leptris 1.9.388.0-arm-linux → 1.9.390.0-arm-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c2d5ce6e05ff65e498dfbd4474f768b800dd830ff4a42bc10f522dab58755c68
-  data.tar.gz: 955bc9c6d8843425f23f37587fd8dcb3af312b16f6b912d7c7b54a4ef3549ec9
+  metadata.gz: e1f6473ab1e7001f70f7bd3fe14cdf1da1e0debb40f498103bbb91d68a176e68
+  data.tar.gz: 2e45d0158274323e9f47d089671e3a2761b24769f052934c8146947453fdd4f0
 SHA512:
-  metadata.gz: 4bf67c78d62e39acac70ec32e2254a4aa89cedbda5402a28edb361cfd0ecf1f5e2ceb398622e9113544a766f8d9c4988bee8e1abf5cc0f4b3d12510db8d47b78
-  data.tar.gz: 99ab897b838bb4c74b03782f00f19b4898438a3823088e01b364565d520d8b1d66be21f58cdea9b19e5d34f0d54c43fbe3ca7f274f14673d5177d765e0e7049c
+  metadata.gz: ef0f1ebea3d784ea055059fa2500c755fa7d9416c2bafb8b641e373511705a83abfb156734574c1cb1b91cfb915d9729a0c298f84a8dc89ce4eb80bd2096b24a
+  data.tar.gz: 1ed6d494a872ac9f99c2956dce51853a2ea5a3c752ae47c0d145b39d3ee94cb5ae90df0f5f7bea971286a5f7cdacac934b921a07b29535cdceca42eccc2440d6

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## [Unreleased]
 
+### Changed — 1.9.389.0 (rides libleptris 1.9.389)
+
+- Engine pin 1.9.388 -> 1.9.389: the XSD content-model automaton
+  size cap (leptris/leptris#1897, #1894 — pathological occurrence
+  products reject in microseconds via an analytic product bound,
+  with a 1e6 expansion cap backstop; over-cap models fail loudly
+  through the structured rows).
+
 ### Changed — 1.9.388.0 (rides libleptris 1.9.388)
 
 - Engine pin 1.9.386 -> 1.9.388: carries the one-pass text-run scan

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.388"
+LIBLEPTRIS_VERSION = "1.9.390"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.388.0"
+  VERSION = "1.9.390.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.388
+- libleptris v1.9.390
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,42 @@
 ## [Unreleased]
 
+## [1.9.390] - 2026-10-29
+
+### Fixed
+
+- **XPath: compare `node->type` against its own enum constant
+  (leptris#1902).** The parent-axis attribute check (#1866,
+  `./@id/..`) used `LEPTRIS_NODE_ATTRIBUTE` — a constant of the
+  *other* internal enum — against `node->type`: same value, wrong
+  type. Found by the leptris-ts CI zero-warning gate (emcc
+  `-Wenum-compare`, wasm32 portability class).
+
+
+
+## [1.9.389] - 2026-10-29
+
+### Fixed
+
+- **XSD: size-cap the content-model automaton (leptris#1897,
+  leptris#1894).** A counted particle multiplies the expanded NFA
+  (finite `maxOccurs` copies the subtree per copy), so nested large
+  bounds grew the automaton exponentially and a huge finite bound
+  walked the copy loop until the process died — jetsam/OOM with no
+  diagnostic, which read as a flaky harness in the W3C XML Schema
+  Test Suite batch runner. Two layers: an analytic, saturating
+  product bound computed BEFORE the build rejects pathological
+  models in microseconds (the 2000x2000 repro measured 10.0s ->
+  0ms), and a 1e6 state/transition expansion cap as the backstop
+  for shapes the walk cannot see (cyclic groups). Over-cap models
+  fail LOUDLY: a `content-model` structured row on instance
+  validation and a `-1` (not evaluable) from the public
+  `leptris_xsd_content_valid` with the message on
+  `leptris_xsd_error`. The issue's own repro (seq maxOccurs=100 x
+  element unbounded) lowers to a ~200-state loop model and pins
+  green.
+
+
+
 ## [1.9.388] - 2026-10-29
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.388
+    VERSION 1.9.390
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/leptris/xpath/evaluator_axes.c

@@ -760,7 +760,7 @@ XPathNodeSet* apply_axis(XPathContext* ctx, LeptrisNode* node,
      * element). The element-typed dispatch below would read the
      * parent field in element form off the attribute struct and
      * return empty (leptris#1866, the standoc svg-uniqueids face). */
-    if (axis_id == XPATH_AXIS_PARENT && node && node->type == LEPTRIS_NODE_ATTRIBUTE) {
+    if (axis_id == XPATH_AXIS_PARENT && node && node->type == LEPTRIS_NODE_TYPE_ATTRIBUTE) {
         LeptrisElement owner = ((LeptrisAttributeNode*)node)->owner;
         XPathNodeSet* result = xpath_nodeset_new();
         if (!result) return result;

data/vendor-src/libleptris/src/leptris/xsd/compile.c

@@ -3651,8 +3651,17 @@ LEPTRIS_API int leptris_xsd_content_valid(
     XsdCm* model = ct->first_child;
     if (!model) return child_count == 0;
 
-    return xsd_content_valid(s, model, s->target_ns, child_names,
-                             child_ns, child_count);
+    int ok = xsd_content_valid(s, model, s->target_ns, child_names,
+                               child_ns, child_count);
+    /* #1894: -2 = the model crosses the automaton size cap — surface
+     * the loud structured row and keep the public contract's -1 for
+     * "not evaluable". */
+    if (ok == -2) {
+        xsd_set_error(s, "content model exceeds the automaton size "
+                         "cap (pathological occurrence product)");
+        return -1;
+    }
+    return ok;
 }
 
 LEPTRIS_API size_t leptris_xsd_declaration_count(LeptrisXsdSchema schema) {

data/vendor-src/libleptris/src/leptris/xsd/content_model.c

@@ -29,12 +29,34 @@ typedef struct {
     int start, accept;
     struct leptris_xsd_schema* s; /* group-ref resolution */
     int depth;                    /* cyclic-group guard */
+    int overflow; /* #1894: crossed XSD_CM_NFA_MAX — abort the build */
 } CmNfa;
 
-static int nfa_state(CmNfa* n) { return n->state_count++; }
+/* leptris#1894: a counted particle multiplies the expanded NFA (finite
+ * maxOccurs copies the subtree per copy), so nested large bounds grow
+ * the automaton exponentially and a huge finite bound walks the copy
+ * loop until the process dies (jetsam/OOM, no diagnostic). Crossing
+ * this bound aborts the build; xsd_content_valid reports -2 and the
+ * callers surface a loud structured row. Generous: legitimate suite
+ * content models stay orders of magnitude below it. */
+#define XSD_CM_NFA_MAX 1000000
+
+static int nfa_state(CmNfa* n) {
+    if (n->overflow) return 0;
+    if (n->state_count >= XSD_CM_NFA_MAX) {
+        n->overflow = 1;
+        return 0;
+    }
+    return n->state_count++;
+}
 
 static void nfa_trans(CmNfa* n, int from, int symbol, XsdCm* particle,
                       int to) {
+    if (n->overflow) return;
+    if (n->count >= XSD_CM_NFA_MAX) {
+        n->overflow = 1;
+        return;
+    }
     if (n->count == n->cap) {
         size_t cap = n->cap ? n->cap * 2 : 16;
         CmTrans* grown = (CmTrans*)realloc(n->trans, cap * sizeof(*grown));
@@ -125,7 +147,9 @@ static void cm_build(CmNfa* n, XsdCm* node, int from, int to) {
 /* occurrence bounds: min copies, then (max-min) optionals, or an
  * epsilon self-loop region for unbounded. */
 static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
+    if (n->overflow) return;
     for (int i = 0; i < node->min; i++) {
+        if (n->overflow) return;
         int mid = nfa_state(n);
         cm_build(n, node, from, mid);
         from = mid;
@@ -138,6 +162,7 @@ static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
         return;
     }
     for (int i = node->min; i < node->max; i++) {
+        if (n->overflow) return;
         nfa_trans(n, from, -1, NULL, to);
         int mid = nfa_state(n);
         cm_build(n, node, from, mid);
@@ -146,6 +171,62 @@ static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
     nfa_trans(n, from, -1, NULL, to);
 }
 
+/* ---- #1894 analytic product bound (pre-build rejection) ----------- */
+
+/* Saturating upper bound on the states+transitions one subtree
+ * expands, honoring the same occurrence lowering cm_build_occurrence
+ * performs: finite max copies the subtree max times; unbounded lowers
+ * to ONE loop region (min + 1 copies). Groups follow like cm_build
+ * (depth-capped; unresolved/cyclic refs count as 1 — the expansion
+ * cap remains the backstop for anything the walk cannot see). Returns
+ * nonzero when the bound crosses XSD_CM_NFA_MAX. */
+static int cm_bound_over(struct leptris_xsd_schema* s,
+                         const XsdCm* node, size_t* bound, int depth) {
+    if (!node || depth > 64) return 0;
+    size_t sub;
+    switch (node->kind) {
+        case XSD_CM_ELEMENT:
+        case XSD_CM_ANY:
+            sub = 1;
+            break;
+        case XSD_CM_GROUP_REF: {
+            XsdGroupDef* g = s ? xsd_find_group(s, node->name) : NULL;
+            if (!g || !g->model ||
+                cm_bound_over(s, g->model, &sub, depth + 1))
+                sub = 1;
+            break;
+        }
+        case XSD_CM_SEQ:
+        case XSD_CM_ALL:
+        case XSD_CM_CHOICE: {
+            sub = 0;
+            for (const XsdCm* c = node->first_child; c; c = c->next) {
+                size_t cb = 0;
+                if (cm_bound_over(s, c, &cb, depth + 1)) return 1;
+                if (sub > XSD_CM_NFA_MAX) return 1;
+                sub += cb;
+            }
+            break;
+        }
+        default:
+            sub = 1;
+            break;
+    }
+    /* occurrence multiplier: copies of the subtree */
+    size_t copies;
+    if (node->max < 0)
+        copies = (size_t)(node->min > 0 ? node->min : 0) + 1;
+    else
+        copies = (size_t)(node->max > 0 ? node->max : 0);
+    if (copies == 0) {
+        *bound = 0;
+        return 0;
+    }
+    if (sub != 0 && copies > XSD_CM_NFA_MAX / sub) return 1;
+    *bound = sub * copies + 1;
+    return *bound > XSD_CM_NFA_MAX;
+}
+
 /* ---- namespace filter (xs:any/@namespace) ------------------------ */
 
 /* XSD 1.1 notQName hit test (moxml#460): ##defined matches a name
@@ -297,7 +378,19 @@ int xsd_content_valid(struct leptris_xsd_schema* s, XsdCm* model,
     n.s = s;
     n.start = nfa_state(&n);
     n.accept = nfa_state(&n);
+    /* #1894: bound the expansion analytically BEFORE building — a
+     * pathological occurrence product (nested finite maxOccurs)
+     * rejects in microseconds instead of growing the automaton until
+     * the process dies. */
+    {
+        size_t bound = 0;
+        if (cm_bound_over(s, model, &bound, 0)) return -2;
+    }
     cm_build_occurrence(&n, model, n.start, n.accept);
+    if (n.overflow) {
+        free(n.trans);
+        return -2;
+    }
 
     StateSet live;
     memset(&live, 0, sizeof(live));

data/vendor-src/libleptris/src/leptris/xsd/validate.c

@@ -391,6 +391,19 @@ static void validate_children(struct xsd_validator* v,
      * min == 0. names/uris stay NULL (never dereferenced at n==0). */
     int ok = xsd_content_valid(s, model, xsd_target_ns(s), names, uris,
                                n);
+    if (ok == -2) {
+        /* #1894: pathological occurrence product — the automaton
+         * exceeds the compile-time size cap. Loud, not a hang. */
+        const char* l2 = NULL;
+        leptris_element_expanded_name(elem, &l2, NULL, NULL);
+        verrf_atk(v, elem, "content-model", l2 ? l2 : "", "element",
+                  l2 ? l2 : "",
+                  "content model exceeds the automaton size cap "
+                  "(pathological occurrence product)");
+        free(names);
+        free(uris);
+        return;
+    }
     if (ok) {
         free(names);
         free(uris);

data/vendor-src/libleptris/test/parser/test_parser.cpp

@@ -974,3 +974,35 @@ TEST(ParseErrorPosition, GenericFailuresStayGeneric) {
     ASSERT_NE(err, nullptr);
     EXPECT_NE(std::strstr(err, "malformed input"), nullptr) << err;
 }
+
+/* leptris#1901: linux-only round-trip attribute loss — sz/szCs w:val
+ * runs vanish between parse and serialize on x86_64-linux (uniword
+ * matrix: darwin green, linux red, same seed + gem versions). Pin the
+ * OOXML shape so the ubuntu lane arbitrates the platform split. */
+TEST(RoundTrip, OoxmlRunPropertiesKeepValAttributes) {
+    const char xml[] =
+        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n"
+        "<w:document xmlns:w=\"http://schemas.openxmlformats.org/"
+        "wordprocessingml/2006/main\"><w:body><w:p><w:pPr><w:rPr>"
+        "<w:sz w:val=\"24\"/><w:szCs w:val=\"24\"/></w:rPr></w:pPr>"
+        "<w:r><w:rPr><w:sz w:val=\"24\"/><w:szCs w:val=\"24\"/>"
+        "</w:rPr><w:t xml:space=\"preserve\">hi there</w:t></w:r>"
+        "</w:p></w:body></w:document>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc =
+        leptris_parse_string(xml, std::strlen(xml), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(doc, nullptr);
+    char* out = leptris_document_serialize(doc, NULL);
+    ASSERT_NE(out, nullptr);
+    /* all four w:val attributes survive the round trip */
+    int val_count = 0;
+    for (const char* p = out; (p = std::strstr(p, "w:val=\"24\"")) != NULL;
+         p++)
+        val_count++;
+    EXPECT_EQ(val_count, 4) << out;
+    EXPECT_NE(std::strstr(out, "<w:sz w:val=\"24\"/>"), nullptr);
+    EXPECT_NE(std::strstr(out, "<w:szCs w:val=\"24\"/>"), nullptr);
+    leptris_free_string(out);
+    leptris_document_free(doc);
+}

data/vendor-src/libleptris/test/xsd/test_xsd_compile.cpp

@@ -3624,3 +3624,59 @@ TEST(XsdValidate, QNameNotationIgnoreLengthFacets) {
     EXPECT_EQ(validate_doc(ul, "<test a='x y'/>"), 1);
     EXPECT_EQ(validate_doc(ul, "<test a='x'/>"), 0);
 }
+
+/* leptris#1894: pathological occurrence products. A counted particle
+ * multiplies the expanded NFA (finite maxOccurs copies the subtree per
+ * copy), so nested large bounds grow the automaton exponentially and a
+ * huge finite bound walks the copy loop until the process dies. The
+ * compile-time size guard fails LOUDLY — a structured report row and a
+ * -1 (not evaluable) from the public face — instead of consuming the
+ * machine. */
+TEST(XsdContent, PathologicalProductFailsLoudlyNotOom) {
+    std::string xsd =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:element name=\"r\"><xs:complexType><xs:sequence"
+        " minOccurs=\"0\" maxOccurs=\"2000\"><xs:element name=\"e\""
+        " minOccurs=\"0\" maxOccurs=\"2000\"/></xs:sequence>"
+        "</xs:complexType></xs:element></xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s =
+        leptris_xsd_compile(xsd.data(), xsd.size(), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    /* 2000 x 2000 = 4e6 expanded copies — over the cap. Zero children
+     * keep the simulation cheap; the BUILD is what the guard bounds. */
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", NULL, NULL, 0), -1);
+    /* the loud message rides the schema error face (validator rows
+     * carry it on the instance-validation path instead) */
+    const char* err = leptris_xsd_error(s);
+    ASSERT_NE(err, nullptr);
+    EXPECT_NE(std::string(err).find("size cap"), std::string::npos)
+        << "error: " << err;
+    leptris_xsd_free(s);
+}
+
+TEST(XsdContent, Issue1894ReproStaysUnderCapAndCorrect) {
+    /* The issue's exact shape — seq maxOccurs=100 x element
+     * unbounded — lowers to a loop region (not copies) and must stay
+     * far under the cap with normal answers. */
+    const char xsd[] =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:element name=\"r\"><xs:complexType><xs:sequence"
+        " maxOccurs=\"100\"><xs:element name=\"e\""
+        " maxOccurs=\"unbounded\"/></xs:sequence></xs:complexType>"
+        "</xs:element></xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s =
+        leptris_xsd_compile(xsd, strlen(xsd), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    const char* e[] = {"e"};
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", e, NULL, 1), 1);
+    /* minOccurs defaults to 1 on the inner element: empty violates */
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", NULL, NULL, 0), 0);
+    const char* x[] = {"x"};
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", x, NULL, 1), 0);
+    EXPECT_EQ(leptris_xsd_error_count(s), 0u);
+    leptris_xsd_free(s);
+}

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.388",
+  "version": "1.9.390",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.388.0
+  version: 1.9.390.0
 platform: arm-linux
 authors:
 - Ribose Inc.