On Tue, Jul 07, 2020 at 06:48:57PM -0400, Laine Stump wrote:
libvirt has several uses of xmlNodeGetContent() (from libxml2) added
at
different times over the years. Some of those uses report an Out of Memory
error when xmlNodeGetContent() returns NULL, and some of them ignore a NULL
return (treating it as if it were ""), and some just assume that the return
will never be NULL, but always at least a pointer to "".
I ran across this when I noticed a usage of the latter type - it wasn't
checking for NULL at all. A lack of check seemed troubling, so I looked at
other uses within libvirt and found the hodge-podge described above, so no
help there in determining the right thing to do. I then looked at the
libxml2 documentation for xmlNodeGetContent(), which says:
Returns: a new #xmlChar * or NULL if no content is available.
To an uninformed outsider, this sounds like the function could return NULL
simply if the node was empty (e.g. "<wwn/>"). But when we look at the
return
from xmlNodeGetContent() for this example, it says that the content is "",
not NULL.
In the meantime, since libxml doesn't abort on OOM errors (as libvirt does),
it could also be possible that it's returning NULL due to OOM. So using
anecdotal evidence acquired so far, one *could* surmise that any time
libvirt gets a NULL return from xmlNodeGetContent(), it is indeed an OOM
error.
Looking at the source for xmlNodeGetContent() that is definitely not
the case.
The purist in me thinks that isn't right, though - I took a quick
look at
the libxml code and saw cases where it returns NULL that don't seem related
to OOM, but rather to the type of node or something. But being an outsider
and not wanting to learn any more than necessary about the internals of
libxml, I'm not sure if any of those cases even apply to libvirt's simple
use of xmlNodeGetContent().
I think we have to expect that the node type will not match what we
want it to be, when faced with malicious XML user input.
So, in the end I just want to modify libvirt's dozen or so calls
to
xmlNodeGetContent() to consistently do the right thing, but first I want to
learn the true answers to these questions:
1) Keeping in mind that we've already successfully parsed the XML, will
calls to xmlNodeGetContent() in the simple cases as when libvirt calls it
only return NULL for OOM, but not for any other reason?
No, there's other reasons it will return NULL that could hit us.
2) If not, is the proper way to distinguish OOM in this case to call
xmlGetLasterror(), and check if the domain is XML_FROM_MEMORY?
There are a bunch of cases in xmlNodeGetContent() which return NULL
without ever bothering to update the last error indicator. Also
xmlGetLastError is not using a thread local, so it is completely
unsafe to use it in any modern app that has threads :-(
3) Aside from returning NULL in the case of errors, would it ever be
possible for correct XML to return NULL as valid "node content", or is it
always an error of some kind?
It does look like it only happens in error, but many of the users
look like that can be triggered from user chosen input, so we must
not abort.
Since libvirt now aborts on OOM, an OOM error could be handled in one
place
by a wrapper function around xmlNodeGetContent() (we already have such a
function, currently a one-liner passthrough, and not called by everyone).
But if there is any chance that any other libxml error could be encountered,
then I suppose we really should be reporting those without aborting, and
then still checking for NULL on return from the wrapper function (presumably
by just logging the contents of "message" from the xmlErrorPtr returned from
xmlGetLastError().
xmlNodeGetContent() looks unusably broken to me in terms of error handling.
I notice however that the xmlNodePtr struct contents is actually fully
public in the API:
http://www.xmlsoft.org/html/libxml-tree.html#xmlNode
Given this, we can avoid xmlNodeGetContent entirely and just access the
node->content field directly, after first validating node->type. This
would give us reliable error handling. This is probably useful to replace
other libxml functions too -eg xmlGetProp looks like it has the same
problems with error reporting
Regards,
Daniel
--
|:
https://berrange.com -o-
https://www.flickr.com/photos/dberrange :|
|:
https://libvirt.org -o-
https://fstop138.berrange.com :|
|:
https://entangle-photo.org -o-
https://www.instagram.com/dberrange :|