Commit 82465776 authored by Nick Wellnhofer's avatar Nick Wellnhofer
Browse files

Transfer XPath limits to XPtr context

Expressions like document('doc.xml#xpointer(evil_expr)') ignored the
XPath limits.
parent 9ae2f94d
Pipeline #205101 passed with stage
in 4 minutes and 56 seconds
......@@ -178,10 +178,22 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI)
goto out_fragment;
}
#if LIBXML_VERSION >= 20911 || \
defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
xptrctxt->opLimit = ctxt->context->opLimit;
xptrctxt->opCount = ctxt->context->opCount;
xptrctxt->maxDepth = ctxt->context->maxDepth - ctxt->context->depth;
resObj = xmlXPtrEval(fragment, xptrctxt);
ctxt->context->opCount = xptrctxt->opCount;
#else
resObj = xmlXPtrEval(fragment, xptrctxt);
xmlXPathFreeContext(xptrctxt);
#endif
xmlXPathFreeContext(xptrctxt);
#endif /* LIBXML_XPTR_ENABLED */
if (resObj == NULL)
goto out_fragment;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment