tidy/CVE-2021-33391.patch
2023-12-28 11:21:35 +08:00

64 lines
2.2 KiB
Diff

Origin: https://launchpadlibrarian.net/697070499/tidy-html5_2%3A5.6.0-11_2%3A5.6.0-11ubuntu0.20.04.1.diff.gz
Backport of:
From efa61528aa500a1efbd2768121820742d3bb709b Mon Sep 17 00:00:00 2001
From: Jim Derry <balthisar@gmail.com>
Date: Sat, 31 Jul 2021 08:26:16 -0400
Subject: [PATCH] Fixes #946 by refactoring the recursion into a loop with a
heap-based stack.
---
.../cases/github-cases/case-946.conf | 3 +
.../cases/github-cases/case-946@1.html | Bin 0 -> 11558 bytes
.../cases/github-expects/case-946.html | 44 +++
.../cases/github-expects/case-946.txt | 330 ++++++++++++++++++
src/gdoc.c | 13 +-
version.txt | 4 +-
6 files changed, 388 insertions(+), 6 deletions(-)
create mode 100755 regression_testing/cases/github-cases/case-946.conf
create mode 100644 regression_testing/cases/github-cases/case-946@1.html
create mode 100644 regression_testing/cases/github-expects/case-946.html
create mode 100644 regression_testing/cases/github-expects/case-946.txt
diff --git a/src/gdoc.c b/src/gdoc.c
index 50cd9bc33..8f5f8ffd7 100644
--- a/src/gdoc.c
+++ b/src/gdoc.c
@@ -96,14 +96,15 @@ static void DiscardContainer( TidyDocImpl* doc, Node *element, Node **pnode)
static void CleanNode( TidyDocImpl* doc, Node *node )
{
+ Stack *stack = TY_(newStack)(doc, 16);
Node *child, *next;
- if (node->content)
+ if ( (child = node->content) )
{
- for (child = node->content; child != NULL; child = next)
+ while (child)
{
next = child->next;
-
+
if (TY_(nodeIsElement)(child))
{
if (nodeIsSTYLE(child))
@@ -131,10 +132,14 @@ static void CleanNode( TidyDocImpl* doc, Node *node )
if (child->attributes)
TY_(DropAttrByName)( doc, child, "class" );
- CleanNode(doc, child);
+ TY_(push)(stack,next);
+ child = child->content;
+ continue;
}
}
+ child = next ? next : TY_(pop)(stack);
}
+ TY_(freeStack)(stack);
}
}