potok/tinyxml2
1
0
Fork 0
Code Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #695 from leethomason/manydecs

Browse Source 
Many declarations
This commit is contained in:
Lee Thomason
2018-08-25 10:54:54 -07:00
committed by GitHub
parent baf8bc93a7 92506ca698
commit 3be5d2b74b
3 changed files with 32 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
resources/xmltest-5662204197076992.xml Normal file
View File

File diff suppressed because one or more lines are too long

24
tinyxml2.cpp
View File

@@ -1032,15 +1032,25 @@ char* XMLNode::ParseDeep( char* p, StrPair* parentEndTag, int* curLineNumPtr )
XMLDeclaration* decl = node->ToDeclaration();
if ( decl ) {
// Declarations are only allowed at document level
bool wellLocated = ( ToDocument() != 0 );
if ( wellLocated ) {
//
// Multiple declarations are allowed but all declarations
// must occur before anything else
for ( const XMLNode* existingNode = _document->FirstChild(); existingNode; existingNode = existingNode->NextSibling() ) {
if ( !existingNode->ToDeclaration() ) {
wellLocated = false;
break;
// must occur before anything else.
//
// Optimized due to a security test case. If the first node is
// a declaration, and the last node is a declaration, then only
// declarations have so far been addded.
bool wellLocated = false;
if (ToDocument()) {
if (FirstChild()) {
wellLocated =
FirstChild() &&
FirstChild()->ToDeclaration() &&
LastChild() &&
LastChild()->ToDeclaration();
}
else {
wellLocated = true;
}
}
if ( !wellLocated ) {

12
xmltest.cpp
View File

@@ -2050,6 +2050,18 @@ int main( int argc, const char ** argv )
XMLTest("Stack overflow prevented.", XML_ELEMENT_DEPTH_EXCEEDED, doc.ErrorID());
}
}
{
const char* TESTS[] = {
"./resources/xmltest-5662204197076992.xml", // Security-level performance issue.
0
};
for (int i = 0; TESTS[i]; ++i) {
XMLDocument doc;
doc.LoadFile(TESTS[i]);
// Need only not crash / lock up.
XMLTest("Fuzz attack prevented.", true, true);
}
}
{
// Crashing reported via email.
const char* xml =