@@ -36,6 +36,7 @@ static void msc_xml_on_start_elementns(
3636 xml_parser_state -> pathlen += (taglen + 1 );
3737 char * newpath = apr_pstrcat (msr -> mp , xml_parser_state -> currpath , "." , (char * )localname , NULL );
3838 xml_parser_state -> currpath = newpath ;
39+ xml_parser_state -> currpathbufflen += taglen ;
3940
4041 int * new_stack_item = (int * )apr_array_push (xml_parser_state -> has_child_stack );
4142 * new_stack_item = 0 ;
@@ -44,7 +45,7 @@ static void msc_xml_on_start_elementns(
4445 // this is necessary because if there is any text between the tags (new line, etc)
4546 // it will be added to the current value
4647 xml_parser_state -> currval = NULL ;
47- xml_parser_state -> currpathbufflen = 0 ;
48+ xml_parser_state -> currvalbufflen = 0 ;
4849
4950 // if there is an item before the current one we set that has a child
5051 if (xml_parser_state -> depth > 1 ) {
@@ -73,7 +74,7 @@ static void msc_xml_on_end_elementns(
7374 if (apr_table_elts (msr -> arguments )-> nelts >= msr -> txcfg -> arguments_limit ) {
7475 if (msr -> txcfg -> debuglog_level >= 4 ) {
7576 msr_log (msr , 4 , "Skipping request argument, over limit (XML): name \"%s\", value \"%s\"" ,
76- log_escape_ex (msr -> mp , xml_parser_state -> currpath , strlen ( xml_parser_state -> currpath ) ),
77+ log_escape_ex (msr -> mp , xml_parser_state -> currpath , xml_parser_state -> currpathbufflen ),
7778 log_escape_ex (msr -> mp ,
7879 (xml_parser_state -> currval == NULL ? apr_pstrndup (msr -> mp , "" , 1 ) : xml_parser_state -> currval ),
7980 (xml_parser_state -> currvalbufflen == 0 ? 1 : xml_parser_state -> currvalbufflen )
@@ -89,7 +90,7 @@ static void msc_xml_on_end_elementns(
8990 msc_arg * arg = (msc_arg * ) apr_pcalloc (msr -> mp , sizeof (msc_arg ));
9091
9192 arg -> name = xml_parser_state -> currpath ;
92- arg -> name_len = strlen ( arg -> name ) ;
93+ arg -> name_len = xml_parser_state -> currpathbufflen ;
9394 arg -> value = (xml_parser_state -> currval == NULL ) ? apr_pstrndup (msr -> mp , "" , 1 ) : xml_parser_state -> currval ;
9495 arg -> value_len = (xml_parser_state -> currvalbufflen == 0 ) ? 1 : xml_parser_state -> currvalbufflen ;
9596 arg -> value_origin_len = arg -> value_len ;
@@ -111,9 +112,11 @@ static void msc_xml_on_end_elementns(
111112 // -1 is needed because we don't need the last '.'
112113 char * newpath = apr_pstrndup (msr -> mp , xml_parser_state -> currpath , xml_parser_state -> pathlen - 1 );
113114 xml_parser_state -> currpath = newpath ;
115+ xml_parser_state -> currpathbufflen = xml_parser_state -> pathlen - 2 ; // -2 because of the '\0' and the last '.'
114116
115117 xml_parser_state -> depth -- ;
116118 xml_parser_state -> currval = NULL ;
119+ xml_parser_state -> currvalbufflen = 0 ;
117120}
118121
119122static void msc_xml_on_characters (void * ctx , const xmlChar * ch , int len ) {
@@ -180,9 +183,9 @@ int xml_init(modsec_rec *msr, char **error_msg) {
180183 msr -> xml -> xml_parser_state -> depth = 0 ;
181184 msr -> xml -> xml_parser_state -> pathlen = 4 ; // "xml\0"
182185 msr -> xml -> xml_parser_state -> currpath = apr_pstrdup (msr -> mp , "xml" );
186+ msr -> xml -> xml_parser_state -> currpathbufflen = 3 ; // "xml"
183187 msr -> xml -> xml_parser_state -> currval = NULL ;
184188 msr -> xml -> xml_parser_state -> currvalbufflen = 0 ;
185- msr -> xml -> xml_parser_state -> currpathbufflen = 4 ;
186189 // initialize the stack with item of 10
187190 // this will store the information about nodes
188191 // 10 is just an initial value, it can be automatically incremented
0 commit comments