SF bug #1296433 (Expat bug #1515266): Unchecked calls to character data

fred.drake · fred.drake · commit a2779e710d6a · 2006-07-01T16:28:20.000Z
handler would cause a segfault. This merges in Expat's lib/xmlparse.c revisions 1.154 and 1.155, which fix this and a closely related problem (the later does not affect Python). Moved the crasher test to the tests for xml.parsers.expat. git-svn-id: http://svn.python.org/projects/python/trunk@47191 6015fed2-1504-0410-9fe1-9d1591cc4771
diff --git a/Lib/test/crashers/xml_parsers.py b/Lib/test/crashers/xml_parsers.py
diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
@@ -365,3 +365,24 @@ def check_pos(self, event):
   <c/>
  </b>
 </a>''', 1)
+
+
+def test_parse_only_xml_data():
+    # http://python.org/sf/1296433
+    #
+    xml = "<?xml version='1.0' encoding='iso8859'?><s>%s</s>" % ('a' * 1025)
+    # this one doesn't crash
+    #xml = "<?xml version='1.0'?><s>%s</s>" % ('a' * 10000)
+
+    def handler(text):
+        raise Exception
+
+    parser = expat.ParserCreate()
+    parser.CharacterDataHandler = handler
+
+    try:
+        parser.Parse(xml)
+    except:
+        pass
+
+test_parse_only_xml_data()
diff --git a/Modules/expat/xmlparse.c b/Modules/expat/xmlparse.c
@@ -2552,6 +2552,8 @@ doContent(XML_Parser parser,
                                  (int)(dataPtr - (ICHAR *)dataBuf));
             if (s == next)
               break;
+            if (ps_parsing == XML_FINISHED || ps_parsing == XML_SUSPENDED)
+              break;
             *eventPP = s;
           }
         }

Original file line number	Diff line number	Diff line change
`@@ -2552,6 +2552,8 @@ doContent(XML_Parser parser,`
`2552`	`2552`	`(int)(dataPtr - (ICHAR *)dataBuf));`
`2553`	`2553`	`if (s == next)`
`2554`	`2554`	`break;`
	`2555`	`+ if (ps_parsing == XML_FINISHED \|\| ps_parsing == XML_SUSPENDED)`
	`2556`	`+ break;`
`2555`	`2557`	`*eventPP = s;`
`2556`	`2558`	`}`
`2557`	`2559`	`}`