Make the XML entity recursion check more precise.

third_party/libxml/src/include/libxml/entities.h

 /*
  * Summary: interface for the XML entities handling
  * Description: this module provides some of the entity API needed
  *              for the parser and applications.
  *
  * Copy: See Copyright for the status of this software.
  *
  * Author: Daniel Veillard
  */
 
@@ skipping 17 matching lines @@
     XML_INTERNAL_PARAMETER_ENTITY = 4,
     XML_EXTERNAL_PARAMETER_ENTITY = 5,
     XML_INTERNAL_PREDEFINED_ENTITY = 6
 } xmlEntityType;
 
 /*
  * An unit of storage for an entity, contains the string, the value
  * and the linkind data needed for the linking in the hash table.
  */
 
+typedef enum {
+  XML_ENTITY_NOT_BEING_CHECKED,
+  XML_ENTITY_BEING_CHECKED              /* entity check is in progress */
+} xmlEntityRecursionGuard;
+
 struct _xmlEntity {
-    void           *_private;           /* application data */
+    void               *_private;       /* application data */
     xmlElementType          type;       /* XML_ENTITY_DECL, must be second ! */
     const xmlChar          *name;       /* Entity name */
     struct _xmlNode    *children;       /* First child link */
     struct _xmlNode        *last;       /* Last child link */
     struct _xmlDtd       *parent;       /* -> DTD */
     struct _xmlNode        *next;       /* next sibling link  */
     struct _xmlNode        *prev;       /* previous sibling link  */
     struct _xmlDoc          *doc;       /* the containing document */
 
     xmlChar                *orig;       /* content without ref substitution */
     xmlChar             *content;       /* content or ndata if unparsed */
     int                   length;       /* the content length */
     xmlEntityType          etype;       /* The entity type */
     const xmlChar    *ExternalID;       /* External identifier for PUBLIC */
     const xmlChar      *SystemID;       /* URI for a SYSTEM or PUBLIC Entity */
 
     struct _xmlEntity     *nexte;       /* unused */
     const xmlChar           *URI;       /* the full URI as computed */
     int                    owner;       /* does the entity own the childrens */
-    int                  checked;       /* was the entity content checked */
-                                        /* this is also used to count entities
-                                         * references done from that entity
-                                         * and if it contains '<' */
+    int                  checked;       /* was the entity content checked and */
+                                        /* l.o. bit: replacement contains '<' */
+                                        /* remaining bits: one plus count of */
+                                        /* entity references from this entity */
+    xmlEntityRecursionGuard guard;

[ddkilzer, 2016/11/30 23:30:22]

FYI, changing struct _xmlEntity (which is vended as typedef 'xmlEntity' in
libxml2 public headers) will cause binary compatibility issues for platforms
that ship libxml2 as a public library.

Obviously this isn't an issue for Chrome if it uses its own copy of libxml2
internally, but it means that this fix can't be upstreamed as-is, and if this
bug is fixed upstream, it will use a different approach.

 };
 
 /*
  * All entities are stored in an hash table.
  * There is 2 separate hash tables for global and parameter entities.
  */
 
 typedef struct _xmlHashTable xmlEntitiesTable;
 typedef xmlEntitiesTable *xmlEntitiesTablePtr;
 
@@ skipping 69 matching lines @@
 XMLPUBFUN void XMLCALL
                         xmlCleanupPredefinedEntities(void);
 #endif /* LIBXML_LEGACY_ENABLED */
 
 
 #ifdef __cplusplus
 }
 #endif
 
 # endif /* __XML_ENTITIES_H__ */