Make the XML entity recursion check more precise.

third_party/libxml/src/parser.c

 /*
  * parser.c : an XML 1.0 parser, namespaces and validity support are mostly
  *            implemented on top of the SAX interfaces
  *
  * References:
  *   The XML specification:
  *     http://www.w3.org/TR/REC-xml
  *   Original 1.0 version:
  *     http://www.w3.org/TR/1998/REC-xml-19980210
  *   XML second edition working draft
@@ skipping 119 matching lines @@
 
     if ((ctxt == NULL) || (ctxt->options & XML_PARSE_HUGE))
         return (0);
     if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
         return (1);
 
     /*
      * This may look absurd but is needed to detect
      * entities problems
      */
+    if ((ent != NULL) && (ent->guard == XML_ENTITY_BEING_CHECKED)) {
+        xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+        return (1);
+    }
     if ((ent != NULL) && (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
         (ent->content != NULL) && (ent->checked == 0) &&
         (ctxt->errNo != XML_ERR_ENTITY_LOOP)) {
         unsigned long oldnbent = ctxt->nbentities;
         xmlChar *rep;
 
+        ent->guard = XML_ENTITY_BEING_CHECKED;
         ent->checked = 1;
 
         ++ctxt->depth;
         rep = xmlStringDecodeEntities(ctxt, ent->content,
                                   XML_SUBSTITUTE_REF, 0, 0, 0);
         --ctxt->depth;
+        ent->guard = XML_ENTITY_NOT_BEING_CHECKED;
         if (ctxt->errNo == XML_ERR_ENTITY_LOOP) {
             ent->content[0] = 0;
         }
 
         ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
         if (rep != NULL) {
             if (xmlStrchr(rep, '<'))
                 ent->checked |= 1;
             xmlFree(rep);
             rep = NULL;
@@ skipping 7160 matching lines @@
             user_data = NULL;
         else
             user_data = ctxt->userData;
 
         /*
          * Check that this entity is well formed
          * 4.3.2: An internal general parsed entity is well-formed
          * if its replacement text matches the production labeled
          * content.
          */
-        if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
-            ctxt->depth++;
-            ret = xmlParseBalancedChunkMemoryInternal(ctxt, ent->content,
-                                                      user_data, &list);
-            ctxt->depth--;
-
-        } else if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
-            ctxt->depth++;
-            ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt, ctxt->sax,
-                                           user_data, ctxt->depth, ent->URI,
-                                           ent->ExternalID, &list);
-            ctxt->depth--;
-        } else {
-            ret = XML_ERR_ENTITY_PE_INTERNAL;
-            xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
-                         "invalid entity type found\n", NULL);
-        }
+        if (ent->guard == XML_ENTITY_BEING_CHECKED) {
+            ret = XML_ERR_ENTITY_LOOP;
+        } else {
+            ent->guard = XML_ENTITY_BEING_CHECKED;
+            if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
+                ctxt->depth++;
+                ret = xmlParseBalancedChunkMemoryInternal(ctxt, ent->content,
+                                                          user_data, &list);
+                ctxt->depth--;
+            } else if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
+                ctxt->depth++;
+                ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt, ctxt->sax,
+                                               user_data, ctxt->depth, ent->URI,
+                                               ent->ExternalID, &list);
+                ctxt->depth--;
+            } else {
+                ret = XML_ERR_ENTITY_PE_INTERNAL;
+                xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
+                             "invalid entity type found\n", NULL);
+            }
+            ent->guard = XML_ENTITY_NOT_BEING_CHECKED;
+        }
 
         /*
          * Store the number of entities needing parsing for this entity
          * content and do checkings
          */
         ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
         if ((ent->content != NULL) && (xmlStrchr(ent->content, '<')))
             ent->checked |= 1;
         if (ret == XML_ERR_ENTITY_LOOP) {
             xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
@@ skipping 82 matching lines @@
             /*
              * This is a bit hackish but this seems the best
              * way to make sure both SAX and DOM entity support
              * behaves okay.
              */
             if (ctxt->userData == ctxt)
                 user_data = NULL;
             else
                 user_data = ctxt->userData;
 
-            if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
-                ctxt->depth++;
-                ret = xmlParseBalancedChunkMemoryInternal(ctxt,
-                                   ent->content, user_data, NULL);
-                ctxt->depth--;
-            } else if (ent->etype ==
-                       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
-                ctxt->depth++;
-                ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt,
-                           ctxt->sax, user_data, ctxt->depth,
-                           ent->URI, ent->ExternalID, NULL);
-                ctxt->depth--;
-            } else {
-                ret = XML_ERR_ENTITY_PE_INTERNAL;
-                xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
-                             "invalid entity type found\n", NULL);
-            }
+            if (ent->guard == XML_ENTITY_BEING_CHECKED) {
+                ret = XML_ERR_ENTITY_LOOP;
+            } else {
+                ent->guard = XML_ENTITY_BEING_CHECKED;
+                if (ent->etype == XML_INTERNAL_GENERAL_ENTITY) {
+                    ctxt->depth++;
+                    ret = xmlParseBalancedChunkMemoryInternal(ctxt,
+                                       ent->content, user_data, NULL);
+                    ctxt->depth--;
+                } else if (ent->etype ==
+                           XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
+                    ctxt->depth++;
+                    ret = xmlParseExternalEntityPrivate(ctxt->myDoc, ctxt,
+                               ctxt->sax, user_data, ctxt->depth,
+                               ent->URI, ent->ExternalID, NULL);
+                    ctxt->depth--;
+                } else {
+                    ret = XML_ERR_ENTITY_PE_INTERNAL;
+                    xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
+                                 "invalid entity type found\n", NULL);
+                }
+                ent->guard = XML_ENTITY_NOT_BEING_CHECKED;
+            }
             if (ret == XML_ERR_ENTITY_LOOP) {
                 xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
                 return;
             }
         }
         if ((ctxt->sax != NULL) && (ctxt->sax->reference != NULL) &&
             (ctxt->replaceEntities == 0) && (!ctxt->disableSAX)) {
             /*
              * Entity reference callback comes second, it's somewhat
              * superfluous but a compatibility to historical behaviour
@@ skipping 8330 matching lines @@
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 #define bottom_parser
 #include "elfgcchack.h"