1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-01-26 10:03:34 +03:00

[CVE-2023-29469] Hashing of empty dict strings isn't deterministic

When hashing empty strings which aren't null-terminated,
xmlDictComputeFastKey could produce inconsistent results. This could
lead to various logic or memory errors, including double frees.

For consistency the seed is also taken into account, but this shouldn't
have an impact on security.

Found by OSS-Fuzz.

Fixes #510.
This commit is contained in:
Nick Wellnhofer 2023-04-07 11:49:27 +02:00
parent e4f85f1bd2
commit 547edbf1cb

3
dict.c
View File

@ -433,7 +433,8 @@ static unsigned long
xmlDictComputeFastKey(const xmlChar *name, int namelen, int seed) {
unsigned long value = seed;
if (name == NULL) return(0);
if ((name == NULL) || (namelen <= 0))
return(value);
value += *name;
value <<= 5;
if (namelen > 10) {