shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-13 20:58:16 +03:00
Code

malloc-fail: Fix null deref after xmlSchemaCompareDates

Browse Source 
Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer 2023-03-05 14:10:56 +01:00
parent 961a4f35bf
commit 19b197b616
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
xmlschemastypes.c
View File

@ -4148,9 +4148,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
if (!y->value.date.tz_flag) {
p1 = xmlSchemaDateNormalize(x, 0);
if (p1 == NULL)
return -2;
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
/* normalize y + 14:00 */
q1 = xmlSchemaDateNormalize(y, (14 * SECS_PER_HOUR));
if (q1 == NULL) {
xmlSchemaFreeValue(p1);
return -2;
}
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
if (p1d < q1d) {
@ -4169,6 +4175,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
int ret = 0;
/* normalize y - 14:00 */
q2 = xmlSchemaDateNormalize(y, -(14 * SECS_PER_HOUR));
if (q2 == NULL) {
xmlSchemaFreeValue(p1);
xmlSchemaFreeValue(q1);
return -2;
}
q2d = _xmlSchemaDateCastYMToDays(q2) + q2->value.date.day;
if (p1d > q2d)
ret = 1;
@ -4192,10 +4203,16 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
}
} else if (y->value.date.tz_flag) {
q1 = xmlSchemaDateNormalize(y, 0);
if (q1 == NULL)
return -2;
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
/* normalize x - 14:00 */
p1 = xmlSchemaDateNormalize(x, -(14 * SECS_PER_HOUR));
if (p1 == NULL) {
xmlSchemaFreeValue(q1);
return -2;
}
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
if (p1d < q1d) {
@ -4214,6 +4231,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
int ret = 0;
/* normalize x + 14:00 */
p2 = xmlSchemaDateNormalize(x, (14 * SECS_PER_HOUR));
if (p2 == NULL) {
xmlSchemaFreeValue(p1);
xmlSchemaFreeValue(q1);
return -2;
}
p2d = _xmlSchemaDateCastYMToDays(p2) + p2->value.date.day;
if (p2d > q1d) {
@ -4243,9 +4265,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
if (x->type == y->type) {
int ret = 0;
q1 = xmlSchemaDateNormalize(y, 0);
if (q1 == NULL)
return -2;
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
p1 = xmlSchemaDateNormalize(x, 0);
if (p1 == NULL) {
xmlSchemaFreeValue(q1);
return -2;
}
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
if (p1d < q1d) {