Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit4310dfa

Browse files
committed
Replace usages of xmlXPathCompile() with xmlXPathCtxtCompile().
In existing releases of libxml2, xmlXPathCompile can be drivento stack overflow because it fails to protect itself againsttoo-deeply-nested input. While there is an upstream fix as ofyesterday, it will take years for that to propagate into allshipping versions. In the meantime, we can protect our ownusages basically for free by calling xmlXPathCtxtCompile instead.(The actual bug is that libxml2 keeps its nesting counter in thexmlXPathContext, and its parsing code was willing to just skipcounting nesting levels if it didn't have a context. So if we supplya context, all is well. It seems odd actually that it works at allto not supply a context, because this means that XPath parsing doesnot have access to XML namespace info. Apparently libxml2 neverchecks namespaces until runtime? Anyway, this seems like goodfuture-proofing even if its only immediate effect is to dodge a bug.)Sadly, this hack only offers protection with libxml2 2.9.11 and newer.Before that there are multiple similar problems, so if you areprocessing untrusted XML it behooves you to get a newer version.But we have some pretty old libxml2 in the buildfarm, so it seemsimpractical to add a regression test to verify this fix.Per bug #18617 from Jingzhou Fu. Back-patch to all supportedversions.Discussion:https://postgr.es/m/18617-1cee4d2ed1f4e7ae@postgresql.orgDiscussion:https://gitlab.gnome.org/GNOME/libxml2/-/issues/799
1 parentad3a47c commit4310dfa

File tree

2 files changed

+17
-5
lines changed

2 files changed

+17
-5
lines changed

‎contrib/xml2/xpath.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -432,7 +432,7 @@ pgxml_xpath(text *document, xmlChar *xpath, xpath_workspace *workspace)
432432
workspace->ctxt->node=xmlDocGetRootElement(workspace->doctree);
433433

434434
/* compile the path */
435-
comppath=xmlXPathCompile(xpath);
435+
comppath=xmlXPathCtxtCompile(workspace->ctxt,xpath);
436436
if (comppath==NULL)
437437
xml_ereport(xmlerrcxt,ERROR,ERRCODE_EXTERNAL_ROUTINE_EXCEPTION,
438438
"XPath Syntax Error");
@@ -746,7 +746,7 @@ xpath_table(PG_FUNCTION_ARGS)
746746
ctxt->node=xmlDocGetRootElement(doctree);
747747

748748
/* compile the path */
749-
comppath=xmlXPathCompile(xpaths[j]);
749+
comppath=xmlXPathCtxtCompile(ctxt,xpaths[j]);
750750
if (comppath==NULL)
751751
xml_ereport(xmlerrcxt,ERROR,
752752
ERRCODE_EXTERNAL_ROUTINE_EXCEPTION,

‎src/backend/utils/adt/xml.c

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4155,7 +4155,13 @@ xpath_internal(text *xpath_expr_text, xmltype *data, ArrayType *namespaces,
41554155
}
41564156
}
41574157

4158-
xpathcomp=xmlXPathCompile(xpath_expr);
4158+
/*
4159+
* Note: here and elsewhere, be careful to use xmlXPathCtxtCompile not
4160+
* xmlXPathCompile. In libxml2 2.13.3 and older, the latter function
4161+
* fails to defend itself against recursion-to-stack-overflow. See
4162+
* https://gitlab.gnome.org/GNOME/libxml2/-/issues/799
4163+
*/
4164+
xpathcomp=xmlXPathCtxtCompile(xpathctx,xpath_expr);
41594165
if (xpathcomp==NULL||xmlerrcxt->err_occurred)
41604166
xml_ereport(xmlerrcxt,ERROR,ERRCODE_INTERNAL_ERROR,
41614167
"invalid XPath expression");
@@ -4534,7 +4540,10 @@ XmlTableSetRowFilter(TableFuncScanState *state, const char *path)
45344540

45354541
xstr=pg_xmlCharStrndup(path,strlen(path));
45364542

4537-
xtCxt->xpathcomp=xmlXPathCompile(xstr);
4543+
/* We require XmlTableSetDocument to have been done already */
4544+
Assert(xtCxt->xpathcxt!=NULL);
4545+
4546+
xtCxt->xpathcomp=xmlXPathCtxtCompile(xtCxt->xpathcxt,xstr);
45384547
if (xtCxt->xpathcomp==NULL||xtCxt->xmlerrcxt->err_occurred)
45394548
xml_ereport(xtCxt->xmlerrcxt,ERROR,ERRCODE_SYNTAX_ERROR,
45404549
"invalid XPath expression");
@@ -4565,7 +4574,10 @@ XmlTableSetColumnFilter(TableFuncScanState *state, const char *path, int colnum)
45654574

45664575
xstr=pg_xmlCharStrndup(path,strlen(path));
45674576

4568-
xtCxt->xpathscomp[colnum]=xmlXPathCompile(xstr);
4577+
/* We require XmlTableSetDocument to have been done already */
4578+
Assert(xtCxt->xpathcxt!=NULL);
4579+
4580+
xtCxt->xpathscomp[colnum]=xmlXPathCtxtCompile(xtCxt->xpathcxt,xstr);
45694581
if (xtCxt->xpathscomp[colnum]==NULL||xtCxt->xmlerrcxt->err_occurred)
45704582
xml_ereport(xtCxt->xmlerrcxt,ERROR,ERRCODE_DATA_EXCEPTION,
45714583
"invalid XPath expression");

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp