Review amendments

lib/Epub/Epub/parsers/ContentOpfParser.cpp

@@ -21,9 +21,8 @@ std::string stripHtml(const std::string& html) {
   for (size_t i = 0; i < html.size(); ++i) {
     const char c = html[i];
     if (c == '<') {
-      // Only treat as a tag if followed by a tag-like character; otherwise keep literal '<'
-      size_t j = i + 1;
-      while (j < html.size() && html[j] == ' ') ++j;
+      // Only treat as a tag if immediately followed (no space skip) by a tag-like character
+      const size_t j = i + 1;
       if (j < html.size() &&
           (isalpha(static_cast<unsigned char>(html[j])) || html[j] == '/' || html[j] == '!' || html[j] == '?')) {
         inTag = true;
@@ -33,7 +32,11 @@ std::string stripHtml(const std::string& html) {
         result += c;
       }
     } else if (c == '>') {
-      inTag = false;
+      if (inTag) {
+        inTag = false;
+      } else {
+        result += c;
+      }
     } else if (!inTag) {
       if (c == '&') {
         // Decode common HTML entities not covered by Expat
@@ -196,7 +199,10 @@ void XMLCALL ContentOpfParser::startElement(void* userData, const XML_Char* name
   }
 
   if (self->state == IN_METADATA && strcmp(name, "dc:description") == 0) {
-    self->state = IN_BOOK_DESCRIPTION;
+    // Only capture the first dc:description element; subsequent ones are alternate/localized variants
+    if (self->description.empty()) {
+      self->state = IN_BOOK_DESCRIPTION;
+    }
     return;
   }
 
@@ -254,9 +260,9 @@ void XMLCALL ContentOpfParser::startElement(void* userData, const XML_Char* name
       if (strcmp(metaName, "cover") == 0) {
         self->coverItemId = metaContent;
       } else if (strcmp(metaName, "calibre:series") == 0 && self->series.empty()) {
-        self->series = metaContent;
+        self->series = std::string(metaContent).substr(0, MAX_DESCRIPTION_LENGTH);
       } else if (strcmp(metaName, "calibre:series_index") == 0 && self->seriesIndex.empty()) {
-        self->seriesIndex = metaContent;
+        self->seriesIndex = std::string(metaContent).substr(0, MAX_DESCRIPTION_LENGTH);
       }
     }
 
@@ -457,12 +463,18 @@ void XMLCALL ContentOpfParser::characterData(void* userData, const XML_Char* s,
   }
 
   if (self->state == IN_BOOK_SERIES) {
-    self->series.append(s, len);
+    if (self->series.size() < MAX_DESCRIPTION_LENGTH) {
+      const size_t remaining = MAX_DESCRIPTION_LENGTH - self->series.size();
+      self->series.append(s, std::min(static_cast<size_t>(len), remaining));
+    }
     return;
   }
 
   if (self->state == IN_BOOK_SERIES_INDEX) {
-    self->seriesIndex.append(s, len);
+    if (self->seriesIndex.size() < MAX_DESCRIPTION_LENGTH) {
+      const size_t remaining = MAX_DESCRIPTION_LENGTH - self->seriesIndex.size();
+      self->seriesIndex.append(s, std::min(static_cast<size_t>(len), remaining));
+    }
     return;
   }
 }

lib/Serialization/Serialization.h

@@ -36,17 +36,23 @@ static void writeString(FsFile& file, const std::string& s) {
   file.write(reinterpret_cast<const uint8_t*>(s.data()), len);
 }
 
-static void readString(std::istream& is, std::string& s) {
+constexpr uint32_t MAX_STRING_LENGTH = 4096;
+
+static bool readString(std::istream& is, std::string& s) {
   uint32_t len;
   readPod(is, len);
+  if (len > MAX_STRING_LENGTH) return false;
   s.resize(len);
   is.read(&s[0], len);
+  return true;
 }
 
-static void readString(FsFile& file, std::string& s) {
+static bool readString(FsFile& file, std::string& s) {
   uint32_t len;
   readPod(file, len);
+  if (len > MAX_STRING_LENGTH) return false;
   s.resize(len);
-  file.read(&s[0], len);
+  file.read(reinterpret_cast<uint8_t*>(&s[0]), len);
+  return true;
 }
 }  // namespace serialization