QXmlSimpleReader: add tests that show unconstrained entity expansion
There is a single entityCharacterLimit limit (4096 characters), but it
is not checked consistently. As a result, the entity expansion can cause
an unbound memory allocation.
The tests also revealed that the existing entity size validation logic
depends on the order of entity declarations - if they're declared in
the reverse order, then entitiy expansion simply does not happen.
The tests do not aim to reach the OOM condition, but rather check that
the expansion exceeds the entityCharacterLimit.
Another set of tests covers references to standard XML entities,
numeric character references, references to undefined entities,
references to entities that have empty values, and entity loops.
They all are supposed to cover corner cases that might trigger
unconstrained entity expansions.
The unknown_entity_in_attlist testcase required to add an
overload of attributeDecl() to the custom handler. That is
required to make sure that the entity size check fails before
ATTLIST is expanded, not after the entire DTD is parsed.
Otherwise ATTLIST itself can be uset to exhaust memory.
Task-number: QTBUG-149213
Pick-to: 6.12 6.8 6.5 5.15
Change-Id: Ic38fb280fc76784386c45e3a33b3eb3968a85d7e
Reviewed-by: MÃ¥rten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Marc Mutz <marc.mutz@qt.io>