Nested repetitions such as ((a)*)* asked the group below for the same end
positions again and again, which is exponential in their depth: remember
the positions of a group per start position while one element's children
are matched. The search for the closing semicolon of a parameter-entity
reference had a 256-byte window, so a longer name was left unexpanded
without an error: stop the search at whitespace or the next percent sign
instead, which keeps a round linear and puts no limit on the name.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Parameter entities were expanded by up to eight rounds of text.replace
per entity over the whole text, so a few hundred bytes of DTD grew
exponentially and a large one cost entities x length per round. Expand
them one scan per round with a map, bound the result and the depth, and
refuse cycles. Content-model groups recursed once per parenthesis with
no limit (a stack overflow), and the positions after each item of a
sequence were kept as a list of paths (2^n for n optional items): limit
the nesting and keep the positions a set.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
