* xmlXIncludeExpandNode: * @ctxt: an XInclude context * @node: an XInclude node * * If the XInclude node wasn't processed yet, create a new RefPtr, * add it to ctxt->incTab and load the included items. * * Returns the new or existing xmlXIncludeRefPtr, or NULL in case of error. */
| 1816 | * Returns the new or existing xmlXIncludeRefPtr, or NULL in case of error. |
| 1817 | */ |
| 1818 | static xmlXIncludeRefPtr |
| 1819 | xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) { |
| 1820 | xmlXIncludeRefPtr ref; |
| 1821 | int i; |
| 1822 | |
| 1823 | if (ctxt->fatalErr) |
| 1824 | return(NULL); |
| 1825 | if (ctxt->depth >= XINCLUDE_MAX_DEPTH) { |
| 1826 | xmlXIncludeErr(ctxt, node, XML_XINCLUDE_RECURSION, |
| 1827 | "maximum recursion depth exceeded\n", NULL); |
| 1828 | ctxt->fatalErr = 1; |
| 1829 | return(NULL); |
| 1830 | } |
| 1831 | |
| 1832 | #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION |
| 1833 | /* |
| 1834 | * The XInclude engine offers no protection against exponential |
| 1835 | * expansion attacks similar to "billion laughs". Avoid timeouts by |
| 1836 | * limiting the total number of replacements when fuzzing. |
| 1837 | * |
| 1838 | * Unfortuately, a single XInclude can already result in quadratic |
| 1839 | * behavior: |
| 1840 | * |
| 1841 | * <doc xmlns:xi="http://www.w3.org/2001/XInclude"> |
| 1842 | * <xi:include xpointer="xpointer(//e)"/> |
| 1843 | * <e> |
| 1844 | * <e> |
| 1845 | * <e> |
| 1846 | * <!-- more nested elements --> |
| 1847 | * </e> |
| 1848 | * </e> |
| 1849 | * </e> |
| 1850 | * </doc> |
| 1851 | */ |
| 1852 | if (ctxt->incTotal >= 20) |
| 1853 | return(NULL); |
| 1854 | ctxt->incTotal++; |
| 1855 | #endif |
| 1856 | |
| 1857 | for (i = 0; i < ctxt->incNr; i++) { |
| 1858 | if (ctxt->incTab[i]->elem == node) { |
| 1859 | if (ctxt->incTab[i]->expanding) { |
| 1860 | xmlXIncludeErr(ctxt, node, XML_XINCLUDE_RECURSION, |
| 1861 | "inclusion loop detected\n", NULL); |
| 1862 | return(NULL); |
| 1863 | } |
| 1864 | return(ctxt->incTab[i]); |
| 1865 | } |
| 1866 | } |
| 1867 | |
| 1868 | ref = xmlXIncludeAddNode(ctxt, node); |
| 1869 | if (ref == NULL) |
| 1870 | return(NULL); |
| 1871 | ref->expanding = 1; |
| 1872 | ctxt->depth++; |
| 1873 | xmlXIncludeLoadNode(ctxt, ref); |
| 1874 | ctxt->depth--; |
| 1875 | ref->expanding = 0; |
no test coverage detected