Fix CData parsing in CFDE_XMLSyntaxParser.

xfa/fde/xml/fde_xml_imp.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "xfa/fde/xml/fde_xml_imp.h"
 
 #include <algorithm>
 
@@ skipping 1473 matching lines @@
   m_iBufferChars = 0;
 }
 uint32_t CFDE_XMLSyntaxParser::DoSyntaxParse() {
   if (m_dwStatus == FDE_XMLSYNTAXSTATUS_Error ||
       m_dwStatus == FDE_XMLSYNTAXSTATUS_EOS) {
     return m_dwStatus;
   }
   FXSYS_assert(m_pStream && m_pBuffer && m_BlockBuffer.IsInitialized());
   int32_t iStreamLength = m_pStream->GetLength();
   int32_t iPos;
-  FX_WCHAR ch;
+
   uint32_t dwStatus = FDE_XMLSYNTAXSTATUS_None;
   while (TRUE) {
     if (m_pStart >= m_pEnd) {
       if (m_bEOS || m_iCurrentPos >= iStreamLength) {
         m_dwStatus = FDE_XMLSYNTAXSTATUS_EOS;
         return m_dwStatus;
       }
       m_iParsedChars += (m_pEnd - m_pBuffer);
       m_iParsedBytes = m_iCurrentPos;
       if (m_pStream->GetPosition() != m_iCurrentPos) {
         m_pStream->Seek(FX_STREAMSEEK_Begin, m_iCurrentPos);
       }
       m_iBufferChars =
           m_pStream->ReadString(m_pBuffer, m_iXMLPlaneSize, m_bEOS);
       iPos = m_pStream->GetPosition();
       if (m_iBufferChars < 1) {
         m_iCurrentPos = iStreamLength;
         m_dwStatus = FDE_XMLSYNTAXSTATUS_EOS;
         return m_dwStatus;
       }
       m_iCurrentPos = iPos;
       m_pStart = m_pBuffer;
       m_pEnd = m_pBuffer + m_iBufferChars;
     }
+
     while (m_pStart < m_pEnd) {
-      ch = *m_pStart;
+      FX_WCHAR ch = *m_pStart;
       switch (m_dwMode) {
         case FDE_XMLSYNTAXMODE_Text:
           if (ch == L'<') {
             if (m_iDataLength > 0) {
               m_iTextDataLength = m_iDataLength;
               m_BlockBuffer.Reset();
               m_pCurrentBlock =
                   m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
               m_iEntityStart = -1;
               dwStatus = FDE_XMLSYNTAXSTATUS_Text;
@@ skipping 245 matching lines @@
               if (!m_pCurrentBlock) {
                 return FDE_XMLSYNTAXSTATUS_Error;
               }
             }
             m_pCurrentBlock[m_iIndexInBlock++] = ch;
             m_iDataLength++;
           }
           m_pStart++;
           break;
         case FDE_XMLSYNTAXMODE_SkipCommentOrDecl:
-          if (ch == '-') {
+          if (FX_wcsnicmp(m_pStart, L"--", 2) == 0) {
+            m_pStart += 2;
             m_dwMode = FDE_XMLSYNTAXMODE_SkipComment;
+          } else if (FX_wcsnicmp(m_pStart, L"[CDATA[", 7) == 0) {
+            m_pStart += 7;
+            m_dwMode = FDE_XMLSYNTAXMODE_SkipCData;
           } else {
             m_dwMode = FDE_XMLSYNTAXMODE_SkipDeclNode;
             m_SkipChar = L'>';
             m_SkipStack.Push(L'>');
           }
           break;
+        case FDE_XMLSYNTAXMODE_SkipCData: {
+          if (FX_wcsnicmp(m_pStart, L"]]>", 3) == 0) {
+            m_pStart += 3;
+            dwStatus = FDE_XMLSYNTAXSTATUS_CData;
+            m_iTextDataLength = m_iDataLength;
+            m_BlockBuffer.Reset();
+            m_pCurrentBlock = m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
+            m_dwMode = FDE_XMLSYNTAXMODE_Text;
+          } else {
+            if (m_iIndexInBlock == m_iAllocStep) {
+              m_pCurrentBlock =
+                  m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
+              if (!m_pCurrentBlock)
+                return FDE_XMLSYNTAXSTATUS_Error;
+            }
+            m_pCurrentBlock[m_iIndexInBlock++] = ch;
+            m_iDataLength++;
+            m_pStart++;
+          }
+          break;
+        }
         case FDE_XMLSYNTAXMODE_SkipDeclNode:
           if (m_SkipChar == L'\'' || m_SkipChar == L'\"') {
             m_pStart++;
-            if (ch != m_SkipChar) {
+            if (ch != m_SkipChar)
               break;
-            }
+
             m_SkipStack.Pop();
             uint32_t* pDWord = m_SkipStack.GetTopElement();
-            if (pDWord == NULL) {
+            if (!pDWord)
               m_dwMode = FDE_XMLSYNTAXMODE_Text;
-            } else {
+            else
               m_SkipChar = (FX_WCHAR)*pDWord;
-            }
           } else {
             switch (ch) {
               case L'<':
                 m_SkipChar = L'>';
                 m_SkipStack.Push(L'>');
                 break;
               case L'[':
                 m_SkipChar = L']';
                 m_SkipStack.Push(L']');
                 break;
               case L'(':
                 m_SkipChar = L')';
                 m_SkipStack.Push(L')');
                 break;
               case L'\'':
                 m_SkipChar = L'\'';
                 m_SkipStack.Push(L'\'');
                 break;
               case L'\"':
                 m_SkipChar = L'\"';
                 m_SkipStack.Push(L'\"');
                 break;
               default:
                 if (ch == m_SkipChar) {
                   m_SkipStack.Pop();
                   uint32_t* pDWord = m_SkipStack.GetTopElement();
-                  if (pDWord == NULL) {
+                  if (!pDWord) {
                     if (m_iDataLength >= 9) {
                       CFX_WideString wsHeader;
                       m_BlockBuffer.GetTextData(wsHeader, 0, 7);
-                      if (wsHeader.Equal(FX_WSTRC(L"[CDATA["))) {
-                        CFX_WideString wsTailer;
-                        m_BlockBuffer.GetTextData(wsTailer, m_iDataLength - 2,
-                                                  2);
-                        if (wsTailer.Equal(FX_WSTRC(L"]]"))) {
-                          m_BlockBuffer.DeleteTextChars(7, TRUE);
-                          m_BlockBuffer.DeleteTextChars(2, FALSE);
-                          dwStatus = FDE_XMLSYNTAXSTATUS_CData;
-                        }
-                      }
                     }
                     m_iTextDataLength = m_iDataLength;
                     m_BlockBuffer.Reset();
                     m_pCurrentBlock =
                         m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
                     m_dwMode = FDE_XMLSYNTAXMODE_Text;
                   } else {
-                    m_SkipChar = (FX_WCHAR)*pDWord;
+                    m_SkipChar = static_cast<FX_WCHAR>(*pDWord);
                   }
                 }
                 break;
             }
             if (m_SkipStack.GetSize() > 0) {
               if (m_iIndexInBlock == m_iAllocStep) {
                 m_pCurrentBlock =
                     m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
                 if (!m_pCurrentBlock) {
                   return FDE_XMLSYNTAXSTATUS_Error;
                 }
               }
               m_pCurrentBlock[m_iIndexInBlock++] = ch;
               m_iDataLength++;
             }
             m_pStart++;
           }
           break;
         case FDE_XMLSYNTAXMODE_SkipComment:
-          if (ch == L'-') {
-            if (m_iIndexInBlock == m_iAllocStep) {
-              m_pCurrentBlock =
-                  m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
-              if (!m_pCurrentBlock) {
-                return FDE_XMLSYNTAXSTATUS_Error;
-              }
-            }
-            m_pCurrentBlock[m_iIndexInBlock++] = L'-';
-            m_iDataLength++;
-          } else if (ch == L'>') {
-            if (m_iDataLength > 1) {
-              m_BlockBuffer.Reset();
-              m_pCurrentBlock =
-                  m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
-              m_dwMode = FDE_XMLSYNTAXMODE_Text;
-            }
-          } else {
-            m_BlockBuffer.Reset();
-            m_pCurrentBlock = m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
+          if (FX_wcsnicmp(m_pStart, L"-->", 3) == 0) {
+            m_pStart += 2;
+            m_dwMode = FDE_XMLSYNTAXMODE_Text;
           }
+
           m_pStart++;
           break;
         case FDE_XMLSYNTAXMODE_TargetData:
           if (FDE_IsXMLWhiteSpace(ch)) {
             if (m_iDataLength < 1) {
               m_pStart++;
               break;
             } else if (m_wQuotationMark == 0) {
               m_iTextDataLength = m_iDataLength;
               m_wQuotationMark = 0;
@@ skipping 33 matching lines @@
               }
             }
             m_pCurrentBlock[m_iIndexInBlock++] = ch;
             m_iDataLength++;
             m_pStart++;
           }
           break;
         default:
           break;
       }
-      if (dwStatus != FDE_XMLSYNTAXSTATUS_None) {
+      if (dwStatus != FDE_XMLSYNTAXSTATUS_None)
         return dwStatus;
-      }
     }
   }
   return 0;
 }
 
 CFDE_XMLSyntaxParser::~CFDE_XMLSyntaxParser() {
   if (m_pCurrentBlock) {
     m_pCurrentBlock = NULL;
   }
   FX_Free(m_pBuffer);
@@ skipping 113 matching lines @@
     m_BlockBuffer.DeleteTextChars(m_iDataLength - m_iEntityStart, FALSE);
     m_pCurrentBlock = m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
     m_iEntityStart = -1;
   } else {
     if (m_iEntityStart < 0 && ch == L'&') {
       m_iEntityStart = m_iDataLength - 1;
     }
   }
   m_pStart++;
 }