shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-27 18:50:07 +03:00
Code

malloc-fail: Fix null deref if growing input buffer fails

Browse Source 
Also add some error checks.

Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer 2023-01-22 14:52:06 +01:00
parent 0c5f40b788
commit 2355eac59e
3 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
encoding.c
View File

@ -2332,7 +2332,8 @@ xmlCharEncInput(xmlParserInputBufferPtr input, int flush)
toconv = 64 * 1024;
written = xmlBufAvail(out);
if (toconv * 2 >= written) {
xmlBufGrow(out, toconv * 2);
if (xmlBufGrow(out, toconv * 2) < 0)
return (-1);
written = xmlBufAvail(out);
}
if ((written > 128 * 1024) && (flush == 0))

6
parserInternals.c
View File

@ -315,6 +315,12 @@ xmlParserInputGrow(xmlParserInputPtr in, int len) {
ret = xmlParserInputBufferGrow(in->buf, len);
in->base = xmlBufContent(in->buf->buffer);
if (in->base == NULL) {
in->base = BAD_CAST "";
in->cur = in->base;
in->end = in->base;
return(-1);
}
in->cur = in->base + indx;
in->end = xmlBufEnd(in->buf->buffer);

3
xmlIO.c
View File

@ -3218,7 +3218,8 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) {
if (res < 0)
return(-1);
xmlBufAddLen(buf, res);
if (xmlBufAddLen(buf, res) < 0)
return(-1);
}
/*