diff options
| author | Kirill Simonov <xi@resolvent.net> | 2014-03-26 07:03:17 -0500 |
|---|---|---|
| committer | Kirill Simonov <xi@resolvent.net> | 2014-03-26 07:03:17 -0500 |
| commit | d1003a9d40b674520934f4f38ffc4ff2a809bc2d (patch) | |
| tree | 70dbf2902eb1adb7dc89fa543728125a3b82ab3e /src | |
| parent | 662f4be270c519ae74b46404ed30cd5ed47735bc (diff) | |
| download | libyaml-git-d1003a9d40b674520934f4f38ffc4ff2a809bc2d.tar.gz | |
Fixed heap overflow in yaml_parser_scan_uri_escapes (Thanks Ivan Fratric of the Google Security Team).0.1.6
Diffstat (limited to 'src')
| -rw-r--r-- | src/scanner.c | 3 | ||||
| -rw-r--r-- | src/yaml_private.h | 7 |
2 files changed, 8 insertions, 2 deletions
diff --git a/src/scanner.c b/src/scanner.c index 8817de2..88d4fa5 100644 --- a/src/scanner.c +++ b/src/scanner.c @@ -2629,6 +2629,9 @@ yaml_parser_scan_tag_uri(yaml_parser_t *parser, int directive, /* Check if it is a URI-escape sequence. */ if (CHECK(parser->buffer, '%')) { + if (!STRING_EXTEND(parser, string)) + goto error; + if (!yaml_parser_scan_uri_escapes(parser, directive, start_mark, &string)) goto error; } diff --git a/src/yaml_private.h b/src/yaml_private.h index 9589e05..f0e1001 100644 --- a/src/yaml_private.h +++ b/src/yaml_private.h @@ -143,9 +143,12 @@ yaml_string_join( (string).start = (string).pointer = (string).end = 0) #define STRING_EXTEND(context,string) \ - (((string).pointer+5 < (string).end) \ + ((((string).pointer+5 < (string).end) \ || yaml_string_extend(&(string).start, \ - &(string).pointer, &(string).end)) + &(string).pointer, &(string).end)) ? \ + 1 : \ + ((context)->error = YAML_MEMORY_ERROR, \ + 0)) #define CLEAR(context,string) \ ((string).pointer = (string).start, \ |