From bad71da95fef645535a6031aa4a0f3811a7aa116 Mon Sep 17 00:00:00 2001
From: Robert Middleton <robert.middleton@rm5248.com>
Date: Sat, 1 Feb 2025 10:37:35 -0500
Subject: [PATCH] Fix empty appender ref recursion

If an appender-ref tag is added with no ref, parsing the XML file gets stuck
in a recursive loop until the stack overflows.  Check to make sure that the
ref attribute is in the XML file.
---
 src/main/cpp/domconfigurator.cpp                       |  6 +++++-
 src/test/cpp/xml/domtestcase.cpp                       |  7 +++++++
 .../resources/input/xml/DOMConfiguratorRecursive.xml   | 10 ++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 src/test/resources/input/xml/DOMConfiguratorRecursive.xml

diff --git a/src/main/cpp/domconfigurator.cpp b/src/main/cpp/domconfigurator.cpp
index b734b6f60..8b29e9dee 100644
--- a/src/main/cpp/domconfigurator.cpp
+++ b/src/main/cpp/domconfigurator.cpp
@@ -295,7 +295,7 @@ AppenderPtr DOMConfigurator::parseAppender(Pool& p,
 			{
 				LogString refName = subst(getAttribute(utf8Decoder, currentElement, REF_ATTR));
 
-				if (appender->instanceof(AppenderAttachable::getStaticClass()))
+				if (!refName.empty() && appender->instanceof(AppenderAttachable::getStaticClass()))
 				{
 					AppenderAttachablePtr aa = LOG4CXX_NS::cast<AppenderAttachable>(appender);
 					if (LogLog::isDebugEnabled())
@@ -306,6 +306,10 @@ AppenderPtr DOMConfigurator::parseAppender(Pool& p,
 					}
 					aa->addAppender(findAppenderByReference(p, utf8Decoder, currentElement, doc, appenders));
 				}
+				else if (refName.empty())
+				{
+					LogLog::error(LOG4CXX_STR("Can't add appender with empty ref attribute"));
+				}
 				else
 				{
 					LogLog::error(LOG4CXX_STR("Requesting attachment of appender named [") +
diff --git a/src/test/cpp/xml/domtestcase.cpp b/src/test/cpp/xml/domtestcase.cpp
index e254868b0..6ff9820f7 100644
--- a/src/test/cpp/xml/domtestcase.cpp
+++ b/src/test/cpp/xml/domtestcase.cpp
@@ -53,6 +53,7 @@ LOGUNIT_CLASS(DOMTestCase)
 #endif
 	LOGUNIT_TEST(test3);
 	LOGUNIT_TEST(test4);
+	LOGUNIT_TEST(recursiveAppenderRef);
 	LOGUNIT_TEST_SUITE_END();
 
 	LoggerPtr root;
@@ -226,6 +227,12 @@ LOGUNIT_CLASS(DOMTestCase)
 		bool exists = file.exists(p);
 		LOGUNIT_ASSERT(exists);
 	}
+
+	void recursiveAppenderRef()
+	{
+		// Load a bad XML file, make sure that we don't crash in endless recursion
+		DOMConfigurator::configure(LOG4CXX_TEST_STR("input/xml/DOMConfiguratorRecursive.xml"));
+	}
 };
 
 LOGUNIT_TEST_SUITE_REGISTRATION(DOMTestCase);
diff --git a/src/test/resources/input/xml/DOMConfiguratorRecursive.xml b/src/test/resources/input/xml/DOMConfiguratorRecursive.xml
new file mode 100644
index 000000000..1ee21f7a9
--- /dev/null
+++ b/src/test/resources/input/xml/DOMConfiguratorRecursive.xml
@@ -0,0 +1,10 @@
+<log4j:configuration xmlns:log4j=" ">
+  <appender class="AsyncAppender">
+    <appender-ref/>
+  </appender>
+
+  <logger>
+    <appender-ref/>
+  </logger>
+
+</log4j:configuration>