shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-24 06:50:08 +03:00
Code

parser: Halt parser when growing buffer results in OOM

Browse Source 
Fix short-lived regression from previous commit.

It might be safer to make xmlBufSetInputBaseCur use the original buffer
even in case of errors.

Found by OSS-Fuzz.
This commit is contained in:
Nick Wellnhofer 2023-06-08 21:53:05 +02:00
parent 20f5c73457
commit b236b7a588
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
buf.c
View File

@ -1100,6 +1100,10 @@ xmlBufSetInputBaseCur(xmlBufPtr buf, xmlParserInputPtr input,
size_t base, size_t cur) {
if (input == NULL)
return(-1);
/*
* TODO: It might be safer to keep using the buffer content if there
* was an error.
*/
if ((buf == NULL) || (buf->error)) {
input->base = input->cur = input->end = BAD_CAST "";
return(-1);

4
encoding.c
View File

@ -2143,8 +2143,10 @@ xmlCharEncInput(xmlParserInputBufferPtr input, int flush)
toconv = 64 * 1024;
written = xmlBufAvail(out);
if (toconv * 2 >= written) {
if (xmlBufGrow(out, toconv * 2) < 0)
if (xmlBufGrow(out, toconv * 2) < 0) {
input->error = XML_ERR_NO_MEMORY;
return(XML_ENC_ERR_MEMORY);
}
written = xmlBufAvail(out);
}
if ((written > 128 * 1024) && (flush == 0))

6
parserInternals.c
View File

@ -566,8 +566,12 @@ xmlParserGrow(xmlParserCtxtPtr ctxt) {
ret = xmlParserInputBufferGrow(buf, INPUT_CHUNK);
xmlBufSetInputBaseCur(buf->buffer, in, 0, curBase);
if (ret < 0)
if (ret < 0) {
xmlFatalErr(ctxt, buf->error, NULL);
/* Buffer contents may be lost in case of memory errors. */
if (buf->error == XML_ERR_NO_MEMORY)
xmlHaltParser(ctxt);
}
return(ret);
}