shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-01-27 14:03:36 +03:00
Code

Fix integer overflow when parsing {min,max}Occurs

Browse Source 
Clamp value to INT_MAX.

Found with libFuzzer and UBSan.
This commit is contained in:
Nick Wellnhofer 2020-06-21 16:26:38 +02:00
parent 50f18830e1
commit 070d635e77
1 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
xmlschemas.c
View File

@ -6074,7 +6074,16 @@ xmlGetMaxOccurs(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node,
return (def);
}
while ((*cur >= '0') && (*cur <= '9')) {
ret = ret * 10 + (*cur - '0');
if (ret > INT_MAX / 10) {
ret = INT_MAX;
} else {
int digit = *cur - '0';
ret *= 10;
if (ret > INT_MAX - digit)
ret = INT_MAX;
else
ret += digit;
}
cur++;
}
while (IS_BLANK_CH(*cur))
@ -6126,7 +6135,16 @@ xmlGetMinOccurs(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node,
return (def);
}
while ((*cur >= '0') && (*cur <= '9')) {
ret = ret * 10 + (*cur - '0');
if (ret > INT_MAX / 10) {
ret = INT_MAX;
} else {
int digit = *cur - '0';
ret *= 10;
if (ret > INT_MAX - digit)
ret = INT_MAX;
else
ret += digit;
}
cur++;
}
while (IS_BLANK_CH(*cur))