Skip to content

Fix data corruption from unrecognized entity in StrPair::GetStr() (#1082) #1086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
steps-re wants to merge 1 commit into
base: master
Choose a base branch
from
+17 −0
Open

Fix data corruption from unrecognized entity in StrPair::GetStr() (#1082) #1086

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions tinyxml2.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,6 +347,11 @@ const char* StrPair::GetStr()
}
if ( !entityFound ) {
// fixme: treat as error?
// Not a recognized entity: copy the '&' through
// verbatim. The write pointer 'q' can lag behind the
// read pointer 'p' after an earlier entity expansion,
// so '*q' must be assigned or a stale byte is emitted.
*q = *p;
++p;
++q;
}
Expand Down
12 changes: 12 additions & 0 deletions xmltest.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1203,6 +1203,18 @@ int main( int argc, const char ** argv )
}
}

{
// An unrecognized entity following a recognized (expanded) entity must
// not corrupt the '&'. After "&" is collapsed the write pointer lags
// the read pointer, and the following "&bogus;" used to emit a stale
// buffer byte in place of the '&'. See issue #1082.
XMLDocument doc;
doc.Parse( "<a>&amp;&bogus;</a>" );
XMLTest( "Unrecognized entity after expansion: parse", false, doc.Error() );
XMLTest( "Unrecognized entity after expansion: text",
"&&bogus;", doc.FirstChildElement( "a" )->GetText() );
}

{
// Suppress entities.
const char* passages =
Expand Down