, &cpos, &str); return ret; } diff --git a/expat/lib/xmlrole.c b/expat/lib/xmlrole.c index 77746ee4..3f0f5c15 100644 --- a/expat/lib/xmlrole.c +++ b/expat/lib/xmlrole.c @@ -11,7 +11,7 @@ Copyright (c) 2002 Greg Stein <gstein@users.sourceforge.net> Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net> Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> - Copyright (c) 2005-2009 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2009 Steven Solie <steven@solie.ca> Copyright (c) 2016-2021 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> Copyright (c) 2019 David Loffredo <loffredo@steptools.com> diff --git a/expat/lib/xmltok.c b/expat/lib/xmltok.c index 502ca1ad..a72200e8 100644 --- a/expat/lib/xmltok.c +++ b/expat/lib/xmltok.c @@ -11,7 +11,7 @@ Copyright (c) 2001-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> Copyright (c) 2002 Greg Stein <gstein@users.sourceforge.net> Copyright (c) 2002-2016 Karl Waclawek <karl@waclawek.net> - Copyright (c) 2005-2009 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2009 Steven Solie <steven@solie.ca> Copyright (c) 2016-2021 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2016 Pascal Cuoq <cuoq@trust-in-soft.com> Copyright (c) 2016 Don Lewis <truckman@apache.org> diff --git a/expat/tests/benchmark/benchmark.c b/expat/tests/benchmark/benchmark.c index ba2bc6e1..2c4eb78e 100644 --- a/expat/tests/benchmark/benchmark.c +++ b/expat/tests/benchmark/benchmark.c @@ -7,7 +7,7 @@ |_| XML parser Copyright (c) 2003-2006 Karl Waclawek <karl@waclawek.net> - Copyright (c) 2005-2007 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2007 Steven Solie <steven@solie.ca> Copyright (c) 2017 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> Licensed under the MIT license: diff --git a/expat/tests/runtests.c b/expat/tests/runtests.c index 4a9c5328..d07203f2 100644 --- a/expat/tests/runtests.c +++ b/expat/tests/runtests.c @@ -8,7 +8,7 @@ Copyright (c) 2001-2006 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> Copyright (c) 2003 Greg Stein <gstein@users.sourceforge.net> - Copyright (c) 2005-2007 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2007 Steven Solie <steven@solie.ca> Copyright (c) 2005-2012 Karl Waclawek <karl@waclawek.net> Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017-2018 Rhodri James <rhodri@wildebeest.org.uk> diff --git a/expat/xmlwf/xmlfile.c b/expat/xmlwf/xmlfile.c index e3d6259a..e3521676 100644 --- a/expat/xmlwf/xmlfile.c +++ b/expat/xmlwf/xmlfile.c @@ -10,7 +10,7 @@ Copyright (c) 2000 Clark Cooper <coopercc@users.sourceforge.net> Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> Copyright (c) 2004-2006 Karl Waclawek <karl@waclawek.net> - Copyright (c) 2005-2007 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2007 Steven Solie <steven@solie.ca> Copyright (c) 2016-2021 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> Copyright (c) 2019 David Loffredo <loffredo@steptools.com> diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c index 78573111..b0cd212f 100644 --- a/expat/xmlwf/xmlwf.c +++ b/expat/xmlwf/xmlwf.c @@ -10,7 +10,7 @@ Copyright (c) 2000 Clark Cooper <coopercc@users.sourceforge.net> Copyright (c) 2001-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> Copyright (c) 2004-2009 Karl Waclawek <karl@waclawek.net> - Copyright (c) 2005-2007 Steven Solie <ssolie@users.sourceforge.net> + Copyright (c) 2005-2007 Steven Solie <steven@solie.ca> Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> Copyright (c) 2019 David Loffredo <loffredo@steptools.com> |