Roll libxml to 2.9.3

third_party/libxml/src/buf.c

 /*
  * buf.c: memory buffers for libxml2
  *
  * new buffer structures and entry points to simplify the maintainance
  * of libxml2 and ensure we keep good control over memory allocations
  * and stay 64 bits clean.
  * The new entry point use the xmlBufPtr opaque structure and
  * xmlBuf...() counterparts to the old xmlBuf...() functions
  *
  * See Copyright for the status of this software.
  *
  * daniel@veillard.com
  */
 
 #define IN_LIBXML
 #include "libxml.h"
 
 #include <string.h> /* for memset() only ! */
 #include <limits.h>
 #ifdef HAVE_CTYPE_H
 #include <ctype.h>
 #endif
 #ifdef HAVE_STDLIB_H
 #include <stdlib.h>
 #endif
 
 #include <libxml/tree.h>
 #include <libxml/globals.h>
 #include <libxml/tree.h>
+#include <libxml/parserInternals.h> /* for XML_MAX_TEXT_LENGTH */
 #include "buf.h"
 
 #define WITH_BUFFER_COMPAT
 
 /**
  * xmlBuf:
  *
  * A buffer structure. The base of the structure is somehow compatible
  * with struct _xmlBuffer to limit risks on application which accessed
  * directly the input->buf->buffer structures.
@@ skipping 252 matching lines @@
                 "xmlBufSetAllocationScheme: buf == NULL or in error\n");
 #endif
         return(-1);
     }
     if ((buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) ||
         (buf->alloc == XML_BUFFER_ALLOC_IO))
         return(-1);
     if ((scheme == XML_BUFFER_ALLOC_DOUBLEIT) ||
         (scheme == XML_BUFFER_ALLOC_EXACT) ||
         (scheme == XML_BUFFER_ALLOC_HYBRID) ||
-        (scheme == XML_BUFFER_ALLOC_IMMUTABLE)) {
+        (scheme == XML_BUFFER_ALLOC_IMMUTABLE) ||
+        (scheme == XML_BUFFER_ALLOC_BOUNDED)) {
         buf->alloc = scheme;
         if (buf->buffer)
             buf->buffer->alloc = scheme;
         return(0);
     }
     /*
      * Switching a buffer ALLOC_IO has the side effect of initializing
      * the contentIO field with the current content
      */
     if (scheme == XML_BUFFER_ALLOC_IO) {
@@ skipping 138 matching lines @@
      */
 #if 1
     if (buf->size > (size_t) len)
         size = buf->size * 2;
     else
         size = buf->use + len + 100;
 #else
     size = buf->use + len + 100;
 #endif
 
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+        /*
+         * Used to provide parsing limits
+         */
+        if ((buf->use + len >= XML_MAX_TEXT_LENGTH) ||
+            (buf->size >= XML_MAX_TEXT_LENGTH)) {
+            xmlBufMemoryError(buf, "buffer error: text too long\n");
+            return(0);
+        }
+        if (size >= XML_MAX_TEXT_LENGTH)
+            size = XML_MAX_TEXT_LENGTH;
+    }
     if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) {
         size_t start_buf = buf->content - buf->contentIO;
 
         newbuf = (xmlChar *) xmlRealloc(buf->contentIO, start_buf + size);
         if (newbuf == NULL) {
             xmlBufMemoryError(buf, "growing buffer");
             return(0);
         }
         buf->contentIO = newbuf;
         buf->content = newbuf + start_buf;
@@ skipping 261 matching lines @@
 {
     unsigned int newSize;
     xmlChar* rebuf = NULL;
     size_t start_buf;
 
     if ((buf == NULL) || (buf->error))
         return(0);
     CHECK_COMPAT(buf)
 
     if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0);
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+        /*
+         * Used to provide parsing limits
+         */
+        if (size >= XML_MAX_TEXT_LENGTH) {
+            xmlBufMemoryError(buf, "buffer error: text too long\n");
+            return(0);
+        }
+    }
 
     /* Don't resize if we don't have to */
     if (size < buf->size)
         return 1;
 
     /* figure out new size */
     switch (buf->alloc){
         case XML_BUFFER_ALLOC_IO:
         case XML_BUFFER_ALLOC_DOUBLEIT:
             /*take care of empty case*/
@@ skipping 108 matching lines @@
     if (len == 0) return 0;
 
     if (len < 0)
         len = xmlStrlen(str);
 
     if (len < 0) return -1;
     if (len == 0) return 0;
 
     needSize = buf->use + len + 2;
     if (needSize > buf->size){
+        if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+            /*
+             * Used to provide parsing limits
+             */
+            if (needSize >= XML_MAX_TEXT_LENGTH) {
+                xmlBufMemoryError(buf, "buffer error: text too long\n");
+                return(-1);
+            }
+        }
         if (!xmlBufResize(buf, needSize)){
             xmlBufMemoryError(buf, "growing buffer");
             return XML_ERR_NO_MEMORY;
         }
     }
 
     memmove(&buf->content[buf->use], str, len*sizeof(xmlChar));
     buf->use += len;
     buf->content[buf->use] = 0;
     UPDATE_COMPAT(buf)
@@ skipping 51 matching lines @@
             buf->content -= len;
             memmove(&buf->content[0], str, len);
             buf->use += len;
             buf->size += len;
             UPDATE_COMPAT(buf)
             return(0);
         }
     }
     needSize = buf->use + len + 2;
     if (needSize > buf->size){
+        if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+            /*
+             * Used to provide parsing limits
+             */
+            if (needSize >= XML_MAX_TEXT_LENGTH) {
+                xmlBufMemoryError(buf, "buffer error: text too long\n");
+                return(-1);
+            }
+        }
         if (!xmlBufResize(buf, needSize)){
             xmlBufMemoryError(buf, "growing buffer");
             return XML_ERR_NO_MEMORY;
         }
     }
 
     memmove(&buf->content[len], &buf->content[0], buf->use);
     memmove(&buf->content[0], str, len);
     buf->use += len;
     buf->content[buf->use] = 0;
@@ skipping 344 matching lines @@
         return(-1);
     CHECK_COMPAT(buf)
     input->base = &buf->content[base];
     input->cur = input->base + cur;
     input->end = &buf->content[buf->use];
     return(0);
 }
 
 #define bottom_buf
 #include "elfgcchack.h"