Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6348048

Browse files
committed
Replace usages of xmlXPathCompile() with xmlXPathCtxtCompile().
In existing releases of libxml2, xmlXPathCompile can be drivento stack overflow because it fails to protect itself againsttoo-deeply-nested input. While there is an upstream fix as ofyesterday, it will take years for that to propagate into allshipping versions. In the meantime, we can protect our ownusages basically for free by calling xmlXPathCtxtCompile instead.(The actual bug is that libxml2 keeps its nesting counter in thexmlXPathContext, and its parsing code was willing to just skipcounting nesting levels if it didn't have a context. So if we supplya context, all is well. It seems odd actually that it works at allto not supply a context, because this means that XPath parsing doesnot have access to XML namespace info. Apparently libxml2 neverchecks namespaces until runtime? Anyway, this seems like goodfuture-proofing even if its only immediate effect is to dodge a bug.)Sadly, this hack only offers protection with libxml2 2.9.11 and newer.Before that there are multiple similar problems, so if you areprocessing untrusted XML it behooves you to get a newer version.But we have some pretty old libxml2 in the buildfarm, so it seemsimpractical to add a regression test to verify this fix.Per bug #18617 from Jingzhou Fu. Back-patch to all supportedversions.Discussion:https://postgr.es/m/18617-1cee4d2ed1f4e7ae@postgresql.orgDiscussion:https://gitlab.gnome.org/GNOME/libxml2/-/issues/799
1 parent9eafc0c commit6348048

File tree

2 files changed

+17
-5
lines changed

2 files changed

+17
-5
lines changed

‎contrib/xml2/xpath.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -386,7 +386,7 @@ pgxml_xpath(text *document, xmlChar *xpath, xpath_workspace *workspace)
386386
workspace->ctxt->node=xmlDocGetRootElement(workspace->doctree);
387387

388388
/* compile the path */
389-
comppath=xmlXPathCompile(xpath);
389+
comppath=xmlXPathCtxtCompile(workspace->ctxt,xpath);
390390
if (comppath==NULL)
391391
xml_ereport(xmlerrcxt,ERROR,ERRCODE_EXTERNAL_ROUTINE_EXCEPTION,
392392
"XPath Syntax Error");
@@ -650,7 +650,7 @@ xpath_table(PG_FUNCTION_ARGS)
650650
ctxt->node=xmlDocGetRootElement(doctree);
651651

652652
/* compile the path */
653-
comppath=xmlXPathCompile(xpaths[j]);
653+
comppath=xmlXPathCtxtCompile(ctxt,xpaths[j]);
654654
if (comppath==NULL)
655655
xml_ereport(xmlerrcxt,ERROR,
656656
ERRCODE_EXTERNAL_ROUTINE_EXCEPTION,

‎src/backend/utils/adt/xml.c‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4154,7 +4154,13 @@ xpath_internal(text *xpath_expr_text, xmltype *data, ArrayType *namespaces,
41544154
}
41554155
}
41564156

4157-
xpathcomp=xmlXPathCompile(xpath_expr);
4157+
/*
4158+
* Note: here and elsewhere, be careful to use xmlXPathCtxtCompile not
4159+
* xmlXPathCompile. In libxml2 2.13.3 and older, the latter function
4160+
* fails to defend itself against recursion-to-stack-overflow. See
4161+
* https://gitlab.gnome.org/GNOME/libxml2/-/issues/799
4162+
*/
4163+
xpathcomp=xmlXPathCtxtCompile(xpathctx,xpath_expr);
41584164
if (xpathcomp==NULL||xmlerrcxt->err_occurred)
41594165
xml_ereport(xmlerrcxt,ERROR,ERRCODE_INTERNAL_ERROR,
41604166
"invalid XPath expression");
@@ -4533,7 +4539,10 @@ XmlTableSetRowFilter(TableFuncScanState *state, const char *path)
45334539

45344540
xstr=pg_xmlCharStrndup(path,strlen(path));
45354541

4536-
xtCxt->xpathcomp=xmlXPathCompile(xstr);
4542+
/* We require XmlTableSetDocument to have been done already */
4543+
Assert(xtCxt->xpathcxt!=NULL);
4544+
4545+
xtCxt->xpathcomp=xmlXPathCtxtCompile(xtCxt->xpathcxt,xstr);
45374546
if (xtCxt->xpathcomp==NULL||xtCxt->xmlerrcxt->err_occurred)
45384547
xml_ereport(xtCxt->xmlerrcxt,ERROR,ERRCODE_SYNTAX_ERROR,
45394548
"invalid XPath expression");
@@ -4564,7 +4573,10 @@ XmlTableSetColumnFilter(TableFuncScanState *state, const char *path, int colnum)
45644573

45654574
xstr=pg_xmlCharStrndup(path,strlen(path));
45664575

4567-
xtCxt->xpathscomp[colnum]=xmlXPathCompile(xstr);
4576+
/* We require XmlTableSetDocument to have been done already */
4577+
Assert(xtCxt->xpathcxt!=NULL);
4578+
4579+
xtCxt->xpathscomp[colnum]=xmlXPathCtxtCompile(xtCxt->xpathcxt,xstr);
45684580
if (xtCxt->xpathscomp[colnum]==NULL||xtCxt->xmlerrcxt->err_occurred)
45694581
xml_ereport(xtCxt->xmlerrcxt,ERROR,ERRCODE_DATA_EXCEPTION,
45704582
"invalid XPath expression");

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp