diff options
| author | Alexander Barkov <bar@mnogosearch.org> | 2014-04-23 15:53:47 +0400 |
|---|---|---|
| committer | Alexander Barkov <bar@mnogosearch.org> | 2014-04-23 15:53:47 +0400 |
| commit | a24ea50d1a04d7bfe9608fe1ea8ac1ab8ed97294 (patch) | |
| tree | 0d4cdc038f11cab6684ce2bfdfb4891d40922e03 /strings | |
| parent | 213f10363e1134fdb39842f55876db1136496ff3 (diff) | |
| download | mariadb-git-a24ea50d1a04d7bfe9608fe1ea8ac1ab8ed97294.tar.gz | |
MDEV-5338 XML parser accepts malformed data
Diffstat (limited to 'strings')
| -rw-r--r-- | strings/xml.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/strings/xml.c b/strings/xml.c index ac6ab807ed8..428222c47ed 100644 --- a/strings/xml.c +++ b/strings/xml.c @@ -240,7 +240,7 @@ static void mstr(char *s,const char *src,size_t l1, size_t l2) static int my_xml_leave(MY_XML_PARSER *p, const char *str, size_t slen) { - char *e; + char *e, *tag; size_t glen; char s[32]; char g[32]; @@ -249,13 +249,14 @@ static int my_xml_leave(MY_XML_PARSER *p, const char *str, size_t slen) /* Find previous '/' or beginning */ for (e=p->attrend; (e>p->attr) && (e[0] != '/') ; e--); glen = (size_t) ((e[0] == '/') ? (p->attrend-e-1) : p->attrend-e); - - if (str && (slen != glen)) + tag= e[0] == '/' ? e + 1 : e; + + if (str && (slen != glen || memcmp(str, tag, slen))) { mstr(s,str,sizeof(s)-1,slen); if (glen) { - mstr(g,e+1,sizeof(g)-1,glen), + mstr(g, tag, sizeof(g)-1, glen); sprintf(p->errstr,"'</%s>' unexpected ('</%s>' wanted)",s,g); } else |