1 files changed, 28 insertions, 5 deletions

diff --git a/chromium/third_party/libxslt/libxslt/attributes.c b/chromium/third_party/libxslt/libxslt/attributes.c
index 2fa86e3c963..8440b103159 100644
--- a/chromium/third_party/libxslt/libxslt/attributes.c
+++ b/chromium/third_party/libxslt/libxslt/attributes.c
@@ -297,9 +297,11 @@ xsltParseStylesheetAttributeSet(xsltStylesheetPtr style, xmlNodePtr cur) {
 	return;
 
     value = xmlGetNsProp(cur, (const xmlChar *)"name", NULL);
-    if (value == NULL) {
+    if ((value == NULL) || (*value == 0)) {
 	xsltGenericError(xsltGenericErrorContext,
 	     "xsl:attribute-set : name is missing\n");
+        if (value)
+	    xmlFree(value);
 	return;
     }
 
@@ -482,19 +484,27 @@ xsltGetSAS(xsltStylesheetPtr style, const xmlChar *name, const xmlChar *ns) {
 }
 
 /**
- * xsltResolveSASCallback,:
+ * xsltResolveSASCallbackInt:
  * @style:  the XSLT stylesheet
  *
  * resolve the references in an attribute set.
  */
 static void
-xsltResolveSASCallback(xsltAttrElemPtr values, xsltStylesheetPtr style,
+xsltResolveSASCallbackInt(xsltAttrElemPtr values, xsltStylesheetPtr style,
 	               const xmlChar *name, const xmlChar *ns,
-		       ATTRIBUTE_UNUSED const xmlChar *ignored) {
+		       int depth) {
     xsltAttrElemPtr tmp;
     xsltAttrElemPtr refs;
 
     tmp = values;
+    if ((name == NULL) || (name[0] == 0))
+        return;
+    if (depth > 100) {
+	xsltGenericError(xsltGenericErrorContext,
+	"xsl:attribute-set : use-attribute-sets recursion detected on %s\n",
+			 name);
+	return;
+    }
     while (tmp != NULL) {
 	if (tmp->set != NULL) {
 	    /*
@@ -519,7 +529,7 @@ xsltResolveSASCallback(xsltAttrElemPtr values, xsltStylesheetPtr style,
 		    /*
 		     * recurse first for cleanup
 		     */
-		    xsltResolveSASCallback(refs, style, name, ns, NULL);
+		    xsltResolveSASCallbackInt(refs, style, name, ns, depth + 1);
 		    /*
 		     * Then merge
 		     */
@@ -537,6 +547,19 @@ xsltResolveSASCallback(xsltAttrElemPtr values, xsltStylesheetPtr style,
 }
 
 /**
+ * xsltResolveSASCallback,:
+ * @style:  the XSLT stylesheet
+ *
+ * resolve the references in an attribute set.
+ */
+static void
+xsltResolveSASCallback(xsltAttrElemPtr values, xsltStylesheetPtr style,
+	               const xmlChar *name, const xmlChar *ns,
+		       ATTRIBUTE_UNUSED const xmlChar *ignored) {
+    xsltResolveSASCallbackInt(values, style, name, ns, 1);
+}
+
+/**
  * xsltMergeSASCallback,:
  * @style:  the XSLT stylesheet
  *