summaryrefslogtreecommitdiffstats
path: root/parser/htmlparser/nsExpatDriver.cpp
diff options
context:
space:
mode:
authorwolfbeast <mcwerewolf@gmail.com>2017-06-15 16:38:41 +0200
committerwolfbeast <mcwerewolf@gmail.com>2018-02-02 18:55:59 +0100
commit7d0c56c2879861e97e0c8af6daa16fa3b945eec4 (patch)
treeabb0f1adb136850fd5e94b3cb0cfd2f05fc911c9 /parser/htmlparser/nsExpatDriver.cpp
parentc0c702a5e3284e843e680064b4c6a7280242c567 (diff)
downloadUXP-7d0c56c2879861e97e0c8af6daa16fa3b945eec4.tar
UXP-7d0c56c2879861e97e0c8af6daa16fa3b945eec4.tar.gz
UXP-7d0c56c2879861e97e0c8af6daa16fa3b945eec4.tar.lz
UXP-7d0c56c2879861e97e0c8af6daa16fa3b945eec4.tar.xz
UXP-7d0c56c2879861e97e0c8af6daa16fa3b945eec4.zip
Restrict XML file recursion depth to 200.
This resolves #2.
Diffstat (limited to 'parser/htmlparser/nsExpatDriver.cpp')
-rw-r--r--parser/htmlparser/nsExpatDriver.cpp14
1 files changed, 11 insertions, 3 deletions
diff --git a/parser/htmlparser/nsExpatDriver.cpp b/parser/htmlparser/nsExpatDriver.cpp
index 8882ec593..9cf888f69 100644
--- a/parser/htmlparser/nsExpatDriver.cpp
+++ b/parser/htmlparser/nsExpatDriver.cpp
@@ -338,6 +338,9 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(nsExpatDriver)
NS_IMPL_CYCLE_COLLECTION(nsExpatDriver, mSink, mExtendedSink)
+// We store the tagdepth in a Uint8, so make sure the limit fits in a Uint8.
+PR_STATIC_ASSERT(MAX_XML_TREE_DEPTH <= UINT8_MAX);
+
nsExpatDriver::nsExpatDriver()
: mExpatParser(nullptr),
mInCData(false),
@@ -345,6 +348,7 @@ nsExpatDriver::nsExpatDriver()
mInExternalDTD(false),
mMadeFinalCallToExpat(false),
mIsFinalChunk(false),
+ mTagDepth(0),
mInternalState(NS_OK),
mExpatBuffered(0),
mCatalogData(nullptr),
@@ -359,7 +363,7 @@ nsExpatDriver::~nsExpatDriver()
}
}
-nsresult
+void
nsExpatDriver::HandleStartElement(const char16_t *aValue,
const char16_t **aAtts)
{
@@ -377,13 +381,16 @@ nsExpatDriver::HandleStartElement(const char16_t *aValue,
}
if (mSink) {
+ if (++mTagDepth == MAX_XML_TREE_DEPTH) {
+ MaybeStopParser(NS_ERROR_HTMLPARSER_HIERARCHYTOODEEP);
+ return;
+ }
+
nsresult rv = mSink->
HandleStartElement(aValue, aAtts, attrArrayLength,
XML_GetCurrentLineNumber(mExpatParser));
MaybeStopParser(rv);
}
-
- return NS_OK;
}
nsresult
@@ -395,6 +402,7 @@ nsExpatDriver::HandleEndElement(const char16_t *aValue)
if (mSink && mInternalState != NS_ERROR_HTMLPARSER_STOPPARSING) {
nsresult rv = mSink->HandleEndElement(aValue);
+ --mTagDepth;
MaybeStopParser(rv);
}