|
| 1 | +From eae9291aa73907694dd3a4274d306e31217e746e Mon Sep 17 00:00:00 2001 |
| 2 | +From: Nathan <nathan.shain@echohq.com> |
| 3 | +Date: Wed, 10 Sep 2025 18:11:50 +0300 |
| 4 | +Subject: [PATCH] fix: Prevent infinite recursion in xmlCatalogListXMLResolve |
| 5 | + |
| 6 | +Upstream patch reference: |
| 7 | +https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/337.patch |
| 8 | +--- |
| 9 | + catalog.c | 28 ++++++++++++++++++++-------- |
| 10 | + result/catalogs/recursive | 1 + |
| 11 | + test/catalogs/recursive.script | 0 |
| 12 | + test/catalogs/recursive.sgml | 1 + |
| 13 | + 4 files changed, 22 insertions(+), 8 deletions(-) |
| 14 | + create mode 100644 result/catalogs/recursive |
| 15 | + create mode 100644 test/catalogs/recursive.script |
| 16 | + create mode 100644 test/catalogs/recursive.sgml |
| 17 | + |
| 18 | +diff --git a/catalog.c b/catalog.c |
| 19 | +index 8e96f4b..e8e0a0d 100644 |
| 20 | +--- a/catalog.c |
| 21 | ++++ b/catalog.c |
| 22 | +@@ -84,7 +84,7 @@ unsigned long __stdcall GetModuleFileNameA(void*, char*, unsigned long); |
| 23 | + #endif |
| 24 | + |
| 25 | + static xmlChar *xmlCatalogNormalizePublic(const xmlChar *pubID); |
| 26 | +-static int xmlExpandCatalog(xmlCatalogPtr catal, const char *filename); |
| 27 | ++static int xmlExpandCatalog(xmlCatalogPtr catal, const char *filename, int depth); |
| 28 | + |
| 29 | + /************************************************************************ |
| 30 | + * * |
| 31 | +@@ -2357,17 +2357,24 @@ xmlGetSGMLCatalogEntryType(const xmlChar *name) { |
| 32 | + * Parse an SGML catalog content and fill up the @catal hash table with |
| 33 | + * the new entries found. |
| 34 | + * |
| 35 | ++ * @param depth the current depth of the catalog |
| 36 | + * Returns 0 in case of success, -1 in case of error. |
| 37 | + */ |
| 38 | + static int |
| 39 | + xmlParseSGMLCatalog(xmlCatalogPtr catal, const xmlChar *value, |
| 40 | +- const char *file, int super) { |
| 41 | ++ const char *file, int super, int depth) { |
| 42 | + const xmlChar *cur = value; |
| 43 | + xmlChar *base = NULL; |
| 44 | + int res; |
| 45 | + |
| 46 | + if ((cur == NULL) || (file == NULL)) |
| 47 | + return(-1); |
| 48 | ++ |
| 49 | ++ /* Check recursion depth */ |
| 50 | ++ if (depth > MAX_CATAL_DEPTH) { |
| 51 | ++ return(-1); |
| 52 | ++ } |
| 53 | ++ |
| 54 | + base = xmlStrdup((const xmlChar *) file); |
| 55 | + |
| 56 | + while ((cur != NULL) && (cur[0] != 0)) { |
| 57 | +@@ -2545,7 +2552,7 @@ xmlParseSGMLCatalog(xmlCatalogPtr catal, const xmlChar *value, |
| 58 | + |
| 59 | + filename = xmlBuildURI(sysid, base); |
| 60 | + if (filename != NULL) { |
| 61 | +- xmlExpandCatalog(catal, (const char *)filename); |
| 62 | ++ xmlExpandCatalog(catal, (const char *)filename, depth); |
| 63 | + xmlFree(filename); |
| 64 | + } |
| 65 | + } |
| 66 | +@@ -2695,7 +2702,7 @@ xmlLoadSGMLSuperCatalog(const char *filename) |
| 67 | + return(NULL); |
| 68 | + } |
| 69 | + |
| 70 | +- ret = xmlParseSGMLCatalog(catal, content, filename, 1); |
| 71 | ++ ret = xmlParseSGMLCatalog(catal, content, filename, 1, 0); |
| 72 | + xmlFree(content); |
| 73 | + if (ret < 0) { |
| 74 | + xmlFreeCatalog(catal); |
| 75 | +@@ -2741,7 +2748,7 @@ xmlLoadACatalog(const char *filename) |
| 76 | + xmlFree(content); |
| 77 | + return(NULL); |
| 78 | + } |
| 79 | +- ret = xmlParseSGMLCatalog(catal, content, filename, 0); |
| 80 | ++ ret = xmlParseSGMLCatalog(catal, content, filename, 0, 0); |
| 81 | + if (ret < 0) { |
| 82 | + xmlFreeCatalog(catal); |
| 83 | + xmlFree(content); |
| 84 | +@@ -2768,16 +2775,21 @@ xmlLoadACatalog(const char *filename) |
| 85 | + * Load the catalog and expand the existing catal structure. |
| 86 | + * This can be either an XML Catalog or an SGML Catalog |
| 87 | + * |
| 88 | ++ * @param depth the current depth of the catalog |
| 89 | + * Returns 0 in case of success, -1 in case of error |
| 90 | + */ |
| 91 | + static int |
| 92 | +-xmlExpandCatalog(xmlCatalogPtr catal, const char *filename) |
| 93 | ++xmlExpandCatalog(xmlCatalogPtr catal, const char *filename, int depth) |
| 94 | + { |
| 95 | + int ret; |
| 96 | + |
| 97 | + if ((catal == NULL) || (filename == NULL)) |
| 98 | + return(-1); |
| 99 | + |
| 100 | ++ /* Check recursion depth */ |
| 101 | ++ if (depth > MAX_CATAL_DEPTH) { |
| 102 | ++ return(-1); |
| 103 | ++ } |
| 104 | + |
| 105 | + if (catal->type == XML_SGML_CATALOG_TYPE) { |
| 106 | + xmlChar *content; |
| 107 | +@@ -2786,7 +2798,7 @@ xmlExpandCatalog(xmlCatalogPtr catal, const char *filename) |
| 108 | + if (content == NULL) |
| 109 | + return(-1); |
| 110 | + |
| 111 | +- ret = xmlParseSGMLCatalog(catal, content, filename, 0); |
| 112 | ++ ret = xmlParseSGMLCatalog(catal, content, filename, 0, depth + 1); |
| 113 | + if (ret < 0) { |
| 114 | + xmlFree(content); |
| 115 | + return(-1); |
| 116 | +@@ -3254,7 +3266,7 @@ xmlLoadCatalog(const char *filename) |
| 117 | + return(0); |
| 118 | + } |
| 119 | + |
| 120 | +- ret = xmlExpandCatalog(xmlDefaultCatalog, filename); |
| 121 | ++ ret = xmlExpandCatalog(xmlDefaultCatalog, filename, 0); |
| 122 | + xmlRMutexUnlock(xmlCatalogMutex); |
| 123 | + return(ret); |
| 124 | + } |
| 125 | +diff --git a/result/catalogs/recursive b/result/catalogs/recursive |
| 126 | +new file mode 100644 |
| 127 | +index 0000000..d9e80f6 |
| 128 | +--- /dev/null |
| 129 | ++++ b/result/catalogs/recursive |
| 130 | +@@ -0,0 +1 @@ |
| 131 | ++> |
| 132 | +diff --git a/test/catalogs/recursive.script b/test/catalogs/recursive.script |
| 133 | +new file mode 100644 |
| 134 | +index 0000000..e69de29 |
| 135 | +diff --git a/test/catalogs/recursive.sgml b/test/catalogs/recursive.sgml |
| 136 | +new file mode 100644 |
| 137 | +index 0000000..ac2148b |
| 138 | +--- /dev/null |
| 139 | ++++ b/test/catalogs/recursive.sgml |
| 140 | +@@ -0,0 +1 @@ |
| 141 | ++CATALOG recursive.sgml |
| 142 | +-- |
| 143 | +2.45.4 |
| 144 | + |
0 commit comments