576368 – htmlChunkParser with special attributes
* HTMLparser.c: htmlChunkParsing failed when the chunk ends inside
element after some attribute which has a '>' char in its value.
diff --git a/HTMLparser.c b/HTMLparser.c
index 5e44d7a..da17efe 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -4521,11 +4521,14 @@
*/
static int
htmlParseLookupSequence(htmlParserCtxtPtr ctxt, xmlChar first,
- xmlChar next, xmlChar third, int iscomment) {
+ xmlChar next, xmlChar third, int iscomment,
+ int ignoreattrval) {
int base, len;
htmlParserInputPtr in;
const xmlChar *buf;
int incomment = 0;
+ int invalue = 0;
+ char valdellim = 0x0;
in = ctxt->input;
if (in == NULL) return(-1);
@@ -4552,6 +4555,22 @@
base += 2;
}
}
+ if (ignoreattrval) {
+ if (buf[base] == '"' || buf[base] == '\'') {
+ if (invalue) {
+ if (buf[base] == valdellim) {
+ invalue = 0;
+ continue;
+ }
+ } else {
+ valdellim = buf[base];
+ invalue = 1;
+ continue;
+ }
+ } else if (invalue) {
+ continue;
+ }
+ }
if (incomment) {
if (base + 3 > len)
return(-1);
@@ -4731,7 +4750,7 @@
(UPP(6) == 'Y') && (UPP(7) == 'P') &&
(UPP(8) == 'E')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4764,7 +4783,7 @@
if ((cur == '<') && (next == '!') &&
(in->cur[2] == '-') && (in->cur[3] == '-')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '-', '-', '>', 1) < 0))
+ (htmlParseLookupSequence(ctxt, '-', '-', '>', 1, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4774,7 +4793,7 @@
ctxt->instate = XML_PARSER_MISC;
} else if ((cur == '<') && (next == '?')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4788,7 +4807,7 @@
(UPP(6) == 'Y') && (UPP(7) == 'P') &&
(UPP(8) == 'E')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4824,7 +4843,7 @@
if ((cur == '<') && (next == '!') &&
(in->cur[2] == '-') && (in->cur[3] == '-')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '-', '-', '>', 1) < 0))
+ (htmlParseLookupSequence(ctxt, '-', '-', '>', 1, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4834,7 +4853,7 @@
ctxt->instate = XML_PARSER_PROLOG;
} else if ((cur == '<') && (next == '?')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4871,7 +4890,7 @@
if ((cur == '<') && (next == '!') &&
(in->cur[2] == '-') && (in->cur[3] == '-')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '-', '-', '>', 1) < 0))
+ (htmlParseLookupSequence(ctxt, '-', '-', '>', 1, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4881,7 +4900,7 @@
ctxt->instate = XML_PARSER_EPILOG;
} else if ((cur == '<') && (next == '?')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -4931,7 +4950,7 @@
break;
}
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
failed = htmlParseStartTag(ctxt);
@@ -5056,7 +5075,7 @@
int idx;
xmlChar val;
- idx = htmlParseLookupSequence(ctxt, '<', '/', 0, 0);
+ idx = htmlParseLookupSequence(ctxt, '<', '/', 0, 0, 1);
if (idx < 0)
goto done;
val = in->cur[idx + 2];
@@ -5083,7 +5102,7 @@
(UPP(6) == 'Y') && (UPP(7) == 'P') &&
(UPP(8) == 'E')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
htmlParseErr(ctxt, XML_HTML_STRUCURE_ERROR,
"Misplaced DOCTYPE declaration\n",
@@ -5093,7 +5112,7 @@
(in->cur[2] == '-') && (in->cur[3] == '-')) {
if ((!terminate) &&
(htmlParseLookupSequence(
- ctxt, '-', '-', '>', 1) < 0))
+ ctxt, '-', '-', '>', 1, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -5103,7 +5122,7 @@
ctxt->instate = XML_PARSER_CONTENT;
} else if ((cur == '<') && (next == '?')) {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -5131,7 +5150,7 @@
break;
} else if (cur == '&') {
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, ';', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, ';', 0, 0, 0, 1) < 0))
goto done;
#ifdef DEBUG_PUSH
xmlGenericError(xmlGenericErrorContext,
@@ -5147,7 +5166,7 @@
* data detection.
*/
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '<', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '<', 0, 0, 0, 1) < 0))
goto done;
ctxt->checkIndex = 0;
#ifdef DEBUG_PUSH
@@ -5173,7 +5192,7 @@
if (avail < 2)
goto done;
if ((!terminate) &&
- (htmlParseLookupSequence(ctxt, '>', 0, 0, 0) < 0))
+ (htmlParseLookupSequence(ctxt, '>', 0, 0, 0, 1) < 0))
goto done;
htmlParseEndTag(ctxt);
if (ctxt->nameNr == 0) {