1 From f5048b3e71fc30ad096970b8df6e7af073bae4cb Mon Sep 17 00:00:00 2001
2 From: Daniel Veillard <veillard@redhat.com>
3 Date: Thu, 18 Aug 2011 09:10:13 +0000
4 Subject: Hardening of XPath evaluation
5
6 Add a mechanism of frame for XPath evaluation when entering a function
7 or a scoped evaluation, also fix a potential problem in predicate
8 evaluation.
9 ---
10 diff --git a/include/libxml/xpath.h b/include/libxml/xpath.h
11 index 1a9e30e..ddd9dd8 100644
12 --- a/include/libxml/xpath.h
13 +++ b/include/libxml/xpath.h
14 @@ -68,7 +68,8 @@ typedef enum {
15 XPATH_UNDEF_PREFIX_ERROR,
16 XPATH_ENCODING_ERROR,
17 XPATH_INVALID_CHAR_ERROR,
18 - XPATH_INVALID_CTXT
19 + XPATH_INVALID_CTXT,
20 + XPATH_STACK_ERROR
21 } xmlXPathError;
22
23 /*
24 @@ -380,6 +381,8 @@ struct _xmlXPathParserContext {
25 xmlXPathCompExprPtr comp; /* the precompiled expression */
26 int xptr; /* it this an XPointer expression */
27 xmlNodePtr ancestor; /* used for walking preceding axis */
28 +
29 + int valueFrame; /* used to limit Pop on the stack */
30 };
31
32 /************************************************************************
33 diff --git a/xpath.c b/xpath.c
34 index b59ac5a..bcee2ea 100644
35 --- a/xpath.c
36 +++ b/xpath.c
37 @@ -252,6 +252,7 @@ static const char *xmlXPathErrorMessages[] = {
38 "Encoding error\n",
39 "Char out of XML range\n",
40 "Invalid or incomplete context\n",
41 + "Stack usage errror\n",
42 "?? Unknown error ??\n" /* Must be last in the list! */
43 };
44 #define MAXERRNO ((int)(sizeof(xmlXPathErrorMessages) / \
45 @@ -2398,6 +2399,42 @@ xmlXPathCacheConvertNumber(xmlXPathContextPtr ctxt, xmlXPathObjectPtr val) {
46 ************************************************************************/
47
48 /**
49 + * xmlXPathSetFrame:
50 + * @ctxt: an XPath parser context
51 + *
52 + * Set the callee evaluation frame
53 + *
54 + * Returns the previous frame value to be restored once done
55 + */
56 +static int
57 +xmlXPathSetFrame(xmlXPathParserContextPtr ctxt) {
58 + int ret;
59 +
60 + if (ctxt == NULL)
61 + return(0);
62 + ret = ctxt->valueFrame;
63 + ctxt->valueFrame = ctxt->valueNr;
64 + return(ret);
65 +}
66 +
67 +/**
68 + * xmlXPathPopFrame:
69 + * @ctxt: an XPath parser context
70 + * @frame: the previous frame value
71 + *
72 + * Remove the callee evaluation frame
73 + */
74 +static void
75 +xmlXPathPopFrame(xmlXPathParserContextPtr ctxt, int frame) {
76 + if (ctxt == NULL)
77 + return;
78 + if (ctxt->valueNr < ctxt->valueFrame) {
79 + xmlXPatherror(ctxt, __FILE__, __LINE__, XPATH_STACK_ERROR);
80 + }
81 + ctxt->valueFrame = frame;
82 +}
83 +
84 +/**
85 * valuePop:
86 * @ctxt: an XPath evaluation context
87 *
88 @@ -2412,6 +2449,12 @@ valuePop(xmlXPathParserContextPtr ctxt)
89
90 if ((ctxt == NULL) || (ctxt->valueNr <= 0))
91 return (NULL);
92 +
93 + if (ctxt->valueNr <= ctxt->valueFrame) {
94 + xmlXPatherror(ctxt, __FILE__, __LINE__, XPATH_STACK_ERROR);
95 + return (NULL);
96 + }
97 +
98 ctxt->valueNr--;
99 if (ctxt->valueNr > 0)
100 ctxt->value = ctxt->valueTab[ctxt->valueNr - 1];
101 @@ -6154,6 +6197,7 @@ xmlXPathCompParserContext(xmlXPathCompExprPtr comp, xmlXPathContextPtr ctxt) {
102 ret->valueNr = 0;
103 ret->valueMax = 10;
104 ret->value = NULL;
105 + ret->valueFrame = 0;
106
107 ret->context = ctxt;
108 ret->comp = comp;
109 @@ -11711,6 +11755,7 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt,
110 xmlXPathObjectPtr contextObj = NULL, exprRes = NULL;
111 xmlNodePtr oldContextNode, contextNode = NULL;
112 xmlXPathContextPtr xpctxt = ctxt->context;
113 + int frame;
114
115 #ifdef LIBXML_XPTR_ENABLED
116 /*
117 @@ -11730,6 +11775,8 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt,
118 */
119 exprOp = &ctxt->comp->steps[op->ch2];
120 for (i = 0; i < set->nodeNr; i++) {
121 + xmlXPathObjectPtr tmp;
122 +
123 if (set->nodeTab[i] == NULL)
124 continue;
125
126 @@ -11757,23 +11804,25 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt,
127 xmlXPathNodeSetAddUnique(contextObj->nodesetval,
128 contextNode);
129
130 + frame = xmlXPathSetFrame(ctxt);
131 valuePush(ctxt, contextObj);
132 res = xmlXPathCompOpEvalToBoolean(ctxt, exprOp, 1);
133 + tmp = valuePop(ctxt);
134 + xmlXPathPopFrame(ctxt, frame);
135
136 if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
137 - xmlXPathObjectPtr tmp;
138 - /* pop the result if any */
139 - tmp = valuePop(ctxt);
140 - if (tmp != contextObj) {
141 + while (tmp != contextObj) {
142 /*
143 * Free up the result
144 * then pop off contextObj, which will be freed later
145 */
146 xmlXPathReleaseObject(xpctxt, tmp);
147 - valuePop(ctxt);
148 + tmp = valuePop(ctxt);
149 }
150 goto evaluation_error;
151 }
152 + /* push the result back onto the stack */
153 + valuePush(ctxt, tmp);
154
155 if (res)
156 pos++;
157 @@ -13377,7 +13426,9 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
158 xmlXPathFunction func;
159 const xmlChar *oldFunc, *oldFuncURI;
160 int i;
161 + int frame;
162
163 + frame = xmlXPathSetFrame(ctxt);
164 if (op->ch1 != -1)
165 total +=
166 xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);
167 @@ -13385,15 +13436,18 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
168 xmlGenericError(xmlGenericErrorContext,
169 "xmlXPathCompOpEval: parameter error\n");
170 ctxt->error = XPATH_INVALID_OPERAND;
171 + xmlXPathPopFrame(ctxt, frame);
172 return (total);
173 }
174 - for (i = 0; i < op->value; i++)
175 + for (i = 0; i < op->value; i++) {
176 if (ctxt->valueTab[(ctxt->valueNr - 1) - i] == NULL) {
177 xmlGenericError(xmlGenericErrorContext,
178 "xmlXPathCompOpEval: parameter error\n");
179 ctxt->error = XPATH_INVALID_OPERAND;
180 + xmlXPathPopFrame(ctxt, frame);
181 return (total);
182 }
183 + }
184 if (op->cache != NULL)
185 XML_CAST_FPTR(func) = op->cache;
186 else {
187 @@ -13409,6 +13463,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
188 xmlGenericError(xmlGenericErrorContext,
189 "xmlXPathCompOpEval: function %s bound to undefined prefix %s\n",
190 (char *)op->value4, (char *)op->value5);
191 + xmlXPathPopFrame(ctxt, frame);
192 return (total);
193 }
194 func = xmlXPathFunctionLookupNS(ctxt->context,
195 @@ -13430,6 +13485,7 @@ xmlXPathCompOpEval(xmlXPathParserContextPtr ctxt, xmlXPathStepOpPtr op)
196 func(ctxt, op->value);
197 ctxt->context->function = oldFunc;
198 ctxt->context->functionURI = oldFuncURI;
199 + xmlXPathPopFrame(ctxt, frame);
200 return (total);
201 }
202 case XPATH_OP_ARG:
203 @@ -14333,6 +14389,7 @@ xmlXPathRunEval(xmlXPathParserContextPtr ctxt, int toBool)
204 ctxt->valueNr = 0;
205 ctxt->valueMax = 10;
206 ctxt->value = NULL;
207 + ctxt->valueFrame = 0;
208 }
209 #ifdef XPATH_STREAMING
210 if (ctxt->comp->stream) {
211 diff --git a/xpointer.c b/xpointer.c
212 index 7a42d02..37afa3a 100644
213 --- a/xpointer.c
214 +++ b/xpointer.c
215 @@ -1269,6 +1269,7 @@ xmlXPtrEvalXPointer(xmlXPathParserContextPtr ctxt) {
216 ctxt->valueNr = 0;
217 ctxt->valueMax = 10;
218 ctxt->value = NULL;
219 + ctxt->valueFrame = 0;
220 }
221 SKIP_BLANKS;
222 if (CUR == '/') {
223 --
224 cgit v0.9.0.2
|
