From 7afb666b26cfb17689e5da98bed610a417083f9d Mon Sep 17 00:00:00 2001

From: David King <amigadave@amigadave.com>

Date: Tue, 3 Jan 2023 09:57:28 +0000

Subject: [PATCH 1/2] Fix CVE-2022-40303

Adapted from https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0

---

 parser.c | 232 +++++++++++++++++++++++++++++--------------------------

 1 file changed, 121 insertions(+), 111 deletions(-)

diff --git a/parser.c b/parser.c

index 1c5e036e..e66e4196 100644

--- a/parser.c

+++ b/parser.c

@@ -108,6 +108,8 @@ static void xmlHaltParser(xmlParserCtxtPtr ctxt);

  *									*

  ************************************************************************/

+#define XML_MAX_HUGE_LENGTH 1000000000

+

 #define XML_PARSER_BIG_ENTITY 1000

 #define XML_PARSER_LOT_ENTITY 5000

@@ -532,7 +534,7 @@ xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info)

             errmsg = "Malformed declaration expecting version";

             break;

         case XML_ERR_NAME_TOO_LONG:

-            errmsg = "Name too long use XML_PARSE_HUGE option";

+            errmsg = "Name too long";

             break;

 #if 0

         case:

@@ -3150,6 +3152,9 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {

     int len = 0, l;

     int c;

     int count = 0;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_TEXT_LENGTH :

+                    XML_MAX_NAME_LENGTH;

 #ifdef DEBUG

     nbParseNameComplex++;

@@ -3241,13 +3246,13 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {

                 if (ctxt->instate == XML_PARSER_EOF)

                     return(NULL);

 	    }

-	    len += l;

+            if (len <= INT_MAX - l)

+	        len += l;

 	    NEXTL(l);

 	    c = CUR_CHAR(l);

 	}

     }

-    if ((len > XML_MAX_NAME_LENGTH) &&

-        ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+    if (len > maxLength) {

         xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");

         return(NULL);

     }

@@ -3286,7 +3291,10 @@ const xmlChar *

 xmlParseName(xmlParserCtxtPtr ctxt) {

     const xmlChar *in;

     const xmlChar *ret;

-    int count = 0;

+    size_t count = 0;

+    size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                       XML_MAX_TEXT_LENGTH :

+                       XML_MAX_NAME_LENGTH;

     GROW;

@@ -3310,8 +3318,7 @@ xmlParseName(xmlParserCtxtPtr ctxt) {

 	    in++;

 	if ((*in > 0) && (*in < 0x80)) {

 	    count = in - ctxt->input->cur;

-            if ((count > XML_MAX_NAME_LENGTH) &&

-                ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+            if (count > maxLength) {

                 xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");

                 return(NULL);

             }

@@ -3333,6 +3340,9 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {

     int len = 0, l;

     int c;

     int count = 0;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_TEXT_LENGTH :

+                    XML_MAX_NAME_LENGTH;

     size_t startPosition = 0;

 #ifdef DEBUG

@@ -3353,17 +3363,13 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {

     while ((c != ' ') && (c != '>') && (c != '/') && /* test bigname.xml */

 	   (xmlIsNameChar(ctxt, c) && (c != ':'))) {

 	if (count++ > XML_PARSER_CHUNK_SIZE) {

-            if ((len > XML_MAX_NAME_LENGTH) &&

-                ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");

-                return(NULL);

-            }

 	    count = 0;

 	    GROW;

             if (ctxt->instate == XML_PARSER_EOF)

                 return(NULL);

 	}

-	len += l;

+        if (len <= INT_MAX - l)

+	    len += l;

 	NEXTL(l);

 	c = CUR_CHAR(l);

 	if (c == 0) {

@@ -3381,8 +3387,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {

 	    c = CUR_CHAR(l);

 	}

     }

-    if ((len > XML_MAX_NAME_LENGTH) &&

-        ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+    if (len > maxLength) {

         xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");

         return(NULL);

     }

@@ -3408,7 +3413,10 @@ static const xmlChar *

 xmlParseNCName(xmlParserCtxtPtr ctxt) {

     const xmlChar *in, *e;

     const xmlChar *ret;

-    int count = 0;

+    size_t count = 0;

+    size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                       XML_MAX_TEXT_LENGTH :

+                       XML_MAX_NAME_LENGTH;

 #ifdef DEBUG

     nbParseNCName++;

@@ -3433,8 +3441,7 @@ xmlParseNCName(xmlParserCtxtPtr ctxt) {

 	    goto complex;

 	if ((*in > 0) && (*in < 0x80)) {

 	    count = in - ctxt->input->cur;

-            if ((count > XML_MAX_NAME_LENGTH) &&

-                ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+            if (count > maxLength) {

                 xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");

                 return(NULL);

             }

@@ -3517,6 +3524,9 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {

     const xmlChar *cur = *str;

     int len = 0, l;

     int c;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_TEXT_LENGTH :

+                    XML_MAX_NAME_LENGTH;

 #ifdef DEBUG

     nbParseStringName++;

@@ -3552,12 +3562,6 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {

 		if (len + 10 > max) {

 		    xmlChar *tmp;

-                    if ((len > XML_MAX_NAME_LENGTH) &&

-                        ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");

-			xmlFree(buffer);

-                        return(NULL);

-                    }

 		    max *= 2;

 		    tmp = (xmlChar *) xmlRealloc(buffer,

 			                            max * sizeof(xmlChar));

@@ -3571,14 +3575,18 @@ xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {

 		COPY_BUF(l,buffer,len,c);

 		cur += l;

 		c = CUR_SCHAR(cur, l);

+                if (len > maxLength) {

+                    xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");

+                    xmlFree(buffer);

+                    return(NULL);

+                }

 	    }

 	    buffer[len] = 0;

 	    *str = cur;

 	    return(buffer);

 	}

     }

-    if ((len > XML_MAX_NAME_LENGTH) &&

-        ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+    if (len > maxLength) {

         xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");

         return(NULL);

     }

@@ -3605,6 +3613,9 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {

     int len = 0, l;

     int c;

     int count = 0;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_TEXT_LENGTH :

+                    XML_MAX_NAME_LENGTH;

 #ifdef DEBUG

     nbParseNmToken++;

@@ -3656,12 +3667,6 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {

 		if (len + 10 > max) {

 		    xmlChar *tmp;

-                    if ((max > XML_MAX_NAME_LENGTH) &&

-                        ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken");

-                        xmlFree(buffer);

-                        return(NULL);

-                    }

 		    max *= 2;

 		    tmp = (xmlChar *) xmlRealloc(buffer,

 			                            max * sizeof(xmlChar));

@@ -3675,6 +3680,11 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {

 		COPY_BUF(l,buffer,len,c);

 		NEXTL(l);

 		c = CUR_CHAR(l);

+                if (len > maxLength) {

+                    xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken");

+                    xmlFree(buffer);

+                    return(NULL);

+                }

 	    }

 	    buffer[len] = 0;

 	    return(buffer);

@@ -3682,8 +3692,7 @@ xmlParseNmtoken(xmlParserCtxtPtr ctxt) {

     }

     if (len == 0)

         return(NULL);

-    if ((len > XML_MAX_NAME_LENGTH) &&

-        ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+    if (len > maxLength) {

         xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken");

         return(NULL);

     }

@@ -3709,6 +3718,9 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) {

     int len = 0;

     int size = XML_PARSER_BUFFER_SIZE;

     int c, l;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_HUGE_LENGTH :

+                    XML_MAX_TEXT_LENGTH;

     xmlChar stop;

     xmlChar *ret = NULL;

     const xmlChar *cur = NULL;

@@ -3768,6 +3780,14 @@ xmlParseEntityValue(xmlParserCtxtPtr ctxt, xmlChar **orig) {

 	    GROW;

 	    c = CUR_CHAR(l);

 	}

+

+        if (len > maxLength) {

+            xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_NOT_FINISHED,

+                           "entity value too long\n");

+        if (buf != NULL)

+            xmlFree(buf);

+        return(ret);

+        }

     }

     buf[len] = 0;

     if (ctxt->instate == XML_PARSER_EOF)

@@ -3855,6 +3875,9 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {

     xmlChar *rep = NULL;

     size_t len = 0;

     size_t buf_size = 0;

+    size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                       XML_MAX_HUGE_LENGTH :

+                       XML_MAX_TEXT_LENGTH;

     int c, l, in_space = 0;

     xmlChar *current = NULL;

     xmlEntityPtr ent;

@@ -3886,16 +3909,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {

     while (((NXT(0) != limit) && /* checked */

             (IS_CHAR(c)) && (c != '<')) &&

             (ctxt->instate != XML_PARSER_EOF)) {

-        /*

-         * Impose a reasonable limit on attribute size, unless XML_PARSE_HUGE

-         * special option is given

-         */

-        if ((len > XML_MAX_TEXT_LENGTH) &&

-            ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-            xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

-                           "AttValue length too long\n");

-            goto mem_error;

-        }

 	if (c == 0) break;

 	if (c == '&') {

 	    in_space = 0;

@@ -4041,6 +4054,11 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {

 	}

 	GROW;

 	c = CUR_CHAR(l);

+        if (len > maxLength) {

+            xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

+                           "AttValue length too long\n");

+            goto mem_error;

+        }

     }

     if (ctxt->instate == XML_PARSER_EOF)

         goto error;

@@ -4062,16 +4080,6 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {

     } else

 	NEXT;

-    /*

-     * There we potentially risk an overflow, don't allow attribute value of

-     * length more than INT_MAX it is a very reasonnable assumption !

-     */

-    if (len >= INT_MAX) {

-        xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

-                       "AttValue length too long\n");

-        goto mem_error;

-    }

-

     if (attlen != NULL) *attlen = (int) len;

     return(buf);

@@ -4142,6 +4150,9 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {

     int len = 0;

     int size = XML_PARSER_BUFFER_SIZE;

     int cur, l;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_TEXT_LENGTH :

+                    XML_MAX_NAME_LENGTH;

     xmlChar stop;

     int state = ctxt->instate;

     int count = 0;

@@ -4169,13 +4180,6 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {

 	if (len + 5 >= size) {

 	    xmlChar *tmp;

-            if ((size > XML_MAX_NAME_LENGTH) &&

-                ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "SystemLiteral");

-                xmlFree(buf);

-		ctxt->instate = (xmlParserInputState) state;

-                return(NULL);

-            }

 	    size *= 2;

 	    tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));

 	    if (tmp == NULL) {

@@ -4203,6 +4207,12 @@ xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {

 	    SHRINK;

 	    cur = CUR_CHAR(l);

 	}

+        if (len > maxLength) {

+            xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "SystemLiteral");

+            xmlFree(buf);

+            ctxt->instate = (xmlParserInputState) state;

+            return(NULL);

+        }

     }

     buf[len] = 0;

     ctxt->instate = (xmlParserInputState) state;

@@ -4230,6 +4240,9 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {

     xmlChar *buf = NULL;

     int len = 0;

     int size = XML_PARSER_BUFFER_SIZE;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_TEXT_LENGTH :

+                    XML_MAX_NAME_LENGTH;

     xmlChar cur;

     xmlChar stop;

     int count = 0;

@@ -4257,12 +4270,6 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {

 	if (len + 1 >= size) {

 	    xmlChar *tmp;

-            if ((size > XML_MAX_NAME_LENGTH) &&

-                ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Public ID");

-                xmlFree(buf);

-                return(NULL);

-            }

 	    size *= 2;

 	    tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));

 	    if (tmp == NULL) {

@@ -4289,6 +4296,11 @@ xmlParsePubidLiteral(xmlParserCtxtPtr ctxt) {

 	    SHRINK;

 	    cur = CUR;

 	}

+        if (len > maxLength) {

+            xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Public ID");

+            xmlFree(buf);

+            return(NULL);

+        }

     }

     buf[len] = 0;

     if (cur != stop) {

@@ -4686,6 +4698,9 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,

     int r, rl;

     int cur, l;

     size_t count = 0;

+    size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                       XML_MAX_HUGE_LENGTH :

+                       XML_MAX_TEXT_LENGTH;

     int inputid;

     inputid = ctxt->input->id;

@@ -4731,13 +4746,6 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,

 	if ((r == '-') && (q == '-')) {

 	    xmlFatalErr(ctxt, XML_ERR_HYPHEN_IN_COMMENT, NULL);

 	}

-        if ((len > XML_MAX_TEXT_LENGTH) &&

-            ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-            xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,

-                         "Comment too big found", NULL);

-            xmlFree (buf);

-            return;

-        }

 	if (len + 5 >= size) {

 	    xmlChar *new_buf;

             size_t new_size;

@@ -4774,6 +4782,13 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,

 	    GROW;

 	    cur = CUR_CHAR(l);

 	}

+

+        if (len > maxLength) {

+            xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,

+                         "Comment too big found", NULL);

+            xmlFree (buf);

+            return;

+        }

     }

     buf[len] = 0;

     if (cur == 0) {

@@ -4818,6 +4833,9 @@ xmlParseComment(xmlParserCtxtPtr ctxt) {

     xmlChar *buf = NULL;

     size_t size = XML_PARSER_BUFFER_SIZE;

     size_t len = 0;

+    size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                       XML_MAX_HUGE_LENGTH :

+                       XML_MAX_TEXT_LENGTH;

     xmlParserInputState state;

     const xmlChar *in;

     size_t nbchar = 0;

@@ -4901,8 +4919,7 @@ get_more:

 		buf[len] = 0;

 	    }

 	}

-        if ((len > XML_MAX_TEXT_LENGTH) &&

-            ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+        if (len > maxLength) {

             xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,

                          "Comment too big found", NULL);

             xmlFree (buf);

@@ -5098,6 +5115,9 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {

     xmlChar *buf = NULL;

     size_t len = 0;

     size_t size = XML_PARSER_BUFFER_SIZE;

+    size_t maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                       XML_MAX_HUGE_LENGTH :

+                       XML_MAX_TEXT_LENGTH;

     int cur, l;

     const xmlChar *target;

     xmlParserInputState state;

@@ -5172,14 +5192,6 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {

                         return;

                     }

 		    count = 0;

-                    if ((len > XML_MAX_TEXT_LENGTH) &&

-                        ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                        xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,

-                                          "PI %s too big found", target);

-                        xmlFree(buf);

-                        ctxt->instate = state;

-                        return;

-                    }

 		}

 		COPY_BUF(l,buf,len,cur);

 		NEXTL(l);

@@ -5189,15 +5201,14 @@ xmlParsePI(xmlParserCtxtPtr ctxt) {

 		    GROW;

 		    cur = CUR_CHAR(l);

 		}

+                if (len > maxLength) {

+                    xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,

+                                      "PI %s too big found", target);

+                    xmlFree(buf);

+                    ctxt->instate = state;

+                    return;

+                }

 	    }

-            if ((len > XML_MAX_TEXT_LENGTH) &&

-                ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,

-                                  "PI %s too big found", target);

-                xmlFree(buf);

-                ctxt->instate = state;

-                return;

-            }

 	    buf[len] = 0;

 	    if (cur != '?') {

 		xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,

@@ -8851,6 +8862,9 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,

     const xmlChar *in = NULL, *start, *end, *last;

     xmlChar *ret = NULL;

     int line, col;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_HUGE_LENGTH :

+                    XML_MAX_TEXT_LENGTH;

     GROW;

     in = (xmlChar *) CUR_PTR;

@@ -8906,8 +8920,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,

 		    in = in + delta;

 		}

 		end = ctxt->input->end;

-                if (((in - start) > XML_MAX_TEXT_LENGTH) &&

-                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+                if ((in - start) > maxLength) {

                     xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

                                    "AttValue length too long\n");

                     return(NULL);

@@ -8929,8 +8942,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,

 		    in = in + delta;

 		}

 		end = ctxt->input->end;

-                if (((in - start) > XML_MAX_TEXT_LENGTH) &&

-                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+                if ((in - start) > maxLength) {

                     xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

                                    "AttValue length too long\n");

                     return(NULL);

@@ -8963,16 +8975,14 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,

 		    last = last + delta;

 		}

 		end = ctxt->input->end;

-                if (((in - start) > XML_MAX_TEXT_LENGTH) &&

-                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+                if ((in - start) > maxLength) {

                     xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

                                    "AttValue length too long\n");

                     return(NULL);

                 }

 	    }

 	}

-        if (((in - start) > XML_MAX_TEXT_LENGTH) &&

-            ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+        if ((in - start) > maxLength) {

             xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

                            "AttValue length too long\n");

             return(NULL);

@@ -8994,8 +9004,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,

 		    in = in + delta;

 		}

 		end = ctxt->input->end;

-                if (((in - start) > XML_MAX_TEXT_LENGTH) &&

-                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+                if ((in - start) > maxLength) {

                     xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

                                    "AttValue length too long\n");

                     return(NULL);

@@ -9003,8 +9012,7 @@ xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,

 	    }

 	}

 	last = in;

-        if (((in - start) > XML_MAX_TEXT_LENGTH) &&

-            ((ctxt->options & XML_PARSE_HUGE) == 0)) {

+        if ((in - start) > maxLength) {

             xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,

                            "AttValue length too long\n");

             return(NULL);

@@ -9711,6 +9719,9 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {

     int	s, sl;

     int cur, l;

     int count = 0;

+    int maxLength = (ctxt->options & XML_PARSE_HUGE) ?

+                    XML_MAX_HUGE_LENGTH :

+                    XML_MAX_TEXT_LENGTH;

     /* Check 2.6.0 was NXT(0) not RAW */

     if (CMP9(CUR_PTR, '<', '!', '[', 'C', 'D', 'A', 'T', 'A', '[')) {

@@ -9744,13 +9755,6 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {

 	if (len + 5 >= size) {

 	    xmlChar *tmp;

-            if ((size > XML_MAX_TEXT_LENGTH) &&

-                ((ctxt->options & XML_PARSE_HUGE) == 0)) {

-                xmlFatalErrMsgStr(ctxt, XML_ERR_CDATA_NOT_FINISHED,

-                             "CData section too big found", NULL);

-                xmlFree (buf);

-                return;

-            }

 	    tmp = (xmlChar *) xmlRealloc(buf, size * 2 * sizeof(xmlChar));

 	    if (tmp == NULL) {

 	        xmlFree(buf);

@@ -9776,6 +9780,12 @@ xmlParseCDSect(xmlParserCtxtPtr ctxt) {

 	}

 	NEXTL(l);

 	cur = CUR_CHAR(l);

+        if (len > maxLength) {

+            xmlFatalErrMsg(ctxt, XML_ERR_CDATA_NOT_FINISHED,

+                           "CData section too big found\n");

+            xmlFree(buf);

+            return;

+        }

     }

     buf[len] = 0;

     ctxt->instate = XML_PARSER_CONTENT;

-- 

2.39.0