Loading...
--- xnu/xnu-3248.50.21/libkern/c++/OSUnserializeXML.cpp
+++ xnu/xnu-4903.221.2/libkern/c++/OSUnserializeXML.cpp
@@ -159,7 +159,8 @@
#include <libkern/c++/OSContainers.h>
#include <libkern/c++/OSLib.h>
-#define MAX_OBJECTS 65535
+#define MAX_OBJECTS 131071
+#define MAX_REFED_OBJECTS 65535
#define YYSTYPE object_t *
#define YYPARSE_PARAM state
@@ -192,6 +193,7 @@
OSString **errorString; // parse error with line
OSObject *parsedObject; // resultant object of parsed text
int parsedObjectCount;
+ int retrievedObjectCount;
} parser_state_t;
#define STATE ((parser_state_t *)state)
@@ -217,12 +219,7 @@
static object_t *buildNumber(parser_state_t *state, object_t *o);
static object_t *buildBoolean(parser_state_t *state, object_t *o);
-extern "C" {
-extern void *kern_os_malloc(size_t size);
-extern void *kern_os_realloc(void * addr, size_t size);
-extern void kern_os_free(void * addr);
-
-} /* extern "C" */
+#include <libkern/OSRuntime.h>
#define malloc(s) kern_os_malloc(s)
#define realloc(a, s) kern_os_realloc(a, s)
@@ -553,10 +550,10 @@
/* YYRLINE[YYN] -- source line where rule number YYN was defined. */
static const yytype_uint16 yyrline[] =
{
- 0, 149, 149, 152, 157, 162, 170, 178, 186, 194,
- 202, 210, 218, 237, 240, 243, 246, 247, 262, 271,
- 283, 286, 289, 292, 295, 298, 301, 304, 311, 314,
- 317, 320, 323
+ 0, 149, 149, 152, 157, 162, 174, 186, 198, 210,
+ 222, 234, 246, 265, 268, 271, 274, 275, 290, 299,
+ 311, 314, 317, 320, 323, 326, 329, 332, 339, 342,
+ 345, 348, 351
};
#endif
@@ -935,7 +932,7 @@
/* YYINITDEPTH -- initial size of the parser's stacks. */
#ifndef YYINITDEPTH
-# define YYINITDEPTH 200
+# define YYINITDEPTH 64
#endif
/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
@@ -1523,6 +1520,10 @@
#line 162 "OSUnserializeXML.y"
{ (yyval) = buildDictionary(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildDictionary");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1532,9 +1533,13 @@
break;
case 6:
-#line 170 "OSUnserializeXML.y"
+#line 174 "OSUnserializeXML.y"
{ (yyval) = buildArray(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildArray");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1544,9 +1549,13 @@
break;
case 7:
-#line 178 "OSUnserializeXML.y"
+#line 186 "OSUnserializeXML.y"
{ (yyval) = buildSet(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildSet");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1556,9 +1565,13 @@
break;
case 8:
-#line 186 "OSUnserializeXML.y"
+#line 198 "OSUnserializeXML.y"
{ (yyval) = buildString(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildString");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1568,9 +1581,13 @@
break;
case 9:
-#line 194 "OSUnserializeXML.y"
+#line 210 "OSUnserializeXML.y"
{ (yyval) = buildData(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildData");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1580,9 +1597,13 @@
break;
case 10:
-#line 202 "OSUnserializeXML.y"
+#line 222 "OSUnserializeXML.y"
{ (yyval) = buildNumber(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildNumber");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1592,9 +1613,13 @@
break;
case 11:
-#line 210 "OSUnserializeXML.y"
+#line 234 "OSUnserializeXML.y"
{ (yyval) = buildBoolean(STATE, (yyvsp[(1) - (1)]));
+ if (!yyval->object) {
+ yyerror("buildBoolean");
+ YYERROR;
+ }
STATE->parsedObjectCount++;
if (STATE->parsedObjectCount > MAX_OBJECTS) {
yyerror("maximum object count");
@@ -1604,10 +1629,15 @@
break;
case 12:
-#line 218 "OSUnserializeXML.y"
+#line 246 "OSUnserializeXML.y"
{ (yyval) = retrieveObject(STATE, (yyvsp[(1) - (1)])->idref);
if ((yyval)) {
+ STATE->retrievedObjectCount++;
(yyval)->object->retain();
+ if (STATE->retrievedObjectCount > MAX_REFED_OBJECTS) {
+ yyerror("maximum object reference count");
+ YYERROR;
+ }
} else {
yyerror("forward reference detected");
YYERROR;
@@ -1623,21 +1653,21 @@
break;
case 13:
-#line 237 "OSUnserializeXML.y"
+#line 265 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->elements = NULL;
;}
break;
case 14:
-#line 240 "OSUnserializeXML.y"
+#line 268 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (3)]);
(yyval)->elements = (yyvsp[(2) - (3)]);
;}
break;
case 17:
-#line 247 "OSUnserializeXML.y"
+#line 275 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(2) - (2)]);
(yyval)->next = (yyvsp[(1) - (2)]);
@@ -1654,7 +1684,7 @@
break;
case 18:
-#line 262 "OSUnserializeXML.y"
+#line 290 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->key = (OSSymbol *)(yyval)->object;
(yyval)->object = (yyvsp[(2) - (2)])->object;
@@ -1665,7 +1695,7 @@
break;
case 19:
-#line 271 "OSUnserializeXML.y"
+#line 299 "OSUnserializeXML.y"
{ (yyval) = buildSymbol(STATE, (yyvsp[(1) - (1)]));
// STATE->parsedObjectCount++;
@@ -1677,42 +1707,42 @@
break;
case 20:
-#line 283 "OSUnserializeXML.y"
+#line 311 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->elements = NULL;
;}
break;
case 21:
-#line 286 "OSUnserializeXML.y"
+#line 314 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (3)]);
(yyval)->elements = (yyvsp[(2) - (3)]);
;}
break;
case 23:
-#line 292 "OSUnserializeXML.y"
+#line 320 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (2)]);
(yyval)->elements = NULL;
;}
break;
case 24:
-#line 295 "OSUnserializeXML.y"
+#line 323 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (3)]);
(yyval)->elements = (yyvsp[(2) - (3)]);
;}
break;
case 26:
-#line 301 "OSUnserializeXML.y"
+#line 329 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(1) - (1)]);
(yyval)->next = NULL;
;}
break;
case 27:
-#line 304 "OSUnserializeXML.y"
+#line 332 "OSUnserializeXML.y"
{ (yyval) = (yyvsp[(2) - (2)]);
(yyval)->next = (yyvsp[(1) - (2)]);
;}
@@ -1720,7 +1750,7 @@
/* Line 1267 of yacc.c. */
-#line 1671 "OSUnserializeXML.tab.c"
+#line 1699 "OSUnserializeXML.tab.c"
default: break;
}
YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -1934,7 +1964,7 @@
}
-#line 326 "OSUnserializeXML.y"
+#line 354 "OSUnserializeXML.y"
int
@@ -2017,6 +2047,7 @@
if (c == '\n') state->lineNumber++;
if (c != '?') continue;
c = nextChar();
+ if (!c) return TAG_IGNORE;
if (c == '>') {
(void)nextChar();
return TAG_IGNORE;
@@ -2071,6 +2102,7 @@
values[*attributeCount][length++] = c;
if (length >= (TAG_MAX_LENGTH - 1)) return TAG_BAD;
c = nextChar();
+ if (!c) return TAG_BAD;
}
values[*attributeCount][length] = 0;
@@ -2740,7 +2772,7 @@
{
OSSymbol *symbol;
- symbol = (OSSymbol *)OSSymbol::withCString(o->string);
+ symbol = const_cast<OSSymbol *>(OSSymbol::withCString(o->string));
if (o->idref >= 0) rememberObject(state, o->idref, symbol);
free(o->string);
@@ -2808,6 +2840,7 @@
state->errorString = errorString;
state->parsedObject = 0;
state->parsedObjectCount = 0;
+ state->retrievedObjectCount = 0;
(void)yyparse((void *)state);