yetangitu/deltachat-core
1
0
Fork 0
mirror of https://github.com/deltachat/deltachat-core.git synced 2025-10-06 03:50:08 +02:00
Code Issues Releases Wiki Activity

avoid a deadlock in the saxparser

Browse source
This commit is contained in:
B. Petersen 2018-06-29 15:16:33 +02:00
parent 64b13391d6
commit e1e649dc8d
2 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
cmdline/stress.c
View file

@ -36,6 +36,7 @@ $ valgrind --leak-check=full --tool=memcheck ./deltachat-core <db>
#include "../src/dc_apeerstate.h" #include "../src/dc_apeerstate.h"
#include "../src/dc_aheader.h" #include "../src/dc_aheader.h"
#include "../src/dc_keyring.h" #include "../src/dc_keyring.h"
#include "../src/dc_saxparser.h"
/* some data used for testing /* some data used for testing
@ -174,6 +175,16 @@ static const char* s_em_setupfile =
void stress_functions(dc_context_t* context) void stress_functions(dc_context_t* context)
{ {
/* test dc_saxparser_t
**************************************************************************/
{
dc_saxparser_t saxparser;
dc_saxparser_init(&saxparser, NULL);
dc_saxparser_parse(&saxparser, "<tag attr=val="); // should not crash or cause a deadlock
dc_saxparser_parse(&saxparser, "<tag attr=\"val\"="); // should not crash or cause a deadlock
}
/* test dc_simplify_t and dc_saxparser_t (indirectly used by dc_simplify_t) /* test dc_simplify_t and dc_saxparser_t (indirectly used by dc_simplify_t)
**************************************************************************/ **************************************************************************/

7
src/dc_saxparser.c
View file

@ -438,9 +438,13 @@ void dc_saxparser_parse(dc_saxparser_t* saxparser, const char* buf_start__)
/* scan for attributes */ /* scan for attributes */
int attr_index = 0; int attr_index = 0;
while( isspace(*p) ) { p++; } /* forward to first attribute name beginning */ while( isspace(*p) ) { p++; } /* forward to first attribute name beginning */
for( ; *p && *p != '/' && *p != '>'; attr_index += 2 ) while (*p && *p!='/' && *p!='>')
{ {
char *beg_attr_name = p, *beg_attr_value = NULL, *beg_attr_value_new = NULL; char *beg_attr_name = p, *beg_attr_value = NULL, *beg_attr_value_new = NULL;
if ('='==*beg_attr_name) {
p++; // otherwise eg. `"val"=` causes a deadlock as the second `=` is no exit condition and is not skipped by strcspn()
continue;
}
p += strcspn(p, XML_WS "=/>"); /* get end of attribute name */ p += strcspn(p, XML_WS "=/>"); /* get end of attribute name */
if( p != beg_attr_name ) if( p != beg_attr_name )
@ -506,6 +510,7 @@ void dc_saxparser_parse(dc_saxparser_t* saxparser, const char* buf_start__)
attr[attr_index+1] = beg_attr_value_new; attr[attr_index+1] = beg_attr_value_new;
attr[attr_index+2] = NULL; /* null-terminate list */ attr[attr_index+2] = NULL; /* null-terminate list */
free_attr[attr_index>>1] = free_bits; free_attr[attr_index>>1] = free_bits;
attr_index += 2;
} }
} }