shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-10-27 04:55:04 +03:00
Code Releases Activity

Fix buffer over-read in xmlParseNCNameComplex

Browse Source 
Calling GROW can halt the parser if the buffer grows too large. This
will set the buffer to an empty string. Return immediately in this case,
otherwise the "current" pointer is advanced leading to a buffer over-read.

Found with OSS-Fuzz. See

https://oss-fuzz.com/testcase?key=6683819592646656
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5031
This commit is contained in:
Nick Wellnhofer 2018-01-08 18:48:01 +01:00
parent ad88b54f1a
commit 132af1a0d1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
parser.c
View File

@ -3370,9 +3370,9 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
*/
ctxt->input->cur -= l;
GROW;
ctxt->input->cur += l;
if (ctxt->instate == XML_PARSER_EOF)
return(NULL);
ctxt->input->cur += l;
c = CUR_CHAR(l);
}
}