From e1e649dc8daa80b83d168a16b7872db96ac8cdfd Mon Sep 17 00:00:00 2001
From: "B. Petersen" <r10s@b44t.com>
Date: Fri, 29 Jun 2018 15:16:33 +0200
Subject: [PATCH] avoid a deadlock in the saxparser

---
 cmdline/stress.c   | 11 +++++++++++
 src/dc_saxparser.c |  7 ++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/cmdline/stress.c b/cmdline/stress.c
index 9bf400d4..cf73299b 100644
--- a/cmdline/stress.c
+++ b/cmdline/stress.c
@@ -36,6 +36,7 @@ $ valgrind --leak-check=full --tool=memcheck ./deltachat-core <db>
 #include "../src/dc_apeerstate.h"
 #include "../src/dc_aheader.h"
 #include "../src/dc_keyring.h"
+#include "../src/dc_saxparser.h"
 
 
 /* some data used for testing
@@ -174,6 +175,16 @@ static const char* s_em_setupfile =
 
 void stress_functions(dc_context_t* context)
 {
+	/* test dc_saxparser_t
+	 **************************************************************************/
+
+	{
+		dc_saxparser_t saxparser;
+		dc_saxparser_init(&saxparser, NULL);
+		dc_saxparser_parse(&saxparser, "<tag attr=val="); // should not crash or cause a deadlock
+		dc_saxparser_parse(&saxparser, "<tag attr=\"val\"="); // should not crash or cause a deadlock
+	}
+
 	/* test dc_simplify_t and dc_saxparser_t (indirectly used by dc_simplify_t)
 	 **************************************************************************/
 
diff --git a/src/dc_saxparser.c b/src/dc_saxparser.c
index 31429452..a1248a6e 100644
--- a/src/dc_saxparser.c
+++ b/src/dc_saxparser.c
@@ -438,9 +438,13 @@ void dc_saxparser_parse(dc_saxparser_t* saxparser, const char* buf_start__)
 						/* scan for attributes */
 						int attr_index = 0;
 						while( isspace(*p) ) { p++; } /* forward to first attribute name beginning */
-						for( ; *p && *p != '/' && *p != '>'; attr_index += 2 )
+						while (*p && *p!='/' && *p!='>')
 						{
 							char *beg_attr_name = p, *beg_attr_value = NULL, *beg_attr_value_new = NULL;
+							if ('='==*beg_attr_name) {
+								p++; // otherwise eg. `"val"=` causes a deadlock as the second `=` is no exit condition and is not skipped by strcspn()
+								continue;
+							}
 
 							p += strcspn(p, XML_WS "=/>"); /* get end of attribute name */
 							if( p != beg_attr_name )
@@ -506,6 +510,7 @@ void dc_saxparser_parse(dc_saxparser_t* saxparser, const char* buf_start__)
 									attr[attr_index+1]       = beg_attr_value_new;
 									attr[attr_index+2]       = NULL; /* null-terminate list */
 									free_attr[attr_index>>1] = free_bits;
+									attr_index += 2;
 								}
 							}