56 lines
1.8 KiB
Diff
56 lines
1.8 KiB
Diff
From 8a5dcc6e9da769bb49ce6a750cc0ef094d621b43 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Fri, 10 May 2019 14:23:24 +0200
|
|
Subject: [PATCH 19/26] Avoid quadratic behavior in xsltSaveResultTo
|
|
|
|
xmlNodeDumpOutput tries to detect XHTML documents and calls
|
|
xmlGetIntSubset which iterates the children of the result document
|
|
fragment again, leading to quadratic behavior.
|
|
|
|
Unfortunately, there's no way to tell xmlNodeDumpOutput which
|
|
serialization mode to use and skip auto-detection. The xmlsave API has
|
|
such an option, but it lacks a function to create an xmlSaveCtxt from
|
|
an existing xmlOutputBuffer.
|
|
|
|
Temporarily set result->children to NULL. This works because the
|
|
internal subset is always available from result->intSubset.
|
|
|
|
Found by OSS-Fuzz.
|
|
---
|
|
libxslt/xsltutils.c | 12 +++++++++++-
|
|
1 file changed, 11 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c
|
|
index 61f5c25..5e95787 100644
|
|
--- a/libxslt/xsltutils.c
|
|
+++ b/libxslt/xsltutils.c
|
|
@@ -1578,7 +1578,15 @@ xsltSaveResultTo(xmlOutputBufferPtr buf, xmlDocPtr result,
|
|
xmlOutputBufferWriteString(buf, "?>\n");
|
|
}
|
|
if (result->children != NULL) {
|
|
- xmlNodePtr child = result->children;
|
|
+ xmlNodePtr children = result->children;
|
|
+ xmlNodePtr child = children;
|
|
+
|
|
+ /*
|
|
+ * Hack to avoid quadratic behavior when scanning
|
|
+ * result->children in xmlGetIntSubset called by
|
|
+ * xmlNodeDumpOutput.
|
|
+ */
|
|
+ result->children = NULL;
|
|
|
|
while (child != NULL) {
|
|
xmlNodeDumpOutput(buf, result, child, 0, (indent == 1),
|
|
@@ -1591,6 +1599,8 @@ xsltSaveResultTo(xmlOutputBufferPtr buf, xmlDocPtr result,
|
|
}
|
|
if (indent)
|
|
xmlOutputBufferWriteString(buf, "\n");
|
|
+
|
|
+ result->children = children;
|
|
}
|
|
xmlOutputBufferFlush(buf);
|
|
}
|
|
--
|
|
1.8.3.1
|
|
|