Loading...
--- xnu/xnu-3248.50.21/libkern/c++/OSUnserializeXML.cpp
+++ xnu/xnu-4570.71.2/libkern/c++/OSUnserializeXML.cpp
@@ -159,7 +159,8 @@
#include <libkern/c++/OSContainers.h>
#include <libkern/c++/OSLib.h>
-#define MAX_OBJECTS 65535
+#define MAX_OBJECTS 131071
+#define MAX_REFED_OBJECTS 65535
#define YYSTYPE object_t *
#define YYPARSE_PARAM state
@@ -192,6 +193,7 @@
OSString **errorString; // parse error with line
OSObject *parsedObject; // resultant object of parsed text
int parsedObjectCount;
+ int retrievedObjectCount;
} parser_state_t;
#define STATE ((parser_state_t *)state)
@@ -553,10 +555,10 @@
/* YYRLINE[YYN] -- source line where rule number YYN was defined. */
static const yytype_uint16 yyrline[] =
{
- 0, 149, 149, 152, 157, 162, 170, 178, 186, 194,
- 202, 210, 218, 237, 240, 243, 246, 247, 262, 271,
- 283, 286, 289, 292, 295, 298, 301, 304, 311, 314,
- 317, 320, 323
+ 0, 149, 149, 152, 157, 162, 174, 186, 198, 210,
+ 222, 234, 246, 265, 268, 271, 274, 275, 290, 299,
+ 311, 314, 317, 320, 323, 326, 329, 332, 339, 342,
+ 345, 348, 351
};
#endif
@@ -935,7 +937,7 @@
/* YYINITDEPTH -- initial size of the parser's stacks. */
#ifndef YYINITDEPTH
-# define YYINITDEPTH 200
+# define YYINITDEPTH 64
#endif
/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
@@ -1523,6 +1525,10 @@
#line 162 "OSUnserializeXML.y"
{ (yyval) = buildDictionary(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildDictionary");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1532,9 +1538,13 @@
break;
case 6:
-#line 170 "OSUnserializeXML.y"
+#line 174 "OSUnserializeXML.y"
{ (yyval) = buildArray(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildArray");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1544,9 +1554,13 @@
break;
case 7:
-#line 178 "OSUnserializeXML.y"
+#line 186 "OSUnserializeXML.y"
{ (yyval) = buildSet(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildSet");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1556,9 +1570,13 @@
break;
case 8:
-#line 186 "OSUnserializeXML.y"
+#line 198 "OSUnserializeXML.y"
{ (yyval) = buildString(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildString");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1568,9 +1586,13 @@
break;
case 9:
-#line 194 "OSUnserializeXML.y"
+#line 210 "OSUnserializeXML.y"
{ (yyval) = buildData(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildData");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1580,9 +1602,13 @@
break;
case 10:
-#line 202 "OSUnserializeXML.y"
+#line 222 "OSUnserializeXML.y"
{ (yyval) = buildNumber(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildNumber");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1592,9 +1618,13 @@
break;
case 11:
-#line 210 "OSUnserializeXML.y"
+#line 234 "OSUnserializeXML.y"
{ (yyval) = buildBoolean(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildBoolean");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1604,9 +1634,14 @@
break;
case 12:
-#line 218 "OSUnserializeXML.y"
+#line 246 "OSUnserializeXML.y"
{ (yyval) = retrieveObject(STATE, (yyvsp[(1) - (1)])->idref);
if ((yyval)) {
+ STATE->retrievedObjectCount++;
+ if (STATE->retrievedObjectCount > MAX_REFED_OBJECTS) {
+ yyerror("maximum object reference count");
+ YYERROR;
+ }
(yyval)->object->retain();
} else {
yyerror("forward reference detected");
@@ -1623,21 +1658,21 @@
break;
case 13:
-#line 237 "OSUnserializeXML.y"
+#line 265 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->elements = NULL;
;}
break;
case 14:
-#line 240 "OSUnserializeXML.y"
+#line 268 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (3)]);
(yyval)->elements = (yyvsp[(2) - (3)]);
;}
break;
case 17:
-#line 247 "OSUnserializeXML.y"
+#line 275 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(2) - (2)]);
(yyval)->next = (yyvsp[(1) - (2)]);
@@ -1654,7 +1689,7 @@
break;
case 18:
-#line 262 "OSUnserializeXML.y"
+#line 290 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->key = (OSSymbol *)(yyval)->object;
(yyval)->object = (yyvsp[(2) - (2)])->object;
@@ -1665,7 +1700,7 @@
break;
case 19:
-#line 271 "OSUnserializeXML.y"
+#line 299 "OSUnserializeXML.y"
{ (yyval) = buildSymbol(STATE, (yyvsp[(1) - (1)]));
// STATE->parsedObjectCount++;
@@ -1677,42 +1712,42 @@
break;
case 20:
-#line 283 "OSUnserializeXML.y"
+#line 311 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->elements = NULL;
;}
break;
case 21:
-#line 286 "OSUnserializeXML.y"
+#line 314 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (3)]);
(yyval)->elements = (yyvsp[(2) - (3)]);
;}
break;
case 23:
-#line 292 "OSUnserializeXML.y"
+#line 320 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->elements = NULL;
;}
break;
case 24:
-#line 295 "OSUnserializeXML.y"
+#line 323 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (3)]);
(yyval)->elements = (yyvsp[(2) - (3)]);
;}
break;
case 26:
-#line 301 "OSUnserializeXML.y"
+#line 329 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (1)]);
(yyval)->next = NULL;
;}
break;
case 27:
-#line 304 "OSUnserializeXML.y"
+#line 332 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(2) - (2)]);
(yyval)->next = (yyvsp[(1) - (2)]);
;}
@@ -1720,7 +1755,7 @@
/* Line 1267 of yacc.c. */
-#line 1671 "OSUnserializeXML.tab.c"
+#line 1699 "OSUnserializeXML.tab.c"
default: break;
}
YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -1934,7 +1969,7 @@
}
-#line 326 "OSUnserializeXML.y"
+#line 354 "OSUnserializeXML.y"
int
@@ -2017,6 +2052,7 @@
if (c == '\n') state->lineNumber++;
if (c != '?') continue;
c = nextChar();
+ if (!c) return TAG_IGNORE;
if (c == '>') {
(void)nextChar();
return TAG_IGNORE;
@@ -2071,6 +2107,7 @@
values[*attributeCount][length++] = c;
if (length >= (TAG_MAX_LENGTH - 1)) return TAG_BAD;
c = nextChar();
+ if (!c) return TAG_BAD;
}
values[*attributeCount][length] = 0;
@@ -2740,7 +2777,7 @@
{
OSSymbol *symbol;
- symbol = (OSSymbol *)OSSymbol::withCString(o->string);
+ symbol = const_cast<OSSymbol *>(OSSymbol::withCString(o->string));
if (o->idref >= 0) rememberObject(state, o->idref, symbol);
free(o->string);
@@ -2808,6 +2845,7 @@
state->errorString = errorString;
state->parsedObject = 0;
state->parsedObjectCount = 0;
+ state->retrievedObjectCount = 0;
(void)yyparse((void *)state);