libxslt update

third_party/libxslt/libexslt/functions.c

 #define IN_LIBEXSLT
 #include "libexslt/libexslt.h"
 
 #if defined(WIN32) && !defined (__CYGWIN__) && (!__MINGW32__)
 #include <win32config.h>
 #else
 #include "config.h"
 #endif
 
 #include <string.h>
@@ skipping 39 matching lines @@
 typedef struct _exsltFuncImportRegData exsltFuncImportRegData;
 struct _exsltFuncImportRegData {
     xsltTransformContextPtr ctxt;
     xmlHashTablePtr hash;
 };
 
 static void exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt,
                                        int nargs);
 static exsltFuncFunctionData *exsltFuncNewFunctionData(void);
 
+#define MAX_FUNC_RECURSION 1000
+
 /*static const xmlChar *exsltResultDataID = (const xmlChar *) "EXSLT Result";*/
 
 /**
  * exsltFuncRegisterFunc:
  * @func:  the #exsltFuncFunctionData for the function
  * @ctxt:  an XSLT transformation context
  * @URI:  the function namespace URI
  * @name: the function name
  *
  * Registers a function declared by a func:function element
@@ skipping 244 matching lines @@
         paramNode = func->content->prev;
     }
     else
         paramNode = NULL;
     if ((paramNode == NULL) && (func->nargs != 0)) {
         xsltGenericError(xsltGenericErrorContext,
                          "exsltFuncFunctionFunction: nargs != 0 and "
                          "param == NULL\n");
         return;
     }
+    if (tctxt->funcLevel > MAX_FUNC_RECURSION) {
+        xsltGenericError(xsltGenericErrorContext,
+                         "{%s}%s: detected a recursion\n",
+                         ctxt->context->functionURI, ctxt->context->function);
+        ctxt->error = XPATH_MEMORY_ERROR;
+        return;
+    }
+    tctxt->funcLevel++;
+
     /*
      * We have a problem with the evaluation of function parameters.
      * The original library code did not evaluate XPath expressions until
      * the last moment.  After version 1.1.17 of the libxslt, the logic
      * of other parts of the library was changed, and the evaluation of
      * XPath expressions within parameters now takes place as soon as the
      * parameter is parsed/evaluated (xsltParseStylesheetCallerParam).
      * This means that the parameters need to be evaluated in lexical
      * order (since a variable is "in scope" as soon as it is declared).
      * However, on entry to this routine, the values (from the caller) are
@@ skipping 96 matching lines @@
     xmlFreeNode(fake);
     valuePush(ctxt, ret);
 
 error:
     /*
     * IMPORTANT: This enables previously tree fragments marked as
     * being results of a function, to be garbage-collected after
     * the calling process exits.
     */
     xsltExtensionInstructionResultFinalize(tctxt);
+    tctxt->funcLevel--;
 }
 
 
 static void
 exsltFuncFunctionComp (xsltStylesheetPtr style, xmlNodePtr inst) {
     xmlChar *name, *prefix;
     xmlNsPtr ns;
     xmlHashTablePtr data;
     exsltFuncFunctionData *func;
 
@@ skipping 303 matching lines @@
                        (xsltStyleExtShutdownFunction) exsltFuncStyleShutdown);
 
     xsltRegisterExtModuleTopLevel ((const xmlChar *) "function",
                                    EXSLT_FUNCTIONS_NAMESPACE,
                                    exsltFuncFunctionComp);
     xsltRegisterExtModuleElement ((const xmlChar *) "result",
                           EXSLT_FUNCTIONS_NAMESPACE,
                           (xsltPreComputeFunction)exsltFuncResultComp,
                           (xsltTransformFunction) exsltFuncResultElem);
 }