[XERCESJ-1280] XML Schema: XPath parser gets stuck in infinite loop for some invalid XPath expressions

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.9.1
• Fix Version/s: 2.10.0
• Component/s: XML Schema 1.0 Structures
• Assignee: Michael Glavassevich
• Reporter: Michael Glavassevich
• Created: 15/Nov/07 04:28
• Updated: 22/Nov/09 18:18
• Resolved: 15/Nov/07 04:57

Description

Xerces' schema loader hangs in the XPath parser while attempting to process the following invalid schema:

<?xml version="1.0" encoding="UTF-8"?>
<schema xmlns="http://www.w3.org/2001/XMLSchema">
<complexType name="NewComplexType">
<sequence>
<element name="NewElement" type="string">
<key name="abc">
<selector xpath="\"></selector>
</key>
</element>
</sequence>
</complexType>
</schema>

There's a large case block in the XPath scanner which is missing a "default:" which causes it to loop forever on the same character in the invalid expression without ever progressing to the next character in the string (or breaking out of the loop if it's at the end of the string).

See https://bugs.eclipse.org/bugs/show_bug.cgi?id=209733 where this bug was first reported.