diff --git a/codec/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java b/codec/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java index c4f7097435..4a8b262bf8 100644 --- a/codec/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java +++ b/codec/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java @@ -111,8 +111,16 @@ public class XmlFrameDecoder extends ByteToMessageDecoder { if (i < bufferLength - 1) { final byte peekAheadByte = in.getByte(i + 1); if (peekAheadByte == '/') { - // found we can decrement openBracketsCount + if (in.getByte(peekFurtherAheadIndex) == '>') { + openBracketsCount--; + break; + } + peekFurtherAheadIndex++; + } } else if (isValidStartCharForXmlElement(peekAheadByte)) { atLeastOneXmlElementFound = true; // char after < is a valid xml element start char, @@ -166,14 +174,15 @@ public class XmlFrameDecoder extends ByteToMessageDecoder { } final int readerIndex = in.readerIndex(); + int xmlElementLength = length - readerIndex; - if (openBracketsCount == 0 && length > 0) { - if (length >= bufferLength) { - length = in.readableBytes(); + if (openBracketsCount == 0 && xmlElementLength > 0) { + if (readerIndex + xmlElementLength >= bufferLength) { + xmlElementLength = in.readableBytes(); } final ByteBuf frame = - extractFrame(in, readerIndex + leadingWhiteSpaceCount, length - leadingWhiteSpaceCount); - in.skipBytes(length); + extractFrame(in, readerIndex + leadingWhiteSpaceCount, xmlElementLength - leadingWhiteSpaceCount); + in.skipBytes(xmlElementLength); out.add(frame); } } diff --git a/codec/src/test/java/io/netty/handler/codec/xml/XmlFrameDecoderTest.java b/codec/src/test/java/io/netty/handler/codec/xml/XmlFrameDecoderTest.java index 62f6719fd7..db3660accf 100644 --- a/codec/src/test/java/io/netty/handler/codec/xml/XmlFrameDecoderTest.java +++ b/codec/src/test/java/io/netty/handler/codec/xml/XmlFrameDecoderTest.java @@ -101,6 +101,12 @@ public class XmlFrameDecoderTest { testDecodeWithXml(" \n\r \t\ttrash", "", CorruptedFrameException.class); } + @Test + public void testDecodeInvalidXml() { + testDecodeWithXml("\n\n" + "\n\n"; + "msgnr=\"2\"/>\n" + + ""; final String frame1 = ""; final String frame2 = "\n\n"; - testDecodeWithXml(input, frame1, frame2); + final String frame3 = ""; + testDecodeWithXml(input, frame1, frame2, frame3); } @Test