diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2019-06-03 13:14:45 +0200 |
|---|---|---|
| committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2019-06-19 16:11:03 +0200 |
| commit | 6ce8de69330783977dd14f6569419489875fb71b (patch) | |
| tree | 0cc63b080868601b461e1dba931ac3b3526d19eb | |
| parent | b6199a2365bc292e49cbe6c7580936081273f963 (diff) | |
| download | libxslt-6ce8de69330783977dd14f6569419489875fb71b.tar.gz | |
Fix uninitialized read with UTF-8 grouping chars
The character type in xsltFormatNumberConversion was too narrow and
an invalid character/length combination could be passed to
xsltNumberFormatDecimal, resulting in an uninitialized read.
Found by OSS-Fuzz.
| -rw-r--r-- | libxslt/numbers.c | 5 | ||||
| -rw-r--r-- | tests/docs/bug-222.xml | 1 | ||||
| -rw-r--r-- | tests/general/bug-222.out | 2 | ||||
| -rw-r--r-- | tests/general/bug-222.xsl | 6 |
4 files changed, 12 insertions, 2 deletions
diff --git a/libxslt/numbers.c b/libxslt/numbers.c index f1ed8846..20b99d5a 100644 --- a/libxslt/numbers.c +++ b/libxslt/numbers.c @@ -1298,13 +1298,14 @@ OUTPUT_NUMBER: number = floor((scale * number + 0.5)) / scale; if ((self->grouping != NULL) && (self->grouping[0] != 0)) { + int gchar; len = xmlStrlen(self->grouping); - pchar = xsltGetUTF8Char(self->grouping, &len); + gchar = xsltGetUTF8Char(self->grouping, &len); xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0], format_info.integer_digits, format_info.group, - pchar, len); + gchar, len); } else xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0], format_info.integer_digits, diff --git a/tests/docs/bug-222.xml b/tests/docs/bug-222.xml new file mode 100644 index 00000000..69d62f2c --- /dev/null +++ b/tests/docs/bug-222.xml @@ -0,0 +1 @@ +<doc/> diff --git a/tests/general/bug-222.out b/tests/general/bug-222.out new file mode 100644 index 00000000..e3139698 --- /dev/null +++ b/tests/general/bug-222.out @@ -0,0 +1,2 @@ +<?xml version="1.0"?> +1⠢0 diff --git a/tests/general/bug-222.xsl b/tests/general/bug-222.xsl new file mode 100644 index 00000000..e32dc473 --- /dev/null +++ b/tests/general/bug-222.xsl @@ -0,0 +1,6 @@ +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:decimal-format name="f" grouping-separator="⠢"/> + <xsl:template match="/"> + <xsl:value-of select="format-number(10,'#⠢0','f')"/> + </xsl:template> +</xsl:stylesheet> |