DO NOT REPLY [Bug 24703] New: - Crash when maxOccurs >= 200000

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24703>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24703

Crash when maxOccurs >= 200000

           Summary: Crash when maxOccurs >= 200000
           Product: Xerces-C++
           Version: 2.3.0
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Critical
          Priority: Other
         Component: Validating Parser (Schema) (Xerces 1.5 or up only)
        AssignedTo: xerces-c-dev@xml.apache.org
        ReportedBy: rast@gefeg.com


Parser crashes in ContentSpecNode.hpp: ContentSpecNode::~ContentSpecNode().

Steps to reproduce:
validate a xml file against a schema with an element having a maxOccurs >= 
200000.

Assumed cause:
Stack overfow

Makeshift resolution:
Set the repeat count to unbounded(-1), when maxOccurs > 500:

inline void ContentSpecNode::setMaxOccurs(int max)
{
    if(max > 500) 
        max = -1;
    fMaxOccurs = max;
}

---------------------------------------------------------------------
To unsubscribe, e-mail: xerces-c-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xerces-c-dev-help@xml.apache.org