shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-10-26 12:25:09 +03:00
Code Releases Activity

Validate UTF8 in xmlEncodeEntities

Browse Source 
Code is currently assuming UTF-8 without validating. Truncated UTF-8
input can cause out-of-bounds array access.

Adds further checks to partial fix in 50f06b3e.

Fixes #178
This commit is contained in:
Joel Hockey 2020-08-16 17:19:35 -07:00 committed by Nick Wellnhofer
parent 1358d157d0
commit bf22713507
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
entities.c
View File

@ -704,11 +704,25 @@ xmlEncodeEntitiesInternal(xmlDocPtr doc, const xmlChar *input, int attr) {
} else {
/*
* We assume we have UTF-8 input.
* It must match either:
* 110xxxxx 10xxxxxx
* 1110xxxx 10xxxxxx 10xxxxxx
* 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
* That is:
* cur[0] is 11xxxxxx
* cur[1] is 10xxxxxx
* cur[2] is 10xxxxxx if cur[0] is 111xxxxx
* cur[3] is 10xxxxxx if cur[0] is 1111xxxx
* cur[0] is not 11111xxx
*/
char buf[11], *ptr;
int val = 0, l = 1;
if (*cur < 0xC0) {
if (((cur[0] & 0xC0) != 0xC0) ||
((cur[1] & 0xC0) != 0x80) ||
(((cur[0] & 0xE0) == 0xE0) && ((cur[2] & 0xC0) != 0x80)) ||
(((cur[0] & 0xF0) == 0xF0) && ((cur[3] & 0xC0) != 0x80)) ||
(((cur[0] & 0xF8) == 0xF8))) {
xmlEntitiesErr(XML_CHECK_NOT_UTF8,
"xmlEncodeEntities: input not UTF-8");
if (doc != NULL)