diff --git a/mysql-test/r/xml.result b/mysql-test/r/xml.result index 6c78e9eac55..056ea62ee97 100644 --- a/mysql-test/r/xml.result +++ b/mysql-test/r/xml.result @@ -132,7 +132,7 @@ xb1 xc1 SELECT extractValue(@xml,'/a//@x[2]'); extractValue(@xml,'/a//@x[2]') xb2 xc2 -SET @xml='b1b2c1b1c1b2c2b1'; +SET @xml='b1b2c1b1c1b2c2b1'; SELECT extractValue(@xml,'//b[1]'); extractValue(@xml,'//b[1]') b1 c1b1 c2b1 @@ -1134,6 +1134,24 @@ Warnings: Warning 1525 Incorrect XML value: 'parse error at line 1 pos 11: STRING unexpected (ident or '/' wanted)' End of 5.1 tests # +# Start of 5.3 tests +# +# +# MDEV-5338 XML parser accepts malformed data +# +SELECT ExtractValue('xxx','/a/b'); +ExtractValue('xxx','/a/b') +NULL +Warnings: +Warning 1525 Incorrect XML value: 'parse error at line 1 pos 10: '' unexpected ('' wanted)' +SELECT ExtractValue('xxx','/a/b'); +ExtractValue('xxx','/a/b') +NULL +Warnings: +Warning 1525 Incorrect XML value: 'parse error at line 1 pos 13: '' unexpected ('' wanted)' +# +# End of 5.3 tests +# # Start of 5.5 tests # # diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test index 7013a306270..ec632eb90c3 100644 --- a/mysql-test/t/xml.test +++ b/mysql-test/t/xml.test @@ -53,7 +53,7 @@ SELECT extractValue(@xml,'/a//@x'); SELECT extractValue(@xml,'/a//@x[1]'); SELECT extractValue(@xml,'/a//@x[2]'); -SET @xml='b1b2c1b1c1b2c2b1'; +SET @xml='b1b2c1b1c1b2c2b1'; SELECT extractValue(@xml,'//b[1]'); SELECT extractValue(@xml,'/descendant::b[1]'); @@ -653,6 +653,18 @@ SELECT ExtractValue(CONVERT('<\"', BINARY(10)), 1); --echo End of 5.1 tests +--echo # +--echo # Start of 5.3 tests +--echo # + +--echo # +--echo # MDEV-5338 XML parser accepts malformed data +--echo # +SELECT ExtractValue('xxx','/a/b'); +SELECT ExtractValue('xxx','/a/b'); + +--echo # +--echo # End of 5.3 tests --echo # --echo # Start of 5.5 tests diff --git a/strings/xml.c b/strings/xml.c index 3b2c278f553..531fdc83eaa 100644 --- a/strings/xml.c +++ b/strings/xml.c @@ -239,7 +239,7 @@ static void mstr(char *s,const char *src,size_t l1, size_t l2) static int my_xml_leave(MY_XML_PARSER *p, const char *str, size_t slen) { - char *e; + char *e, *tag; size_t glen; char s[32]; char g[32]; @@ -248,13 +248,14 @@ static int my_xml_leave(MY_XML_PARSER *p, const char *str, size_t slen) /* Find previous '/' or beginning */ for (e=p->attrend; (e>p->attr) && (e[0] != '/') ; e--); glen = (size_t) ((e[0] == '/') ? (p->attrend-e-1) : p->attrend-e); - - if (str && (slen != glen)) + tag= e[0] == '/' ? e + 1 : e; + + if (str && (slen != glen || memcmp(str, tag, slen))) { mstr(s,str,sizeof(s)-1,slen); if (glen) { - mstr(g,e+1,sizeof(g)-1,glen), + mstr(g, tag, sizeof(g)-1, glen); sprintf(p->errstr,"'' unexpected ('' wanted)",s,g); } else