Allow any number of leading zero in Character Reference

leethomason · Nov 25, 2024 · 016bd05 · 016bd05
1 parent 9b8ea04
commit 016bd05
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 12 deletions.
diff --git a/tinyxml2.cpp b/tinyxml2.cpp
@@ -474,7 +474,7 @@ const char* XMLUtil::GetCharacterRef( const char* p, char* value, int* length )
 
     if ( *(p+1) == '#' && *(p+2) ) {
         unsigned long long ucs = 0;
-        TIXMLASSERT( sizeof( ucs ) >= 4 );
+        TIXMLASSERT( sizeof( ucs ) >= 8 );
         ptrdiff_t delta = 0;
         unsigned long long mult = 1;
         static const char SEMICOLON = ';';
@@ -494,11 +494,6 @@ const char* XMLUtil::GetCharacterRef( const char* p, char* value, int* length )
             TIXMLASSERT( *q == SEMICOLON );
 
             delta = q-p;
-
-            if ( delta > 8 + 3 ) { // allow maximum 8 digits in hex format and '&#x'
-                return 0;
-            }
-
             --q;
 
             while ( *q != 'x' ) {
@@ -519,6 +514,8 @@ const char* XMLUtil::GetCharacterRef( const char* p, char* value, int* length )
                 TIXMLASSERT( digit < 16 );
                 const unsigned long long digitScaled = mult * digit;
                 ucs += digitScaled;
+                if (ucs > ULONG_MAX)
+                    return 0;
                 mult *= 16;
                 --q;
             }
@@ -538,11 +535,6 @@ const char* XMLUtil::GetCharacterRef( const char* p, char* value, int* length )
             TIXMLASSERT( *q == SEMICOLON );
 
             delta = q-p;
-
-            if (delta > 10 + 2) { // allow maximum 10 digits and '&#'
-                return 0;
-            }
-
             --q;
 
             while ( *q != '#' ) {
@@ -551,6 +543,8 @@ const char* XMLUtil::GetCharacterRef( const char* p, char* value, int* length )
                     TIXMLASSERT( digit < 10 );
                     const unsigned long long digitScaled = mult * digit;
                     ucs += digitScaled;
+                    if (ucs > ULONG_MAX)
+                        return 0;
                 }
                 else {
                     return 0;

diff --git a/xmltest.cpp b/xmltest.cpp
@@ -2678,18 +2678,20 @@ int main( int argc, const char ** argv )
     }
 
     {
-    	const char* xml = "<Hello value='&#ABC9000000065;' value2='&#xffffffff;' value3='&#5000000000;' value4='&#x00000045;'>Text</Hello>";
+    	const char* xml = "<Hello value='&#ABC9000000065;' value2='&#xffffffff;' value3='&#5000000000;' value4='&#x00000045;' value5='&#x000000000000000021;'>Text</Hello>";
     	XMLDocument doc;
     	doc.Parse(xml);
     	const char* value = doc.FirstChildElement()->Attribute("value");
     	const char* value2 = doc.FirstChildElement()->Attribute("value2");
     	const char* value3 = doc.FirstChildElement()->Attribute("value3");
     	const char* value4 = doc.FirstChildElement()->Attribute("value4");
+		const char* value5 = doc.FirstChildElement()->Attribute("value5");
     	XMLTest("Test attribute encode", false, doc.Error());
     	XMLTest("Test attribute encode too long value", value, "&#ABC9000000065;"); // test long value
     	XMLTest("Test attribute encode out of unicode range", value2, "&#xffffffff;"); // out of unicode range
     	XMLTest("Test attribute encode out of int max value", value3, "&#5000000000;"); // out of int max value
     	XMLTest("Test attribute encode with a Hex value", value4, "E"); // hex value in unicode value
+		XMLTest("Test attribute encode with a Hex value", value5, "!"); // hex value in unicode value
     }
 
     // ----------- Performance tracking --------------