leptris 1.9.388.0-ppc64le-linux → 1.9.389.0-ppc64le-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 238b6117d6d53b2e74db8530678f08b444e405ed9569cc0d5c794bc1539de2db
-  data.tar.gz: 6e3a5e2de83a00123bc4ea19fd4818526809f05248b41e0aa6d7a9d9532d71a2
+  metadata.gz: e44ebccdfaf5bf4827e70bef39014db27495c9b8a75ec7021ef64b4c5071d821
+  data.tar.gz: 386db1cceadaa37208ed1f68e7e014ced0be911df07ea3813e3e0414a7fcbab4
 SHA512:
-  metadata.gz: ae6c2a635dce0825ae7f0d85ecfaf343a912f551ce7a88e62f5686de2dbfa1ed736aa8c512a3c33ffa3ab236de554ff1ac7ecc316d419cda9bf2e7ec6c68db91
-  data.tar.gz: d96b043f56180f0fc6c79a9a25c1678d1161d099b544ed0ba4ebfa5a220fec998b287b591d6535305d3a42b5bb7eada48576f0276ea930b4cfc5db4313589da5
+  metadata.gz: a883f44d891d1034c0c122827e687e581982b070838425a1760b55f32cccd5a3ca5ddf706b26e7e50c6b064d3d209cf8ebc4706cebb298b9795ca8d1ccaa75ce
+  data.tar.gz: eaf431976b58bca8f974a27b2fb0656dbe0ba328413be0bbadf2a6718580c09875bfd669d9431c0290ed200a096902c853c14445e9c28a37e3ab7ae8e4597e50

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## [Unreleased]
 
+### Changed — 1.9.389.0 (rides libleptris 1.9.389)
+
+- Engine pin 1.9.388 -> 1.9.389: the XSD content-model automaton
+  size cap (leptris/leptris#1897, #1894 — pathological occurrence
+  products reject in microseconds via an analytic product bound,
+  with a 1e6 expansion cap backstop; over-cap models fail loudly
+  through the structured rows).
+
 ### Changed — 1.9.388.0 (rides libleptris 1.9.388)
 
 - Engine pin 1.9.386 -> 1.9.388: carries the one-pass text-run scan

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.388"
+LIBLEPTRIS_VERSION = "1.9.389"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.388.0"
+  VERSION = "1.9.389.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.388
+- libleptris v1.9.389
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,29 @@
 ## [Unreleased]
 
+## [1.9.389] - 2026-10-29
+
+### Fixed
+
+- **XSD: size-cap the content-model automaton (leptris#1897,
+  leptris#1894).** A counted particle multiplies the expanded NFA
+  (finite `maxOccurs` copies the subtree per copy), so nested large
+  bounds grew the automaton exponentially and a huge finite bound
+  walked the copy loop until the process died — jetsam/OOM with no
+  diagnostic, which read as a flaky harness in the W3C XML Schema
+  Test Suite batch runner. Two layers: an analytic, saturating
+  product bound computed BEFORE the build rejects pathological
+  models in microseconds (the 2000x2000 repro measured 10.0s ->
+  0ms), and a 1e6 state/transition expansion cap as the backstop
+  for shapes the walk cannot see (cyclic groups). Over-cap models
+  fail LOUDLY: a `content-model` structured row on instance
+  validation and a `-1` (not evaluable) from the public
+  `leptris_xsd_content_valid` with the message on
+  `leptris_xsd_error`. The issue's own repro (seq maxOccurs=100 x
+  element unbounded) lowers to a ~200-state loop model and pins
+  green.
+
+
+
 ## [1.9.388] - 2026-10-29
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.388
+    VERSION 1.9.389
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/leptris/xsd/compile.c

@@ -3651,8 +3651,17 @@ LEPTRIS_API int leptris_xsd_content_valid(
     XsdCm* model = ct->first_child;
     if (!model) return child_count == 0;
 
-    return xsd_content_valid(s, model, s->target_ns, child_names,
-                             child_ns, child_count);
+    int ok = xsd_content_valid(s, model, s->target_ns, child_names,
+                               child_ns, child_count);
+    /* #1894: -2 = the model crosses the automaton size cap — surface
+     * the loud structured row and keep the public contract's -1 for
+     * "not evaluable". */
+    if (ok == -2) {
+        xsd_set_error(s, "content model exceeds the automaton size "
+                         "cap (pathological occurrence product)");
+        return -1;
+    }
+    return ok;
 }
 
 LEPTRIS_API size_t leptris_xsd_declaration_count(LeptrisXsdSchema schema) {

data/vendor-src/libleptris/src/leptris/xsd/content_model.c

@@ -29,12 +29,34 @@ typedef struct {
     int start, accept;
     struct leptris_xsd_schema* s; /* group-ref resolution */
     int depth;                    /* cyclic-group guard */
+    int overflow; /* #1894: crossed XSD_CM_NFA_MAX — abort the build */
 } CmNfa;
 
-static int nfa_state(CmNfa* n) { return n->state_count++; }
+/* leptris#1894: a counted particle multiplies the expanded NFA (finite
+ * maxOccurs copies the subtree per copy), so nested large bounds grow
+ * the automaton exponentially and a huge finite bound walks the copy
+ * loop until the process dies (jetsam/OOM, no diagnostic). Crossing
+ * this bound aborts the build; xsd_content_valid reports -2 and the
+ * callers surface a loud structured row. Generous: legitimate suite
+ * content models stay orders of magnitude below it. */
+#define XSD_CM_NFA_MAX 1000000
+
+static int nfa_state(CmNfa* n) {
+    if (n->overflow) return 0;
+    if (n->state_count >= XSD_CM_NFA_MAX) {
+        n->overflow = 1;
+        return 0;
+    }
+    return n->state_count++;
+}
 
 static void nfa_trans(CmNfa* n, int from, int symbol, XsdCm* particle,
                       int to) {
+    if (n->overflow) return;
+    if (n->count >= XSD_CM_NFA_MAX) {
+        n->overflow = 1;
+        return;
+    }
     if (n->count == n->cap) {
         size_t cap = n->cap ? n->cap * 2 : 16;
         CmTrans* grown = (CmTrans*)realloc(n->trans, cap * sizeof(*grown));
@@ -125,7 +147,9 @@ static void cm_build(CmNfa* n, XsdCm* node, int from, int to) {
 /* occurrence bounds: min copies, then (max-min) optionals, or an
  * epsilon self-loop region for unbounded. */
 static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
+    if (n->overflow) return;
     for (int i = 0; i < node->min; i++) {
+        if (n->overflow) return;
         int mid = nfa_state(n);
         cm_build(n, node, from, mid);
         from = mid;
@@ -138,6 +162,7 @@ static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
         return;
     }
     for (int i = node->min; i < node->max; i++) {
+        if (n->overflow) return;
         nfa_trans(n, from, -1, NULL, to);
         int mid = nfa_state(n);
         cm_build(n, node, from, mid);
@@ -146,6 +171,62 @@ static void cm_build_occurrence(CmNfa* n, XsdCm* node, int from, int to) {
     nfa_trans(n, from, -1, NULL, to);
 }
 
+/* ---- #1894 analytic product bound (pre-build rejection) ----------- */
+
+/* Saturating upper bound on the states+transitions one subtree
+ * expands, honoring the same occurrence lowering cm_build_occurrence
+ * performs: finite max copies the subtree max times; unbounded lowers
+ * to ONE loop region (min + 1 copies). Groups follow like cm_build
+ * (depth-capped; unresolved/cyclic refs count as 1 — the expansion
+ * cap remains the backstop for anything the walk cannot see). Returns
+ * nonzero when the bound crosses XSD_CM_NFA_MAX. */
+static int cm_bound_over(struct leptris_xsd_schema* s,
+                         const XsdCm* node, size_t* bound, int depth) {
+    if (!node || depth > 64) return 0;
+    size_t sub;
+    switch (node->kind) {
+        case XSD_CM_ELEMENT:
+        case XSD_CM_ANY:
+            sub = 1;
+            break;
+        case XSD_CM_GROUP_REF: {
+            XsdGroupDef* g = s ? xsd_find_group(s, node->name) : NULL;
+            if (!g || !g->model ||
+                cm_bound_over(s, g->model, &sub, depth + 1))
+                sub = 1;
+            break;
+        }
+        case XSD_CM_SEQ:
+        case XSD_CM_ALL:
+        case XSD_CM_CHOICE: {
+            sub = 0;
+            for (const XsdCm* c = node->first_child; c; c = c->next) {
+                size_t cb = 0;
+                if (cm_bound_over(s, c, &cb, depth + 1)) return 1;
+                if (sub > XSD_CM_NFA_MAX) return 1;
+                sub += cb;
+            }
+            break;
+        }
+        default:
+            sub = 1;
+            break;
+    }
+    /* occurrence multiplier: copies of the subtree */
+    size_t copies;
+    if (node->max < 0)
+        copies = (size_t)(node->min > 0 ? node->min : 0) + 1;
+    else
+        copies = (size_t)(node->max > 0 ? node->max : 0);
+    if (copies == 0) {
+        *bound = 0;
+        return 0;
+    }
+    if (sub != 0 && copies > XSD_CM_NFA_MAX / sub) return 1;
+    *bound = sub * copies + 1;
+    return *bound > XSD_CM_NFA_MAX;
+}
+
 /* ---- namespace filter (xs:any/@namespace) ------------------------ */
 
 /* XSD 1.1 notQName hit test (moxml#460): ##defined matches a name
@@ -297,7 +378,19 @@ int xsd_content_valid(struct leptris_xsd_schema* s, XsdCm* model,
     n.s = s;
     n.start = nfa_state(&n);
     n.accept = nfa_state(&n);
+    /* #1894: bound the expansion analytically BEFORE building — a
+     * pathological occurrence product (nested finite maxOccurs)
+     * rejects in microseconds instead of growing the automaton until
+     * the process dies. */
+    {
+        size_t bound = 0;
+        if (cm_bound_over(s, model, &bound, 0)) return -2;
+    }
     cm_build_occurrence(&n, model, n.start, n.accept);
+    if (n.overflow) {
+        free(n.trans);
+        return -2;
+    }
 
     StateSet live;
     memset(&live, 0, sizeof(live));

data/vendor-src/libleptris/src/leptris/xsd/validate.c

@@ -391,6 +391,19 @@ static void validate_children(struct xsd_validator* v,
      * min == 0. names/uris stay NULL (never dereferenced at n==0). */
     int ok = xsd_content_valid(s, model, xsd_target_ns(s), names, uris,
                                n);
+    if (ok == -2) {
+        /* #1894: pathological occurrence product — the automaton
+         * exceeds the compile-time size cap. Loud, not a hang. */
+        const char* l2 = NULL;
+        leptris_element_expanded_name(elem, &l2, NULL, NULL);
+        verrf_atk(v, elem, "content-model", l2 ? l2 : "", "element",
+                  l2 ? l2 : "",
+                  "content model exceeds the automaton size cap "
+                  "(pathological occurrence product)");
+        free(names);
+        free(uris);
+        return;
+    }
     if (ok) {
         free(names);
         free(uris);

data/vendor-src/libleptris/test/xsd/test_xsd_compile.cpp

@@ -3624,3 +3624,59 @@ TEST(XsdValidate, QNameNotationIgnoreLengthFacets) {
     EXPECT_EQ(validate_doc(ul, "<test a='x y'/>"), 1);
     EXPECT_EQ(validate_doc(ul, "<test a='x'/>"), 0);
 }
+
+/* leptris#1894: pathological occurrence products. A counted particle
+ * multiplies the expanded NFA (finite maxOccurs copies the subtree per
+ * copy), so nested large bounds grow the automaton exponentially and a
+ * huge finite bound walks the copy loop until the process dies. The
+ * compile-time size guard fails LOUDLY — a structured report row and a
+ * -1 (not evaluable) from the public face — instead of consuming the
+ * machine. */
+TEST(XsdContent, PathologicalProductFailsLoudlyNotOom) {
+    std::string xsd =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:element name=\"r\"><xs:complexType><xs:sequence"
+        " minOccurs=\"0\" maxOccurs=\"2000\"><xs:element name=\"e\""
+        " minOccurs=\"0\" maxOccurs=\"2000\"/></xs:sequence>"
+        "</xs:complexType></xs:element></xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s =
+        leptris_xsd_compile(xsd.data(), xsd.size(), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    /* 2000 x 2000 = 4e6 expanded copies — over the cap. Zero children
+     * keep the simulation cheap; the BUILD is what the guard bounds. */
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", NULL, NULL, 0), -1);
+    /* the loud message rides the schema error face (validator rows
+     * carry it on the instance-validation path instead) */
+    const char* err = leptris_xsd_error(s);
+    ASSERT_NE(err, nullptr);
+    EXPECT_NE(std::string(err).find("size cap"), std::string::npos)
+        << "error: " << err;
+    leptris_xsd_free(s);
+}
+
+TEST(XsdContent, Issue1894ReproStaysUnderCapAndCorrect) {
+    /* The issue's exact shape — seq maxOccurs=100 x element
+     * unbounded — lowers to a loop region (not copies) and must stay
+     * far under the cap with normal answers. */
+    const char xsd[] =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:element name=\"r\"><xs:complexType><xs:sequence"
+        " maxOccurs=\"100\"><xs:element name=\"e\""
+        " maxOccurs=\"unbounded\"/></xs:sequence></xs:complexType>"
+        "</xs:element></xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s =
+        leptris_xsd_compile(xsd, strlen(xsd), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    const char* e[] = {"e"};
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", e, NULL, 1), 1);
+    /* minOccurs defaults to 1 on the inner element: empty violates */
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", NULL, NULL, 0), 0);
+    const char* x[] = {"x"};
+    EXPECT_EQ(leptris_xsd_content_valid(s, "r", x, NULL, 1), 0);
+    EXPECT_EQ(leptris_xsd_error_count(s), 0u);
+    leptris_xsd_free(s);
+}

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.388",
+  "version": "1.9.389",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.388.0
+  version: 1.9.389.0
 platform: ppc64le-linux
 authors:
 - Ribose Inc.