diff options
author | Sebastian Pipping <sebastian@pipping.org> | 2021-12-25 20:52:08 +0100 |
---|---|---|
committer | Sebastian Pipping <sebastian@pipping.org> | 2022-01-10 16:51:14 +0100 |
commit | 85ae9a2d7d0e9358f356b33977b842df8ebaec2b (patch) | |
tree | 5d1b81c5a2c9f34457740f90e37325d4b2113110 | |
parent | b6b432bad559b7dcd60ed3da36db3881abb08457 (diff) | |
download | libexpat-git-85ae9a2d7d0e9358f356b33977b842df8ebaec2b.tar.gz |
lib: Prevent integer overflow on m_groupSize in function doProlog (CVE-2021-46143)
-rw-r--r-- | expat/lib/xmlparse.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c index b47c31b0..8f243126 100644 --- a/expat/lib/xmlparse.c +++ b/expat/lib/xmlparse.c @@ -5046,6 +5046,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, if (parser->m_prologState.level >= parser->m_groupSize) { if (parser->m_groupSize) { { + /* Detect and prevent integer overflow */ + if (parser->m_groupSize > (unsigned int)(-1) / 2u) { + return XML_ERROR_NO_MEMORY; + } + char *const new_connector = (char *)REALLOC( parser, parser->m_groupConnector, parser->m_groupSize *= 2); if (new_connector == NULL) { @@ -5056,6 +5061,16 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, } if (dtd->scaffIndex) { + /* Detect and prevent integer overflow. + * The preprocessor guard addresses the "always false" warning + * from -Wtype-limits on platforms where + * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */ +#if UINT_MAX >= SIZE_MAX + if (parser->m_groupSize > (size_t)(-1) / sizeof(int)) { + return XML_ERROR_NO_MEMORY; + } +#endif + int *const new_scaff_index = (int *)REALLOC( parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int)); if (new_scaff_index == NULL) |