@@ -36,6 +36,7 @@ static void msc_xml_on_start_elementns(
36
36
xml_parser_state -> pathlen += (taglen + 1 );
37
37
char * newpath = apr_pstrcat (msr -> mp , xml_parser_state -> currpath , "." , (char * )localname , NULL );
38
38
xml_parser_state -> currpath = newpath ;
39
+ xml_parser_state -> currpathbufflen += taglen ;
39
40
40
41
int * new_stack_item = (int * )apr_array_push (xml_parser_state -> has_child_stack );
41
42
* new_stack_item = 0 ;
@@ -44,7 +45,7 @@ static void msc_xml_on_start_elementns(
44
45
// this is necessary because if there is any text between the tags (new line, etc)
45
46
// it will be added to the current value
46
47
xml_parser_state -> currval = NULL ;
47
- xml_parser_state -> currpathbufflen = 0 ;
48
+ xml_parser_state -> currvalbufflen = 0 ;
48
49
49
50
// if there is an item before the current one we set that has a child
50
51
if (xml_parser_state -> depth > 1 ) {
@@ -73,7 +74,7 @@ static void msc_xml_on_end_elementns(
73
74
if (apr_table_elts (msr -> arguments )-> nelts >= msr -> txcfg -> arguments_limit ) {
74
75
if (msr -> txcfg -> debuglog_level >= 4 ) {
75
76
msr_log (msr , 4 , "Skipping request argument, over limit (XML): name \"%s\", value \"%s\"" ,
76
- log_escape_ex (msr -> mp , xml_parser_state -> currpath , strlen ( xml_parser_state -> currpath ) ),
77
+ log_escape_ex (msr -> mp , xml_parser_state -> currpath , xml_parser_state -> currpathbufflen ),
77
78
log_escape_ex (msr -> mp ,
78
79
(xml_parser_state -> currval == NULL ? apr_pstrndup (msr -> mp , "" , 1 ) : xml_parser_state -> currval ),
79
80
(xml_parser_state -> currvalbufflen == 0 ? 1 : xml_parser_state -> currvalbufflen )
@@ -89,7 +90,7 @@ static void msc_xml_on_end_elementns(
89
90
msc_arg * arg = (msc_arg * ) apr_pcalloc (msr -> mp , sizeof (msc_arg ));
90
91
91
92
arg -> name = xml_parser_state -> currpath ;
92
- arg -> name_len = strlen ( arg -> name ) ;
93
+ arg -> name_len = xml_parser_state -> currpathbufflen ;
93
94
arg -> value = (xml_parser_state -> currval == NULL ) ? apr_pstrndup (msr -> mp , "" , 1 ) : xml_parser_state -> currval ;
94
95
arg -> value_len = (xml_parser_state -> currvalbufflen == 0 ) ? 1 : xml_parser_state -> currvalbufflen ;
95
96
arg -> value_origin_len = arg -> value_len ;
@@ -111,9 +112,11 @@ static void msc_xml_on_end_elementns(
111
112
// -1 is needed because we don't need the last '.'
112
113
char * newpath = apr_pstrndup (msr -> mp , xml_parser_state -> currpath , xml_parser_state -> pathlen - 1 );
113
114
xml_parser_state -> currpath = newpath ;
115
+ xml_parser_state -> currpathbufflen = xml_parser_state -> pathlen - 2 ; // -2 because of the '\0' and the last '.'
114
116
115
117
xml_parser_state -> depth -- ;
116
118
xml_parser_state -> currval = NULL ;
119
+ xml_parser_state -> currvalbufflen = 0 ;
117
120
}
118
121
119
122
static void msc_xml_on_characters (void * ctx , const xmlChar * ch , int len ) {
@@ -180,9 +183,9 @@ int xml_init(modsec_rec *msr, char **error_msg) {
180
183
msr -> xml -> xml_parser_state -> depth = 0 ;
181
184
msr -> xml -> xml_parser_state -> pathlen = 4 ; // "xml\0"
182
185
msr -> xml -> xml_parser_state -> currpath = apr_pstrdup (msr -> mp , "xml" );
186
+ msr -> xml -> xml_parser_state -> currpathbufflen = 3 ; // "xml"
183
187
msr -> xml -> xml_parser_state -> currval = NULL ;
184
188
msr -> xml -> xml_parser_state -> currvalbufflen = 0 ;
185
- msr -> xml -> xml_parser_state -> currpathbufflen = 4 ;
186
189
// initialize the stack with item of 10
187
190
// this will store the information about nodes
188
191
// 10 is just an initial value, it can be automatically incremented
0 commit comments