[#XERCESC-1051] Crash when maxOccurs >= 200000

Xerces-C++

Crash when maxOccurs >= 200000

Created: 14/Nov/03 06:32 PM Updated: 10/Jul/09 01:13 PM

Return to search

Component/s:

Validating Parser (XML Schema)

Affects Version/s:

2.3.0

Fix Version/s:

3.0.0

Time Tracking:

Not Specified

Environment:

« Hide

Operating System: Windows NT/2K
Platform: PC

Bugzilla Id:	24703
Resolution Date:	13/Jul/08 08:02 PM

Description

« Hide

Parser crashes in ContentSpecNode.hpp: ContentSpecNode::~ContentSpecNode().

Steps to reproduce:
validate a xml file against a schema with an element having a maxOccurs >=
200000.

Assumed cause:
Stack overfow

Makeshift resolution:
Set the repeat count to unbounded(-1), when maxOccurs > 500:

inline void ContentSpecNode::setMaxOccurs(int max)
{
    if(max > 500)
        max = -1;
    fMaxOccurs = max;
}

All

Comments

Work Log

Change History

Subversion Commits

Sort Order:

Repository	Revision	Date	User	Message
ASF	#676426	Sun Jul 13 20:01:22 UTC 2008	amassari	Backported fix for ~~XERCESJ-773~~: build a representation of large minOccurs/maxOccurs in constant time and memory (which uses a counter during validation) for element and wildcard particles when each model group particle in the content model: * has minOccurs/maxOccurs == 1; or * contains only one element/wildcard particle with minOccurs/maxOccurs == 1 (~~XERCESC-1051~~)
				Files Changed
				MODIFY /xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp ADD /xerces/c/trunk/src/xercesc/validators/common/CMRepeatingLeaf.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/AllContentModel.cpp MODIFY /xerces/c/trunk/projects/Win32/VC8/xerces-all/XercesLib/XercesLib.vcproj MODIFY /xerces/c/trunk/projects/Win32/VC9/xerces-all/XercesLib/XercesLib.vcproj MODIFY /xerces/c/trunk/src/xercesc/validators/schema/ComplexTypeInfo.hpp MODIFY /xerces/c/trunk/projects/Win32/VC7.1/xerces-all/XercesLib/XercesLib.vcproj MODIFY /xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMLeaf.hpp MODIFY /xerces/c/trunk/tests/src/XSTSHarness/XSTSHarnessHandlers.cpp MODIFY /xerces/c/trunk/src/Makefile.am MODIFY /xerces/c/trunk/projects/Win32/VC6/xerces-all/XercesLib/XercesLib.dsp MODIFY /xerces/c/trunk/src/xercesc/validators/common/ContentSpecNode.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/schema/ComplexTypeInfo.cpp

Repository	Revision	Date	User	Message
ASF	#677396	Wed Jul 16 19:36:20 UTC 2008	amassari	- Build a compact tree also for xsd:any nodes (~~XERCESC-1051~~) - Reduce the memory required to build a DFA by creating a shallow CMNode hierarchy - Avoid stack overflow when analyzing non-compact model trees - Optimized the building of the DFA state table by avoiding linear searches
				Files Changed
				MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMRepeatingLeaf.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMAny.cpp MODIFY /xerces/c/trunk/tests/src/XSTSHarness/XSTSHarnessHandlers.cpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMUnaryOp.cpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMAny.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMStateSet.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMUnaryOp.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/schema/ComplexTypeInfo.cpp MODIFY /xerces/c/trunk/tests/src/XSTSHarness/regression/Xerces.testSet MODIFY /xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp ADD /xerces/c/trunk/tests/src/XSTSHarness/regression/XERCESC-1051 MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMBinaryOp.cpp ADD /xerces/c/trunk/tests/src/XSTSHarness/regression/XERCESC-1051/test_valid.xml MODIFY /xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMLeaf.hpp ADD /xerces/c/trunk/tests/src/XSTSHarness/regression/XERCESC-1051/test.xml ADD /xerces/c/trunk/tests/src/XSTSHarness/regression/XERCESC-1051/schema.xsd MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMBinaryOp.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMNode.hpp

Repository	Revision	Date	User	Message
ASF	#807213	Mon Aug 24 13:47:35 UTC 2009	amassari	Improved performance and reduced memory footprint of schema validation involving large maxOccurs: - the CMStateSet uses a sparsely allocated matrix to store the bits, resulting in less memory usage and faster bitwise operations (when analyzing an unallocated chunk, no operations are done); also, having moved the dynamic buffer data members into a separate structure, the space used by two pointers has been added to the cached bit fields, that is now 128 bits - the DFA builder chooses the faster algorithm depending on the data being analyzed. The regression test for ~~XERCESC-1051~~ now completes in 30 seconds instead of 80
				Files Changed
				MODIFY /xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp MODIFY /xerces/c/trunk/src/xercesc/util/XMLString.hpp MODIFY /xerces/c/trunk/src/xercesc/validators/common/CMStateSet.hpp MODIFY /xerces/c/trunk/tests/src/DOM/DOMTest/DTest.cpp