diff options
| author | Katie Hockman <katie@golang.org> | 2021-03-01 09:54:00 -0500 |
|---|---|---|
| committer | Filippo Valsorda <filippo@golang.org> | 2021-03-10 18:19:03 +0000 |
| commit | d0b79e3513a29628f3599dc8860666b6eed75372 (patch) | |
| tree | 460190eb75902eeef668a9d36fb035e369998844 /src/encoding/xml/xml.go | |
| parent | cd3b4ca9f20fd14187ed4cdfdee1a02ea87e5cd8 (diff) | |
| download | go-d0b79e3513a29628f3599dc8860666b6eed75372.tar.xz | |
encoding/xml: prevent infinite loop while decoding
This change properly handles a TokenReader which
returns an EOF in the middle of an open XML
element.
Thanks to Sam Whited for reporting this.
Fixes CVE-2021-27918
Fixes #44913
Change-Id: Id02a3f3def4a1b415fa2d9a8e3b373eb6cb0f433
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1004594
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Filippo Valsorda <valsorda@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/300391
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Alexander Rakoczy <alex@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Diffstat (limited to 'src/encoding/xml/xml.go')
| -rw-r--r-- | src/encoding/xml/xml.go | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/src/encoding/xml/xml.go b/src/encoding/xml/xml.go index adaf4daf19..6f9594d7ba 100644 --- a/src/encoding/xml/xml.go +++ b/src/encoding/xml/xml.go @@ -271,7 +271,7 @@ func NewTokenDecoder(t TokenReader) *Decoder { // it will return an error. // // Token implements XML name spaces as described by -// https://www.w3.org/TR/REC-xml-names/. Each of the +// https://www.w3.org/TR/REC-xml-names/. Each of the // Name structures contained in the Token has the Space // set to the URL identifying its name space when known. // If Token encounters an unrecognized name space prefix, @@ -285,16 +285,17 @@ func (d *Decoder) Token() (Token, error) { if d.nextToken != nil { t = d.nextToken d.nextToken = nil - } else if t, err = d.rawToken(); err != nil { - switch { - case err == io.EOF && d.t != nil: - err = nil - case err == io.EOF && d.stk != nil && d.stk.kind != stkEOF: - err = d.syntaxError("unexpected EOF") + } else { + if t, err = d.rawToken(); t == nil && err != nil { + if err == io.EOF && d.stk != nil && d.stk.kind != stkEOF { + err = d.syntaxError("unexpected EOF") + } + return nil, err } - return t, err + // We still have a token to process, so clear any + // errors (e.g. EOF) and proceed. + err = nil } - if !d.Strict { if t1, ok := d.autoClose(t); ok { d.nextToken = t |