summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Wellnhofer <wellnhofer@aevum.de>2020-08-26 00:34:38 +0200
committerNick Wellnhofer <wellnhofer@aevum.de>2020-08-26 00:34:38 +0200
commit77c26bad0433541f486b1e7ced44ca9979376908 (patch)
treeb199c094f0158a4364a598b917e6fc34047c256e
parent824657768aea2cce9c23e72ba8085cb5e44350c7 (diff)
downloadlibxslt-77c26bad0433541f486b1e7ced44ca9979376908.tar.gz
Don't set maxDepth in XPath contexts
The maximum recursion depth is hardcoded in libxml2 now.
-rw-r--r--libxslt/functions.c2
-rw-r--r--tests/fuzz/fuzz.c11
2 files changed, 3 insertions, 10 deletions
diff --git a/libxslt/functions.c b/libxslt/functions.c
index 975ea790..7887dda7 100644
--- a/libxslt/functions.c
+++ b/libxslt/functions.c
@@ -182,7 +182,7 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI)
defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
xptrctxt->opLimit = ctxt->context->opLimit;
xptrctxt->opCount = ctxt->context->opCount;
- xptrctxt->maxDepth = ctxt->context->maxDepth - ctxt->context->depth;
+ xptrctxt->depth = ctxt->context->depth;
resObj = xmlXPtrEval(fragment, xptrctxt);
diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c
index 75234ad6..780c2d41 100644
--- a/tests/fuzz/fuzz.c
+++ b/tests/fuzz/fuzz.c
@@ -183,7 +183,6 @@ xsltFuzzXPathInit(int *argc_p ATTRIBUTE_UNUSED, char ***argv_p,
xpctxt = tctxt->xpathCtxt;
/* Resource limits to avoid timeouts and call stack overflows */
- xpctxt->maxDepth = 500;
xpctxt->opLimit = 500000;
/* Test namespaces used in xpath.xml */
@@ -314,12 +313,6 @@ xsltFuzzXsltInit(int *argc_p ATTRIBUTE_UNUSED, char ***argv_p,
return 0;
}
-static void
-xsltSetXPathResourceLimits(xmlXPathContextPtr ctxt) {
- ctxt->maxDepth = 200;
- ctxt->opLimit = 100000;
-}
-
xmlChar *
xsltFuzzXslt(const char *data, size_t size) {
xmlDocPtr xsltDoc;
@@ -349,7 +342,7 @@ xsltFuzzXslt(const char *data, size_t size) {
xmlFreeDoc(xsltDoc);
return NULL;
}
- xsltSetXPathResourceLimits(sheet->xpathCtxt);
+ sheet->xpathCtxt->opLimit = 100000;
sheet->xpathCtxt->opCount = 0;
if (xsltParseStylesheetUser(sheet, xsltDoc) != 0) {
xsltFreeStylesheet(sheet);
@@ -361,7 +354,7 @@ xsltFuzzXslt(const char *data, size_t size) {
xsltSetCtxtSecurityPrefs(sec, ctxt);
ctxt->maxTemplateDepth = 100;
ctxt->opLimit = 20000;
- xsltSetXPathResourceLimits(ctxt->xpathCtxt);
+ ctxt->xpathCtxt->opLimit = 100000;
ctxt->xpathCtxt->opCount = sheet->xpathCtxt->opCount;
result = xsltApplyStylesheetUser(sheet, doc, NULL, NULL, NULL, ctxt);