Fix CData parsing in CFDE_XMLSyntaxParser.

xfa/fde/xml/fde_xml_imp.cpp

Index: xfa/fde/xml/fde_xml_imp.cpp
diff --git a/xfa/fde/xml/fde_xml_imp.cpp b/xfa/fde/xml/fde_xml_imp.cpp
index ef5a7e4ee3aebd789efc7bbf70fa3466b37e66f3..fdd69e5f9f48efd3deb3ee37e6c452955a0dca38 100644
--- a/xfa/fde/xml/fde_xml_imp.cpp
+++ b/xfa/fde/xml/fde_xml_imp.cpp
@@ -1785,12 +1785,48 @@ uint32_t CFDE_XMLSyntaxParser::DoSyntaxParse() {
         case FDE_XMLSYNTAXMODE_SkipCommentOrDecl:
           if (ch == '-') {

[Tom Sepez, 2016/03/30 17:04:41]

This is wrong, too, needs -- to enter comment, right?

[dsinclair, 2016/03/30 19:18:12]

Done.

             m_dwMode = FDE_XMLSYNTAXMODE_SkipComment;
+          } else if (ch == '[') {

[Tom Sepez, 2016/03/30 17:04:41]

Maybe look for the whole "[CDATA[" here, otherwise, its skipdelcnode?

[dsinclair, 2016/03/30 19:18:11]

Done.

+            m_dwMode = FDE_XMLSYNTAXMODE_SkipCData;
           } else {
             m_dwMode = FDE_XMLSYNTAXMODE_SkipDeclNode;
             m_SkipChar = L'>';
             m_SkipStack.Push(L'>');
           }
           break;
+        case FDE_XMLSYNTAXMODE_SkipCData: {
+          if (ch == ']' && (m_pStart + 2 < m_pEnd) && *(m_pStart + 1) == ']' &&

[Tom Sepez, 2016/03/30 17:04:41]

maybe its easier to just look for "]]>" via string comparision.

[dsinclair, 2016/03/30 19:18:11]

Done.

+              *(m_pStart + 2) == '>') {
+            m_pStart += 3;
+
+            if (m_iDataLength >= 7) {
+              CFX_WideString wsHeader;
+              m_BlockBuffer.GetTextData(wsHeader, 0, 7);
+
+              if (wsHeader.Equal(FX_WSTRC(L"[CDATA["))) {
+                m_BlockBuffer.DeleteTextChars(7, TRUE);
+                dwStatus = FDE_XMLSYNTAXSTATUS_CData;
+              }
+            }
+            m_iTextDataLength = m_iDataLength;
+            m_BlockBuffer.Reset();
+            m_pCurrentBlock = m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
+            m_dwMode = FDE_XMLSYNTAXMODE_Text;
+          } else {
+            if (m_iIndexInBlock == m_iAllocStep) {
+              m_pCurrentBlock =
+                  m_BlockBuffer.GetAvailableBlock(m_iIndexInBlock);
+              if (!m_pCurrentBlock) {
+                return FDE_XMLSYNTAXSTATUS_Error;
+              }
+            }
+            m_pCurrentBlock[m_iIndexInBlock++] = ch;
+            m_iDataLength++;
+            m_pStart++;
+          }
+
+          break;
+        }
+
         case FDE_XMLSYNTAXMODE_SkipDeclNode:
           if (m_SkipChar == L'\'' || m_SkipChar == L'\"') {
             m_pStart++;