mirror/netcdf-c
2
0
Fork 0
mirror of https://github.com/Unidata/netcdf-c.git synced 2024-11-21 03:13:42 +08:00
Code Issues Packages Projects Releases Wiki Activity
a328318d6b
netcdf-c/libncxml/ezxml.c
Dennis Heimbigner 9380790ea8 Support MSYS2/Mingw platform 
re:

The current netcdf-c release has some problems with the mingw platform
on windows. Mostly they are path issues.

Changes to support mingw+msys2:
-------------------------------
* Enable option of looking into the windows registry to find
  the mingw root path. In aid of proper path handling.
* Add mingw+msys as a specific platform in configure.ac and move testing
  of the platform to the front so it is available early.
* Handle mingw X libncpoco (dynamic loader) properly even though
  mingw does not yet support it.
* Handle mingw X plugins properly even though mingw does not yet support it.
* Alias pwd='pwd -W' to better handle paths in shell scripts.
* Plus a number of other minor compile irritations.
* Disallow the use of multiple nc_open's on the same file for windows
  (and mingw) because windows does not seem to handle these properly.
  Not sure why we did not catch this earlier.
* Add mountpoint info to dpathmgr.c to help support mingw.
* Cleanup dpathmgr conversions.

Known problems:
---------------
* I have not been able to get shared libraries to work, so
  plugins/filters must be disabled.
* There is some kind of problem with libcurl that I have not solved,
  so all uses of libcurl (currently DAP+Byterange) must be disabled.

Misc. other fixes:
------------------
* Cleanup the relationship between ENABLE_PLUGINS and various other flags
  in CMakeLists.txt and configure.ac.
* Re-arrange the TESTDIRS order in Makefile.am.
* Add pseudo-breakpoint to nclog.[ch] for debugging.
* Improve the documentation of the path manager code in ncpathmgr.h
* Add better support for relative paths in dpathmgr.c
* Default the mode args to NCfopen to include "b" (binary) for windows.
* Add optional debugging output in various places.
* Make sure that everything builds with plugins disabled.
* Fix numerous (s)printf inconsistencies betweenb the format spec
  and the arguments.
2021-12-23 22:18:56 -07:00

1057 lines
41 KiB
C
Raw Blame History

#define EZXML_NOMMAP 1
/* ezxml.c
*
* Copyright 2004-2006 Aaron Voisine <aaron@voisine.org>
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this software and associated documentation files (the
* "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish,
* distribute, sublicense, and/or sell copies of the Software, and to
* permit persons to whom the Software is furnished to do so, subject to
* the following conditions:
*
* The above copyright notice and this permission notice shall be included
* in all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*/
#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
#ifndef EZXML_NOMMAP
#include <sys/mman.h>
#endif /* EZXML_NOMMAP*/
#include <sys/stat.h>
#include "ezxml.h"
#define EZXML_WS "\t\r\n " /* whitespace*/
#define EZXML_ERRL 128 /* maximum error string length*/
typedef struct ezxml_root *ezxml_root_t;
struct ezxml_root { /* additional data for the root tag*/
struct ezxml xml; /* is a super-struct built on top of ezxml struct*/
ezxml_t cur; /* current xml tree insertion point*/
char *m; /* original xml string*/
size_t len; /* length of allocated memory for mmap, -1 for malloc*/
char *u; /* UTF-8 conversion of string if original was UTF-16*/
char *s; /* start of work area*/
char *e; /* end of work area*/
char **ent; /* general entities (ampersand sequences)*/
char ***attr; /* default attributes*/
char ***pi; /* processing instructions*/
short standalone; /* non-zero if <?xml standalone="yes"?>*/
char err[EZXML_ERRL]; /* error string*/
};
char *EZXML_NIL[] = { NULL }; /* empty, null terminated array of strings*/
/* returns the first child tag with the given name or NULL if not found*/
ezxml_t ezxml_child(ezxml_t xml, const char *name)
{
xml = (xml) ? xml->child : NULL;
while (xml && strcmp(name, xml->name)) xml = xml->sibling;
return xml;
}
/* returns the Nth tag with the same name in the same subsection or NULL if not*/
/* found*/
ezxml_t ezxml_idx(ezxml_t xml, int idx)
{
for (; xml && idx; idx--) xml = xml->next;
return xml;
}
/* returns the value of the requested tag attribute or NULL if not found*/
const char *ezxml_attr(ezxml_t xml, const char *attr)
{
int i = 0, j = 1;
ezxml_root_t root = (ezxml_root_t)xml;
if (! xml || ! xml->attr) return NULL;
while (xml->attr[i] && strcmp(attr, xml->attr[i])) i += 2;
if (xml->attr[i]) return xml->attr[i + 1]; /* found attribute*/
while (root->xml.parent) root = (ezxml_root_t)root->xml.parent; /* root tag*/
for (i = 0; root->attr[i] && strcmp(xml->name, root->attr[i][0]); i++);
if (! root->attr[i]) return NULL; /* no matching default attributes*/
while (root->attr[i][j] && strcmp(attr, root->attr[i][j])) j += 3;
return (root->attr[i][j]) ? root->attr[i][j + 1] : NULL; /* found default*/
}
/* same as ezxml_get but takes an already initialized va_list*/
ezxml_t ezxml_vget(ezxml_t xml, va_list ap)
{
char *name = va_arg(ap, char *);
int idx = -1;
if (name && *name) {
idx = va_arg(ap, int);
xml = ezxml_child(xml, name);
}
return (idx < 0) ? xml : ezxml_vget(ezxml_idx(xml, idx), ap);
}
/* Traverses the xml tree to retrieve a specific subtag. Takes a variable*/
/* length list of tag names and indexes. The argument list must be terminated*/
/* by either an index of -1 or an empty string tag name. Example: */
/* title = ezxml_get(library, "shelf", 0, "book", 2, "title", -1);*/
/* This retrieves the title of the 3rd book on the 1st shelf of library.*/
/* Returns NULL if not found.*/
ezxml_t ezxml_get(ezxml_t xml, ...)
{
va_list ap;
ezxml_t r;
va_start(ap, xml);
r = ezxml_vget(xml, ap);
va_end(ap);
return r;
}
/* returns a null terminated array of processing instructions for the given*/
/* target*/
const char **ezxml_pi(ezxml_t xml, const char *target)
{
ezxml_root_t root = (ezxml_root_t)xml;
int i = 0;
if (! root) return (const char **)EZXML_NIL;
while (root->xml.parent) root = (ezxml_root_t)root->xml.parent; /* root tag*/
while (root->pi[i] && strcmp(target, root->pi[i][0])) i++; /* find target*/
return (const char **)((root->pi[i]) ? root->pi[i] + 1 : EZXML_NIL);
}
/* set an error string and return root*/
ezxml_t ezxml_err(ezxml_root_t root, char *s, const char *err, ...)
{
va_list ap;
int line = 1;
char *t, fmt[EZXML_ERRL];
for (t = root->s; t < s; t++) if (*t == '\n') line++;
snprintf(fmt, EZXML_ERRL, "[error near line %d]: %s", line, err);
va_start(ap, err);
vsnprintf(root->err, EZXML_ERRL, fmt, ap);
va_end(ap);
return &root->xml;
}
/* Recursively decodes entity and character references and normalizes new lines*/
/* ent is a null terminated array of alternating entity names and values. set t*/
/* to '&' for general entity decoding, '%' for parameter entity decoding, 'c'*/
/* for cdata sections, ' ' for attribute normalization, or '*' for non-cdata*/
/* attribute normalization. Returns s, or if the decoded string is longer than*/
/* s, returns a malloced string that must be freed.*/
char *ezxml_decode(char *s, char **ent, char t)
{
char *e, *r = s, *m = s;
long b, c, d, l;
for (; *s; s++) { /* normalize line endings*/
while (*s == '\r') {
*(s++) = '\n';
if (*s == '\n') memmove(s, (s + 1), strlen(s));
}
if (!*s) break; // bug#19 / CVE-2019-20200
}
for (s = r; ; ) {
while (*s && *s != '&' && (*s != '%' || t != '%') && !isspace(*s)) s++;
if (! *s) break;
else if (t != 'c' && ! strncmp(s, "&#", 2)) { /* character reference*/
if (s[2] == 'x') c = strtol(s + 3, &e, 16); /* base 16*/
else c = strtol(s + 2, &e, 10); /* base 10*/
if (! c || *e != ';') { s++; continue; } /* not a character ref*/
if (c < 0x80) *(s++) = c; /* US-ASCII subset*/
else { /* multi-byte UTF-8 sequence*/
for (b = 0, d = c; d; d /= 2) b++; /* number of bits in c*/
// UTF-8 can ecode max 36 bits (standard says 21) - noop on 32 bit.
if (b > 36) { s++; continue; } // bug#15 / CVE-2019-20006 / bug#17 / CVE-2019-20202
b = (b - 2) / 5; /* number of bytes in payload*/
*(s++) = (0xFF << (7 - b)) | (c >> (6 * b)); /* head*/
while (b) *(s++) = 0x80 | ((c >> (6 * --b)) & 0x3F); /* payload*/
}
memmove(s, strchr(s, ';') + 1, strlen(strchr(s, ';')));
}
else if ((*s == '&' && (t == '&' || t == ' ' || t == '*')) ||
(*s == '%' && t == '%')) { /* entity reference*/
for (b = 0; ent[b] && strncmp(s + 1, ent[b], strlen(ent[b]));
b += 2); /* find entity in entity list*/
if (ent[b++]) { /* found a match*/
if ((c = strlen(ent[b])) - 1 > (e = strchr(s, ';')) - s) {
if (!e) { s++; continue; } // bug#18 / CVE-2019-20199
l = (d = (s - r)) + c + strlen(e); /* new length*/
r = (r == m) ? strcpy(malloc(l), r) : realloc(r, l);
e = strchr((s = r + d), ';'); /* fix up pointers*/
if (!e) { s++; continue; } // bug#18 / CVE-2019-20199
}
memmove(s + c, e + 1, strlen(e)); /* shift rest of string*/
strncpy(s, ent[b], c); /* copy in replacement text*/
}
else s++; /* not a known entity*/
}
else if ((t == ' ' || t == '*') && isspace(*s)) *(s++) = ' ';
else s++; /* no decoding needed*/
}
if (t == '*') { /* normalize spaces for non-cdata attributes*/
for (s = r; *s; s++) {
if ((l = strspn(s, " "))) memmove(s, s + l, strlen(s + l) + 1);
while (*s && *s != ' ') s++;
}
if (--s >= r && *s == ' ') *s = '\0'; /* trim any trailing space*/
}
return r;
}
/* called when parser finds start of new tag*/
void ezxml_open_tag(ezxml_root_t root, char *name, char **attr)
{
ezxml_t xml = root->cur;
if (xml->name) xml = ezxml_add_child(xml, name, strlen(xml->txt));
else xml->name = name; /* first open tag*/
xml->attr = attr;
root->cur = xml; /* update tag insertion point*/
}
/* called when parser finds character content between open and closing tag*/
void ezxml_char_content(ezxml_root_t root, char *s, size_t len, char t)
{
ezxml_t xml = root->cur;
char *m = s;
size_t l;
if (! xml || ! xml->name || ! len) return; /* sanity check*/
s[len] = '\0'; /* null terminate text (calling functions anticipate this)*/
len = strlen(s = ezxml_decode(s, root->ent, t)) + 1;
if (! *(xml->txt)) xml->txt = s; /* initial character content*/
else { /* allocate our own memory and make a copy*/
xml->txt = (xml->flags & EZXML_TXTM) /* allocate some space*/
? realloc(xml->txt, (l = strlen(xml->txt)) + len)
: strcpy(malloc((l = strlen(xml->txt)) + len), xml->txt);
strcpy(xml->txt + l, s); /* add new char content*/
if (s != m) free(s); /* free s if it was malloced by ezxml_decode()*/
}
if (xml->txt != m) ezxml_set_flag(xml, EZXML_TXTM);
}
/* called when parser finds closing tag*/
ezxml_t ezxml_close_tag(ezxml_root_t root, char *name, char *s)
{
if (! root->cur || ! root->cur->name || strcmp(name, root->cur->name))
return ezxml_err(root, s, "unexpected closing tag </%s>", name);
root->cur = root->cur->parent;
return NULL;
}
/* checks for circular entity references, returns non-zero if no circular*/
/* references are found, zero otherwise*/
int ezxml_ent_ok(char *name, char *s, char **ent)
{
int i;
for (; ; s++) {
while (*s && *s != '&') s++; /* find next entity reference*/
if (! *s) return 1;
if (! strncmp(s + 1, name, strlen(name))) return 0; /* circular ref.*/
for (i = 0; ent[i] && strncmp(ent[i], s + 1, strlen(ent[i])); i += 2);
if (ent[i] && ! ezxml_ent_ok(name, ent[i + 1], ent)) return 0;
}
}
/* called when the parser finds a processing instruction*/
void ezxml_proc_inst(ezxml_root_t root, char *s, size_t len)
{
int i = 0, j = 1;
char *target = s;
s[len] = '\0'; /* null terminate instruction*/
if (*(s += strcspn(s, EZXML_WS))) {
*s = '\0'; /* null terminate target*/
s += strspn(s + 1, EZXML_WS) + 1; /* skip whitespace after target*/
}
if (! strcmp(target, "xml")) { /* <?xml ... ?>*/
if ((s = strstr(s, "standalone")) && ! strncmp(s + strspn(s + 10,
EZXML_WS "='\"") + 10, "yes", 3)) root->standalone = 1;
return;
}
if (! root->pi[0]) *(root->pi = malloc(sizeof(char **))) = NULL; /*first pi*/
while (root->pi[i] && strcmp(target, root->pi[i][0])) i++; /* find target*/
if (! root->pi[i]) { /* new target*/
root->pi = realloc(root->pi, sizeof(char **) * (i + 2));
root->pi[i] = malloc(sizeof(char *) * 3);
root->pi[i][0] = target;
root->pi[i][1] = (char *)(root->pi[i + 1] = NULL); /* terminate pi list*/
root->pi[i][2] = strdup(""); /* empty document position list*/
}
while (root->pi[i][j]) j++; /* find end of instruction list for this target*/
root->pi[i] = realloc(root->pi[i], sizeof(char *) * (j + 3));
root->pi[i][j + 2] = realloc(root->pi[i][j + 1], j + 1);
strcpy(root->pi[i][j + 2] + j - 1, (root->xml.name) ? ">" : "<");
root->pi[i][j + 1] = NULL; /* null terminate pi list for this target*/
root->pi[i][j] = s; /* set instruction*/
}
/* called when the parser finds an internal doctype subset*/
short ezxml_internal_dtd(ezxml_root_t root, char *s, size_t len)
{
char q, *c, *t, *n = NULL, *v, **ent, **pe;
int i, j;
/* Bug CVE-2021-31229 */
size_t n_len, n_off;
pe = memcpy(malloc(sizeof(EZXML_NIL)), EZXML_NIL, sizeof(EZXML_NIL));
for (s[len] = '\0'; s; ) {
while (*s && *s != '<' && *s != '%') s++; /* find next declaration*/
if (! *s) break;
else if (! strncmp(s, "<!ENTITY", 8)) { /* parse entity definitions*/
c = s += strspn(s + 8, EZXML_WS) + 8; /* skip white space separator*/
n = s + strspn(s, EZXML_WS "%"); /* find name*/
/* Bug CVE-2021-31229 */
n_len = strlen(n);
n_off = strcspn(n, EZXML_WS);
if(n_off >= n_len) {
ezxml_err(root, NULL, "write past buffer (<!ENTITY)");
break;
}
*(s = n + n_off) = ';'; /* append ; to name */
v = s + strspn(s + 1, EZXML_WS) + 1; /* find value*/
if ((q = *(v++)) != '"' && q != '\'') { /* skip externals*/
s = strchr(s, '>');
continue;
}
for (i = 0, ent = (*c == '%') ? pe : root->ent; ent[i]; i++);
ent = realloc(ent, (i + 3) * sizeof(char *)); /* space for next ent*/
if (*c == '%') pe = ent;
else root->ent = ent;
*(++s) = '\0'; /* null terminate name*/
if ((s = strchr(v, q))) *(s++) = '\0'; /* null terminate value*/
ent[i + 1] = ezxml_decode(v, pe, '%'); /* set value*/
ent[i + 2] = NULL; /* null terminate entity list*/
if (! ezxml_ent_ok(n, ent[i + 1], ent)) { /* circular reference*/
if (ent[i + 1] != v) free(ent[i + 1]);
ezxml_err(root, v, "circular entity declaration &%s", n);
break;
}
else ent[i] = n; /* set entity name*/
}
else if (! strncmp(s, "<!ATTLIST", 9)) { /* parse default attributes*/
t = s + strspn(s + 9, EZXML_WS) + 9; /* skip whitespace separator*/
if (! *t) { ezxml_err(root, t, "unclosed <!ATTLIST"); break; }
if (*(s = t + strcspn(t, EZXML_WS ">")) == '>') continue;
else *s = '\0'; /* null terminate tag name*/
/* Bug CVE-2021-30485 */
for (i = 0; n && root->attr[i] && strcmp(n, root->attr[i][0]); i++);
for(;;) {
s++;
if(!(*(n = s + strspn(s, EZXML_WS)) && *n != '>')) break;
if (*(s = n + strcspn(n, EZXML_WS))) *s = '\0'; /* attr name*/
else { ezxml_err(root, t, "malformed <!ATTLIST"); break; }
s += strspn(s + 1, EZXML_WS) + 1; /* find next token*/
c = (strncmp(s, "CDATA", 5)) ? "*" : " "; /* is it cdata?*/
if (! strncmp(s, "NOTATION", 8))
s += strspn(s + 8, EZXML_WS) + 8;
s = (*s == '(') ? strchr(s, ')') : s + strcspn(s, EZXML_WS);
if (! s) { ezxml_err(root, t, "malformed <!ATTLIST"); break; }
s += strspn(s, EZXML_WS ")"); /* skip white space separator*/
if (! strncmp(s, "#FIXED", 6))
s += strspn(s + 6, EZXML_WS) + 6;
if (*s == '#') { /* no default value*/
s += strcspn(s, EZXML_WS ">") - 1;
if (*c == ' ') continue; /* cdata is default, nothing to do*/
v = NULL;
}
else if ((*s == '"' || *s == '\'') && /* default value*/
(s = strchr(v = s + 1, *s))) *s = '\0';
else { ezxml_err(root, t, "malformed <!ATTLIST"); break; }
if (! root->attr[i]) { /* new tag name*/
root->attr = (! i) ? malloc(2 * sizeof(char **))
: realloc(root->attr,
(i + 2) * sizeof(char **));
root->attr[i] = malloc(2 * sizeof(char *));
root->attr[i][0] = t; /* set tag name*/
root->attr[i][1] = (char *)(root->attr[i + 1] = NULL);
}
for (j = 1; root->attr[i][j]; j += 3); /* find end of list*/
root->attr[i] = realloc(root->attr[i],
(j + 4) * sizeof(char *));
root->attr[i][j + 3] = NULL; /* null terminate list*/
root->attr[i][j + 2] = c; /* is it cdata?*/
root->attr[i][j + 1] = (v) ? ezxml_decode(v, root->ent, *c)
: NULL;
root->attr[i][j] = n; /* attribute name */
}
}
else if (! strncmp(s, "<!--", 4)) s = strstr(s + 4, "-->"); /* comments*/
else if (! strncmp(s, "<?", 2)) { /* processing instructions*/
if ((s = strstr(c = s + 2, "?>")))
ezxml_proc_inst(root, c, s++ - c);
}
else if (*s == '<') s = strchr(s, '>'); /* skip other declarations*/
else if (*(s++) == '%' && ! root->standalone) break;
}
free(pe);
return ! *root->err;
}
/* Converts a UTF-16 string to UTF-8. Returns a new string that must be freed*/
/* or NULL if no conversion was needed.*/
char *ezxml_str2utf8(char **s, size_t *len)
{
char *u;
size_t l = 0, sl, max = *len;
long c, d;
int b, be = (**s == '\xFE') ? 1 : (**s == '\xFF') ? 0 : -1;
if (be == -1) return NULL; /* not UTF-16*/
u = malloc(max);
for (sl = 2; sl < *len - 1; sl += 2) {
c = (be) ? (((*s)[sl] & 0xFF) << 8) | ((*s)[sl + 1] & 0xFF) /*UTF-16BE*/
: (((*s)[sl + 1] & 0xFF) << 8) | ((*s)[sl] & 0xFF); /*UTF-16LE*/
if (c >= 0xD800 && c <= 0xDFFF && (sl += 2) < *len - 1) { /* high-half*/
d = (be) ? (((*s)[sl] & 0xFF) << 8) | ((*s)[sl + 1] & 0xFF)
: (((*s)[sl + 1] & 0xFF) << 8) | ((*s)[sl] & 0xFF);
c = (((c & 0x3FF) << 10) | (d & 0x3FF)) + 0x10000;
}
while (l + 6 > max) u = realloc(u, max += EZXML_BUFSIZE);
if (c < 0x80) u[l++] = c; /* US-ASCII subset*/
else { /* multi-byte UTF-8 sequence*/
for (b = 0, d = c; d; d /= 2) b++; /* bits in c*/
b = (b - 2) / 5; /* bytes in payload*/
u[l++] = (0xFF << (7 - b)) | (c >> (6 * b)); /* head*/
while (b) u[l++] = 0x80 | ((c >> (6 * --b)) & 0x3F); /* payload*/
}
}
return *s = realloc(u, *len = l);
}
/* frees a tag attribute list*/
void ezxml_free_attr(char **attr) {
int i = 0;
char *m;
if (! attr || attr == EZXML_NIL) return; /* nothing to free*/
while (attr[i]) i += 2; /* find end of attribute list*/
m = attr[i + 1]; /* list of which names and values are malloced*/
for (i = 0; m[i]; i++) {
if (m[i] & EZXML_NAMEM) free(attr[i * 2]);
if (m[i] & EZXML_TXTM) free(attr[(i * 2) + 1]);
}
free(m);
free(attr);
}
/* parse the given xml string and return an ezxml structure*/
ezxml_t ezxml_parse_str(char *s, size_t len)
{
ezxml_root_t root = (ezxml_root_t)ezxml_new(NULL);
char q, e, *d, **attr, **a = NULL; /* initialize a to avoid compile warning*/
int l, i, j;
if (!root) return NULL; // bug#21 / CVE-2021-26221
root->m = s;
if (! len) return ezxml_err(root, NULL, "root tag missing");
root->u = ezxml_str2utf8(&s, &len); /* convert utf-16 to utf-8*/
if (! s) return ezxml_err(root, NULL, "invalid root tag"); // bug#13 / CVE-2019-20007
root->e = (root->s = s) + len; /* record start and end of work area*/
e = s[len - 1]; /* save end char*/
s[len - 1] = '\0'; /* turn end char into null terminator*/
while (*s && *s != '<') s++; /* find first tag*/
if (! *s) return ezxml_err(root, s, "root tag missing");
for (; ; ) {
attr = (char **)EZXML_NIL;
d = ++s;
if (isalpha(*s) || *s == '_' || *s == ':' || *s < '\0') { /* new tag*/
if (! root->cur)
return ezxml_err(root, d, "markup outside of root element");
s += strcspn(s, EZXML_WS "/>");
while (isspace(*s)) *(s++) = '\0'; /* null terminate tag name*/
if (*s && *s != '/' && *s != '>') /* find tag in default attr list*/
for (i = 0; (a = root->attr[i]) && strcmp(a[0], d); i++);
for (l = 0; *s && *s != '/' && *s != '>'; l += 2) { /* new attrib*/
attr = (l) ? realloc(attr, (l + 4) * sizeof(char *))
: malloc(4 * sizeof(char *)); /* allocate space*/
attr[l + 3] = (l) ? realloc(attr[l + 1], (l / 2) + 2)
: malloc(2); /* mem for list of maloced vals*/
strcpy(attr[l + 3] + (l / 2), " "); /* value is not malloced*/
attr[l + 2] = NULL; /* null terminate list*/
attr[l + 1] = ""; /* temporary attribute value*/
attr[l] = s; /* set attribute name*/
s += strcspn(s, EZXML_WS "=/>");
if (*s == '=' || isspace(*s)) {
*(s++) = '\0'; /* null terminate tag attribute name*/
q = *(s += strspn(s, EZXML_WS "="));
if (q == '"' || q == '\'') { /* attribute value*/
attr[l + 1] = ++s;
while (*s && *s != q) s++;
if (*s) *(s++) = '\0'; /* null terminate attribute val*/
else {
ezxml_free_attr(attr);
return ezxml_err(root, d, "missing %c", q);
}
for (j = 1; a && a[j] && strcmp(a[j], attr[l]); j +=3);
attr[l + 1] = ezxml_decode(attr[l + 1], root->ent, (a
&& a[j]) ? *a[j + 2] : ' ');
if (attr[l + 1] < d || attr[l + 1] > s)
attr[l + 3][l / 2] = EZXML_TXTM; /* value malloced*/
}
}
while (isspace(*s)) s++;
}
if (*s == '/') { /* self closing tag*/
*(s++) = '\0';
if ((*s && *s != '>') || (! *s && e != '>')) {
if (l) ezxml_free_attr(attr);
return ezxml_err(root, d, "missing >");
}
ezxml_open_tag(root, d, attr);
ezxml_close_tag(root, d, s);
}
else if ((q = *s) == '>' || (! *s && e == '>')) { /* open tag*/
*s = '\0'; /* temporarily null terminate tag name*/
ezxml_open_tag(root, d, attr);
*s = q;
}
else {
if (l) ezxml_free_attr(attr);
return ezxml_err(root, d, "missing >");
}
}
else if (*s == '/') { /* close tag*/
s += strcspn(d = s + 1, EZXML_WS ">") + 1;
if (! (q = *s) && e != '>') return ezxml_err(root, d, "missing >");
*s = '\0'; /* temporarily null terminate tag name*/
if (ezxml_close_tag(root, d, s)) return &root->xml;
if (isspace(*s = q)) s += strspn(s, EZXML_WS);
}
else if (! strncmp(s, "!--", 3)) { /* xml comment*/
if (! (s = strstr(s + 3, "--")) || (*(s += 2) != '>' && *s) ||
(! *s && e != '>')) return ezxml_err(root, d, "unclosed <!--");
}
else if (! strncmp(s, "![CDATA[", 8)) { /* cdata*/
if ((s = strstr(s, "]]>")))
ezxml_char_content(root, d + 8, (s += 2) - d - 10, 'c');
else return ezxml_err(root, d, "unclosed <![CDATA[");
}
else if (! strncmp(s, "!DOCTYPE", 8)) { /* dtd*/
for (l = 0; *s && ((! l && *s != '>') || (l && (*s != ']' ||
*(s + strspn(s + 1, EZXML_WS) + 1) != '>')));
l = (*s == '[') ? 1 : l) s += strcspn(s + 1, "[]>") + 1;
/* Bug CVE-2021-31348 / CVE-2021-31347 */
if (! *s )
return ezxml_err(root, d, "unclosed <!DOCTYPE");
d = (l) ? strchr(d, '[') + 1 : d;
if (l && ! ezxml_internal_dtd(root, d, s++ - d)) return &root->xml;
}
else if (*s == '?') { /* <?...?> processing instructions*/
do { s = strchr(s, '?'); } while (s && *(++s) && *s != '>');
if (! s || (! *s && e != '>'))
return ezxml_err(root, d, "unclosed <?");
else ezxml_proc_inst(root, d + 1, s - d - 2);
}
else return ezxml_err(root, d, "unexpected <");
if (! s || ! *s) break;
*s = '\0';
d = ++s;
if (*s && *s != '<') { /* tag character content*/
while (*s && *s != '<') s++;
if (*s) ezxml_char_content(root, d, s - d, '&');
else break;
}
else if (! *s) break;
}
if (! root->cur) return &root->xml;
else if (! root->cur->name) return ezxml_err(root, d, "root tag missing");
else return ezxml_err(root, d, "unclosed tag <%s>", root->cur->name);
}
#if 0
/* Wrapper for ezxml_parse_str() that accepts a file stream. Reads the entire*/
/* stream into memory and then parses it. For xml files, use ezxml_parse_file()*/
/* or ezxml_parse_fd()*/
ezxml_t ezxml_parse_fp(FILE *fp)
{
ezxml_root_t root;
size_t l, len = 0;
char *s;
if (! (s = malloc(EZXML_BUFSIZE))) return NULL;
do {
len += (l = fread((s + len), 1, EZXML_BUFSIZE, fp));
if (l == EZXML_BUFSIZE) s = realloc(s, len + EZXML_BUFSIZE);
} while (s && l == EZXML_BUFSIZE);
if (! s) return NULL;
if (!(root = (ezxml_root_t)ezxml_parse_str(s, len))) { free(s); return NULL; }; // bug#21 / CVE-2021-26221
root = (ezxml_root_t)ezxml_parse_str(s, len);
root->len = -1; /* so we know to free s in ezxml_free()*/
return &root->xml;
}
/* A wrapper for ezxml_parse_str() that accepts a file descriptor. First*/
/* attempts to mem map the file. Failing that, reads the file into memory.*/
/* Returns NULL on failure.*/
ezxml_t ezxml_parse_fd(int fd)
{
ezxml_root_t root;
struct stat st;
size_t l;
void *m;
if (fd < 0) return NULL;
fstat(fd, &st);
#ifndef EZXML_NOMMAP
l = (st.st_size + sysconf(_SC_PAGESIZE) - 1) & ~(sysconf(_SC_PAGESIZE) -1);
if ((m = mmap(NULL, l, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0)) !=
MAP_FAILED) {
madvise(m, l, MADV_SEQUENTIAL); /* optimize for sequential access*/
root = (ezxml_root_t)ezxml_parse_str(m, st.st_size);
if (!root) { munmap(m,l); return NULL; }; // bug#21 / CVE-2021-26221
madvise(m, root->len = l, MADV_NORMAL); /* put it back to normal*/
}
else { /* mmap failed, read file into memory*/
#endif /* EZXML_NOMMAP*/
l = read(fd, m = malloc(st.st_size), st.st_size);
root = (ezxml_root_t)ezxml_parse_str(m, l);
if (!root) { free(m); return NULL; }; // bug#21 / CVE-2021-26221
root->len = -1; /* so we know to free s in ezxml_free()*/
#ifndef EZXML_NOMMAP
}
#endif /* EZXML_NOMMAP*/
return &root->xml;
}
/* a wrapper for ezxml_parse_fd that accepts a file name*/
ezxml_t ezxml_parse_file(const char *file)
{
int fd = open(file, O_RDONLY, 0);
ezxml_t xml = ezxml_parse_fd(fd);
if (fd >= 0) close(fd);
return xml;
}
#endif /*0*/
/* Encodes ampersand sequences appending the results to *dst, reallocating *dst*/
/* if length excedes max. a is non-zero for attribute encoding. Returns *dst*/
char *ezxml_ampencode(const char *s, size_t len, char **dst, size_t *dlen,
size_t *max, short a)
{
const char *e;
for (e = s + len; s != e; s++) {
while (*dlen + 10 > *max) *dst = realloc(*dst, *max += EZXML_BUFSIZE);
switch (*s) {
case '\0': return *dst;
case '&': *dlen += sprintf(*dst + *dlen, "&amp;"); break;
case '<': *dlen += sprintf(*dst + *dlen, "&lt;"); break;
case '>': *dlen += sprintf(*dst + *dlen, "&gt;"); break;
case '"': *dlen += sprintf(*dst + *dlen, (a) ? "&quot;" : "\""); break;
case '\n': *dlen += sprintf(*dst + *dlen, (a) ? "&#xA;" : "\n"); break;
case '\t': *dlen += sprintf(*dst + *dlen, (a) ? "&#x9;" : "\t"); break;
case '\r': *dlen += sprintf(*dst + *dlen, "&#xD;"); break;
default: (*dst)[(*dlen)++] = *s;
}
}
return *dst;
}
/* Recursively converts each tag to xml appending it to *s. Reallocates *s if*/
/* its length excedes max. start is the location of the previous tag in the*/
/* parent tag's character content. Returns *s.*/
char *ezxml_toxml_r(ezxml_t xml, char **s, size_t *len, size_t *max,
size_t start, char ***attr)
{
int i, j;
char *txt = (xml->parent) ? xml->parent->txt : "";
size_t off = 0;
/* parent character content up to this tag*/
*s = ezxml_ampencode(txt + start, xml->off - start, s, len, max, 0);
while (*len + strlen(xml->name) + 4 > *max) /* reallocate s*/
*s = realloc(*s, *max += EZXML_BUFSIZE);
*len += sprintf(*s + *len, "<%s", xml->name); /* open tag*/
for (i = 0; xml->attr[i]; i += 2) { /* tag attributes*/
if (ezxml_attr(xml, xml->attr[i]) != xml->attr[i + 1]) continue;
while (*len + strlen(xml->attr[i]) + 7 > *max) /* reallocate s*/
*s = realloc(*s, *max += EZXML_BUFSIZE);
*len += sprintf(*s + *len, " %s=\"", xml->attr[i]);
ezxml_ampencode(xml->attr[i + 1], -1, s, len, max, 1);
*len += sprintf(*s + *len, "\"");
}
for (i = 0; attr[i] && strcmp(attr[i][0], xml->name); i++);
for (j = 1; attr[i] && attr[i][j]; j += 3) { /* default attributes*/
if (! attr[i][j + 1] || ezxml_attr(xml, attr[i][j]) != attr[i][j + 1])
continue; /* skip duplicates and non-values*/
while (*len + strlen(attr[i][j]) + 7 > *max) /* reallocate s*/
*s = realloc(*s, *max += EZXML_BUFSIZE);
*len += sprintf(*s + *len, " %s=\"", attr[i][j]);
ezxml_ampencode(attr[i][j + 1], -1, s, len, max, 1);
*len += sprintf(*s + *len, "\"");
}
*len += sprintf(*s + *len, ">");
*s = (xml->child) ? ezxml_toxml_r(xml->child, s, len, max, 0, attr) /*child*/
: ezxml_ampencode(xml->txt, -1, s, len, max, 0); /*data*/
while (*len + strlen(xml->name) + 4 > *max) /* reallocate s*/
*s = realloc(*s, *max += EZXML_BUFSIZE);
*len += sprintf(*s + *len, "</%s>", xml->name); /* close tag*/
while (txt[off] && off < xml->off) off++; /* make sure off is within bounds*/
return (xml->ordered) ? ezxml_toxml_r(xml->ordered, s, len, max, off, attr)
: ezxml_ampencode(txt + off, -1, s, len, max, 0);
}
/* Converts an ezxml structure back to xml. Returns a string of xml data that*/
/* must be freed.*/
char *ezxml_toxml(ezxml_t xml)
{
ezxml_t p = (xml) ? xml->parent : NULL, o = (xml) ? xml->ordered : NULL;
ezxml_root_t root = (ezxml_root_t)xml;
size_t len = 0, max = EZXML_BUFSIZE;
char *s = malloc(max), *t, *n; // bug#23 / CVE-2021-26220
int i, j, k;
if (!s) return (NULL);// bug#23 / CVE-2021-26220
s = strcpy(s, "");// bug#23 / CVE-2021-26220
if (! xml || ! xml->name) return realloc(s, len + 1);
while (root->xml.parent) root = (ezxml_root_t)root->xml.parent; /* root tag*/
for (i = 0; ! p && root->pi[i]; i++) { /* pre-root processing instructions*/
for (k = 2; root->pi[i][k - 1]; k++);
for (j = 1; (n = root->pi[i][j]); j++) {
if (root->pi[i][k][j - 1] == '>') continue; /* not pre-root*/
while (len + strlen(t = root->pi[i][0]) + strlen(n) + 7 > max)
s = realloc(s, max += EZXML_BUFSIZE);
len += sprintf(s + len, "<?%s%s%s?>\n", t, *n ? " " : "", n);
}
}
xml->parent = xml->ordered = NULL;
s = ezxml_toxml_r(xml, &s, &len, &max, 0, root->attr);
xml->parent = p;
xml->ordered = o;
for (i = 0; ! p && root->pi[i]; i++) { /* post-root processing instructions*/
for (k = 2; root->pi[i][k - 1]; k++);
for (j = 1; (n = root->pi[i][j]); j++) {
if (root->pi[i][k][j - 1] == '<') continue; /* not post-root*/
while (len + strlen(t = root->pi[i][0]) + strlen(n) + 7 > max)
s = realloc(s, max += EZXML_BUFSIZE);
len += sprintf(s + len, "\n<?%s%s%s?>", t, *n ? " " : "", n);
}
}
return realloc(s, len + 1);
}
/* free the memory allocated for the ezxml structure*/
void ezxml_free(ezxml_t xml)
{
ezxml_root_t root = (ezxml_root_t)xml;
int i, j;
char **a, *s;
if (! xml) return;
ezxml_free(xml->child);
ezxml_free(xml->ordered);
if (! xml->parent) { /* free root tag allocations*/
for (i = 10; root->ent[i]; i += 2) /* 0 - 9 are default entites (<>&"')*/
if ((s = root->ent[i + 1]) < root->s || s > root->e) free(s);
free(root->ent); /* free list of general entities*/
for (i = 0; (a = root->attr[i]); i++) {
for (j = 1; a[j++]; j += 2) /* free malloced attribute values*/
if (a[j] && (a[j] < root->s || a[j] > root->e)) free(a[j]);
free(a);
}
if (root->attr[0]) free(root->attr); /* free default attribute list*/
for (i = 0; root->pi[i]; i++) {
for (j = 1; root->pi[i][j]; j++);
free(root->pi[i][j + 1]);
free(root->pi[i]);
}
if (root->pi[0]) free(root->pi); /* free processing instructions*/
if (root->len == -1) free(root->m); /* malloced xml data*/
#ifndef EZXML_NOMMAP
else if (root->len) munmap(root->m, root->len); /* mem mapped xml data*/
#endif /* EZXML_NOMMAP*/
if (root->u) free(root->u); /* utf8 conversion*/
}
ezxml_free_attr(xml->attr); /* tag attributes*/
if ((xml->flags & EZXML_TXTM)) free(xml->txt); /* character content*/
if ((xml->flags & EZXML_NAMEM)) free(xml->name); /* tag name*/
free(xml);
}
/* return parser error message or empty string if none*/
const char *ezxml_error(ezxml_t xml)
{
while (xml && xml->parent) xml = xml->parent; /* find root tag*/
return (xml) ? ((ezxml_root_t)xml)->err : "";
}
/* returns a new empty ezxml structure with the given root tag name*/
ezxml_t ezxml_new(const char *name)
{
static char *ent[] = { "lt;", "&#60;", "gt;", "&#62;", "quot;", "&#34;",
"apos;", "&#39;", "amp;", "&#38;", NULL };
ezxml_root_t root = NULL;
/* Bug CVE-2021-26222 */
char **p_ent;
if (!(root = calloc(1,sizeof(struct ezxml_root)))) return NULL; // bug#21 / CVE-2021-26221
memset(root, '\0', sizeof(struct ezxml_root));
/* Bug CVE-2021-26222 */
if (!(p_ent = calloc(1,sizeof(ent)))) { free(root); return NULL; };
root->xml.name = (char *)name;
root->cur = &root->xml;
strcpy(root->err, root->xml.txt = "");
/* Bug CVE-2021-26222 */
root->ent = memcpy(p_ent, ent, sizeof(ent));
root->attr = root->pi = (char ***)(root->xml.attr = (char**)EZXML_NIL);
return &root->xml;
}
/* inserts an existing tag into an ezxml structure*/
ezxml_t ezxml_insert(ezxml_t xml, ezxml_t dest, size_t off)
{
ezxml_t cur, prev, head;
xml->next = xml->sibling = xml->ordered = NULL;
xml->off = off;
xml->parent = dest;
if ((head = dest->child)) { /* already have sub tags*/
if (head->off <= off) { /* not first subtag*/
for (cur = head; cur->ordered && cur->ordered->off <= off;
cur = cur->ordered);
xml->ordered = cur->ordered;
cur->ordered = xml;
}
else { /* first subtag*/
xml->ordered = head;
dest->child = xml;
}
for (cur = head, prev = NULL; cur && strcmp(cur->name, xml->name);
prev = cur, cur = cur->sibling); /* find tag type*/
if (cur && cur->off <= off) { /* not first of type*/
while (cur->next && cur->next->off <= off) cur = cur->next;
xml->next = cur->next;
cur->next = xml;
}
else { /* first tag of this type*/
if (prev && cur) prev->sibling = cur->sibling; /* remove old first*/
xml->next = cur; /* old first tag is now next*/
for (cur = head, prev = NULL; cur && cur->off <= off;
prev = cur, cur = cur->sibling); /* new sibling insert point*/
xml->sibling = cur;
if (prev) prev->sibling = xml;
}
}
else dest->child = xml; /* only sub tag*/
return xml;
}
/* Adds a child tag. off is the offset of the child tag relative to the start*/
/* of the parent tag's character content. Returns the child tag.*/
ezxml_t ezxml_add_child(ezxml_t xml, const char *name, size_t off)
{
ezxml_t child;
if (! xml) return NULL;
child = (ezxml_t)memset(malloc(sizeof(struct ezxml)), '\0',
sizeof(struct ezxml));
child->name = (char *)name;
child->attr = (char**)EZXML_NIL;
child->txt = "";
return ezxml_insert(child, xml, off);
}
/* sets the character content for the given tag and returns the tag*/
ezxml_t ezxml_set_txt(ezxml_t xml, const char *txt)
{
if (! xml) return NULL;
if (xml->flags & EZXML_TXTM) free(xml->txt); /* existing txt was malloced*/
xml->flags &= ~EZXML_TXTM;
xml->txt = (char *)txt;
return xml;
}
/* Sets the given tag attribute or adds a new attribute if not found. A value*/
/* of NULL will remove the specified attribute. Returns the tag given.*/
ezxml_t ezxml_set_attr(ezxml_t xml, const char *name, const char *value)
{
int l = 0, c;
if (! xml) return NULL;
while (xml->attr[l] && strcmp(xml->attr[l], name)) l += 2;
if (! xml->attr[l]) { /* not found, add as new attribute*/
if (! value) return xml; /* nothing to do*/
if (xml->attr == EZXML_NIL) { /* first attribute*/
xml->attr = malloc(4 * sizeof(char *));
xml->attr[1] = strdup(""); /* empty list of malloced names/vals*/
}
else xml->attr = realloc(xml->attr, (l + 4) * sizeof(char *));
xml->attr[l] = (char *)name; /* set attribute name*/
xml->attr[l + 2] = NULL; /* null terminate attribute list*/
xml->attr[l + 3] = realloc(xml->attr[l + 1],
(c = strlen(xml->attr[l + 1])) + 2);
strcpy(xml->attr[l + 3] + c, " "); /* set name/value as not malloced*/
if (xml->flags & EZXML_DUP) xml->attr[l + 3][c] = EZXML_NAMEM;
}
else if (xml->flags & EZXML_DUP) free((char *)name); /* name was strduped*/
for (c = l; xml->attr[c]; c += 2); /* find end of attribute list*/
if (xml->attr[c + 1][l / 2] & EZXML_TXTM) free(xml->attr[l + 1]); /*old val*/
if (xml->flags & EZXML_DUP) xml->attr[c + 1][l / 2] |= EZXML_TXTM;
else xml->attr[c + 1][l / 2] &= ~EZXML_TXTM;
if (value) xml->attr[l + 1] = (char *)value; /* set attribute value*/
else { /* remove attribute*/
if (xml->attr[c + 1][l / 2] & EZXML_NAMEM) free(xml->attr[l]);
memmove(xml->attr + l, xml->attr + l + 2, (c - l + 2) * sizeof(char*));
xml->attr = realloc(xml->attr, (c + 2) * sizeof(char *));
memmove(xml->attr[c + 1] + (l / 2), xml->attr[c + 1] + (l / 2) + 1,
(c / 2) - (l / 2)); /* fix list of which name/vals are malloced*/
}
xml->flags &= ~EZXML_DUP; /* clear strdup() flag*/
return xml;
}
/* sets a flag for the given tag and returns the tag*/
ezxml_t ezxml_set_flag(ezxml_t xml, short flag)
{
if (xml) xml->flags |= flag;
return xml;
}
/* removes a tag along with its subtags without freeing its memory*/
ezxml_t ezxml_cut(ezxml_t xml)
{
ezxml_t cur;
if (! xml) return NULL; /* nothing to do*/
if (xml->next) xml->next->sibling = xml->sibling; /* patch sibling list*/
if (xml->parent) { /* not root tag*/
cur = xml->parent->child; /* find head of subtag list*/
if (cur == xml) xml->parent->child = xml->ordered; /* first subtag*/
else { /* not first subtag*/
while (cur->ordered != xml) cur = cur->ordered;
cur->ordered = cur->ordered->ordered; /* patch ordered list*/
cur = xml->parent->child; /* go back to head of subtag list*/
if (strcmp(cur->name, xml->name)) { /* not in first sibling list*/
while (strcmp(cur->sibling->name, xml->name))
cur = cur->sibling;
if (cur->sibling == xml) { /* first of a sibling list*/
cur->sibling = (xml->next) ? xml->next
: cur->sibling->sibling;
}
else cur = cur->sibling; /* not first of a sibling list*/
}
while (cur->next && cur->next != xml) cur = cur->next;
if (cur->next) cur->next = cur->next->next; /* patch next list*/
}
}
xml->ordered = xml->sibling = xml->next = NULL;
return xml;
}
#ifdef EZXML_TEST /* test harness*/
int main(int argc, char **argv)
{
ezxml_t xml;
char *s;
int i;
if (argc != 2) return fprintf(stderr, "usage: %s xmlfile\n", argv[0]);
xml = ezxml_parse_file(argv[1]);
s = ezxml_toxml(xml);
if (s) {
printf("%s\n", s);
free(s);
} // bug#23 / CVE-2021-26220
i = fprintf(stderr, "%s", ezxml_error(xml));
ezxml_free(xml);
return (i) ? 1 : 0;
}
#endif /* EZXML_TEST*/
Reference in New Issue View Git Blame Copy Permalink