* xmlCheckEntityInAttValue: * @ctxt: parser context * @pent: entity * @depth: nesting depth * * Check an entity reference in an attribute value for validity * without expanding it. */
| 3977 | * without expanding it. |
| 3978 | */ |
| 3979 | static void |
| 3980 | xmlCheckEntityInAttValue(xmlParserCtxtPtr ctxt, xmlEntityPtr pent, int depth) { |
| 3981 | int maxDepth = (ctxt->options & XML_PARSE_HUGE) ? 40 : 20; |
| 3982 | const xmlChar *str; |
| 3983 | unsigned long expandedSize = pent->length; |
| 3984 | int c, flags; |
| 3985 | |
| 3986 | depth += 1; |
| 3987 | if (depth > maxDepth) { |
| 3988 | xmlFatalErrMsg(ctxt, XML_ERR_RESOURCE_LIMIT, |
| 3989 | "Maximum entity nesting depth exceeded"); |
| 3990 | return; |
| 3991 | } |
| 3992 | |
| 3993 | if (pent->flags & XML_ENT_EXPANDING) { |
| 3994 | xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); |
| 3995 | xmlHaltParser(ctxt); |
| 3996 | return; |
| 3997 | } |
| 3998 | |
| 3999 | /* |
| 4000 | * If we're parsing a default attribute value in DTD content, |
| 4001 | * the entity might reference other entities which weren't |
| 4002 | * defined yet, so the check isn't reliable. |
| 4003 | */ |
| 4004 | if (ctxt->inSubset == 0) |
| 4005 | flags = XML_ENT_CHECKED | XML_ENT_VALIDATED; |
| 4006 | else |
| 4007 | flags = XML_ENT_VALIDATED; |
| 4008 | |
| 4009 | str = pent->content; |
| 4010 | if (str == NULL) |
| 4011 | goto done; |
| 4012 | |
| 4013 | /* |
| 4014 | * Note that entity values are already validated. We only check |
| 4015 | * for illegal less-than signs and compute the expanded size |
| 4016 | * of the entity. No special handling for multi-byte characters |
| 4017 | * is needed. |
| 4018 | */ |
| 4019 | while (!PARSER_STOPPED(ctxt)) { |
| 4020 | c = *str; |
| 4021 | |
| 4022 | if (c != '&') { |
| 4023 | if (c == 0) |
| 4024 | break; |
| 4025 | |
| 4026 | if (c == '<') |
| 4027 | xmlFatalErrMsgStr(ctxt, XML_ERR_LT_IN_ATTRIBUTE, |
| 4028 | "'<' in entity '%s' is not allowed in attributes " |
| 4029 | "values\n", pent->name); |
| 4030 | |
| 4031 | str += 1; |
| 4032 | } else if (str[1] == '#') { |
| 4033 | int val; |
| 4034 | |
| 4035 | val = xmlParseStringCharRef(ctxt, &str); |
| 4036 | if (val == 0) { |
no test coverage detected