forked from 1b-agent/opencadstudio-upstream
Karim Jerbi
21c4d6ab41
Bug: Loading a DWFx package recursed twice on untrusted input: 1. roxmltree's tokenizer (parse_element <-> parse_content) recurses once per element nesting level (present in versions 0.20 and 0.21) - a page or descriptor nested about 100k deep overflows the stack inside Document::parse, before any application code runs; 2. the XPS walk recursed once per nested Canvas with no limit - about 10k levels overflowed the stack. Either one aborts the process during ATTACH. Reproduce: 1. Build a DWFx (zip) whose .fpage / descriptor.xml nests elements (e.g. Canvas) about 100,000 deep. 2. ATTACH it. 3. Before: STATUS_STACK_OVERFLOW (0xc00000fd) - process death; a test calling only roxmltree::Document::parse on the same bytes reproduces it, proving the dependency's tokenizer dies first. 4. After: the file is rejected before parse (a log::warn records "XML nests deeper than 256 levels ... document rejected"), or - for Canvas nesting between 65 and 256 - the page renders with the too-deep subtree skipped while siblings and the rest of the page stay. Fix: A linear depth scan (xml_depth_within, skipping comments, CDATA, PIs, doctype subsets and quoted attribute values so their angle brackets never count; it may over-reject malformed markup but must never under-count) gates all three Document::parse sites at 256 levels - real pages nest single digits - and walk caps Canvas nesting at 64 (continue skips that subtree, siblings unaffected), matching the compound-file walker's cap. Rejections are logged so a rejected depth is distinguishable from a corrupt parse.