Commit 8ee72e49 authored by Nick Wellnhofer's avatar Nick Wellnhofer

Detect infinite recursion when evaluating function arguments

This fixes a regression introduced when consolidating recursion checks
in commit 1c8e0e55. When a function is called recursively during
evaluation of its arguments, the recursion check in
xsltApplySequenceConstructor is never reached. Readd recursion check
in exsltFuncFunctionFunction but use the template depth counter.

Fixes bug #777293:

https://bugzilla.gnome.org/show_bug.cgi?id=777293
parent 96c9c644
......@@ -331,6 +331,21 @@ exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
return;
}
/*
* When a function is called recursively during evaluation of its
* arguments, the recursion check in xsltApplySequenceConstructor
* isn't reached.
*/
if (tctxt->depth >= tctxt->maxTemplateDepth) {
xsltTransformError(tctxt, NULL, NULL,
"exsltFuncFunctionFunction: Potentially infinite recursion "
"detected in function {%s}%s.\n",
ctxt->context->functionURI, ctxt->context->function);
tctxt->state = XSLT_STATE_STOPPED;
return;
}
tctxt->depth++;
/*
* We have a problem with the evaluation of function parameters.
* The original library code did not evaluate XPath expressions until
......@@ -413,7 +428,7 @@ exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
xsltFreeStackElemList(params);
if (data->error != 0)
return;
goto error;
if (data->result != NULL) {
ret = data->result;
......@@ -441,10 +456,13 @@ exsltFuncFunctionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
"executing a function\n",
ctxt->context->functionURI, ctxt->context->function);
xmlFreeNode(fake);
return;
goto error;
}
xmlFreeNode(fake);
valuePush(ctxt, ret);
error:
tctxt->depth--;
}
......
runtime error: file ./bug-201.xsl line 13 element copy-of
exsltFuncFunctionFunction: Potentially infinite recursion detected in function {test}func.
xmlXPathCompiledEval: evaluation failed
runtime error: file ./bug-201.xsl line 8 element param
Failed to evaluate the expression of variable 'var'.
no result for ./../docs/bug-201.xml
<xsl:stylesheet
version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:func="http://exslt.org/functions"
xmlns:test="test"
extension-element-prefixes="func">
<func:function name="test:func">
<xsl:param name="var" select="test:func()"/>
<func:result select="$var"/>
</func:function>
<xsl:template match="/">
<xsl:copy-of select="test:func()"/>
</xsl:template>
</xsl:stylesheet>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment