[Libreoffice-commits] core.git: starmath/source

[Caolán McNamara]

 starmath/source/mathmlimport.cxx |   24 ++++++++++++++++++++----
 starmath/source/mathmlimport.hxx |    5 +++++
 2 files changed, 25 insertions(+), 4 deletions(-)

New commits:
commit f1d1eb2c647af7b751b024faef09e01d849aacbb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jan 21 17:51:14 2018 +0000

    ofz#5526 restrict mml parsing depth
    
    Change-Id: Ib74787137112fb8402a2f6400ab4313d43c103dc
    Reviewed-on: https://gerrit.libreoffice.org/48277
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/starmath/source/mathmlimport.cxx b/starmath/source/mathmlimport.cxx
index 032feb61a260..62a705cae930 100644
--- a/starmath/source/mathmlimport.cxx
+++ b/starmath/source/mathmlimport.cxx
@@ -410,7 +410,8 @@ SmXMLImport::SmXMLImport(
     const css::uno::Reference< css::uno::XComponentContext >& rContext,
     OUString const & implementationName, SvXMLImportFlags nImportFlags)
 :   SvXMLImport(rContext, implementationName, nImportFlags),
-    bSuccess(false)
+    bSuccess(false),
+    nParseDepth(0)
 {
 }
 
@@ -536,7 +537,15 @@ class SmXMLImportContext: public SvXMLImportContext
 public:
     SmXMLImportContext( SmXMLImport &rImport, sal_uInt16 nPrfx,
         const OUString& rLName)
-        : SvXMLImportContext(rImport, nPrfx, rLName) {}
+        : SvXMLImportContext(rImport, nPrfx, rLName)
+    {
+        GetSmImport().IncParseDepth();
+    }
+
+    virtual ~SmXMLImportContext() override
+    {
+        GetSmImport().DecParseDepth();
+    }
 
     SmXMLImport& GetSmImport()
     {
@@ -546,6 +555,12 @@ public:
     virtual void TCharacters(const OUString & /*rChars*/);
     virtual void Characters(const OUString &rChars) override;
     virtual SvXMLImportContextRef CreateChildContext(sal_uInt16 /*nPrefix*/, const OUString& /*rLocalName*/, const uno::Reference< xml::sax::XAttributeList > & /*xAttrList*/) override;
+    virtual void StartElement(const css::uno::Reference<css::xml::sax::XAttributeList>& rAttrList) override
+    {
+        if (GetSmImport().TooDeep())
+            throw std::range_error("too deep");
+        SvXMLImportContext::StartElement(rAttrList);
+    }
 };
 
 void SmXMLImportContext::TCharacters(const OUString & /*rChars*/)
@@ -906,7 +921,9 @@ public:
     SmXMLRowContext_Impl(SmXMLImport &rImport,sal_uInt16 nPrefix,
         const OUString& rLName)
         : SmXMLDocContext_Impl(rImport,nPrefix,rLName)
-        { nElementCount = GetSmImport().GetNodeStack().size(); }
+        , nElementCount(GetSmImport().GetNodeStack().size())
+    {
+    }
 
     virtual SvXMLImportContextRef CreateChildContext(sal_uInt16 nPrefix, const OUString& rLocalName, const uno::Reference< xml::sax::XAttributeList > &xAttrList) override;
 
@@ -916,7 +933,6 @@ public:
     void EndElement() override;
 };
 
-
 class SmXMLEncloseContext_Impl : public SmXMLRowContext_Impl
 {
 public:
diff --git a/starmath/source/mathmlimport.hxx b/starmath/source/mathmlimport.hxx
index 3d017c1a25a7..a0d2c6254f0c 100644
--- a/starmath/source/mathmlimport.hxx
+++ b/starmath/source/mathmlimport.hxx
@@ -80,6 +80,7 @@ class SmXMLImport : public SvXMLImport
 
         SmNodeStack aNodeStack;
         bool bSuccess;
+        int nParseDepth;
         OUString aText;
 
 public:
@@ -181,6 +182,10 @@ public:
 
     virtual void SetViewSettings(const css::uno::Sequence<css::beans::PropertyValue>& aViewProps) override;
     virtual void SetConfigurationSettings(const css::uno::Sequence<css::beans::PropertyValue>& aViewProps) override;
+
+    void IncParseDepth() { ++nParseDepth; }
+    bool TooDeep() const { return nParseDepth >= 2048; }
+    void DecParseDepth() { --nParseDepth; }
 };