You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
43 lines
1.7 KiB
43 lines
1.7 KiB
From 85ae9a2d7d0e9358f356b33977b842df8ebaec2b Mon Sep 17 00:00:00 2001 |
|
From: Sebastian Pipping <sebastian@pipping.org> |
|
Date: Sat, 25 Dec 2021 20:52:08 +0100 |
|
Subject: [PATCH] lib: Prevent integer overflow on m_groupSize in function |
|
doProlog (CVE-2021-46143) |
|
|
|
--- |
|
expat/lib/xmlparse.c | 15 +++++++++++++++ |
|
1 file changed, 15 insertions(+) |
|
|
|
diff --git a/lib/xmlparse.c b/lib/xmlparse.c |
|
index b47c31b0..8f243126 100644 |
|
--- a/lib/xmlparse.c |
|
+++ b/lib/xmlparse.c |
|
@@ -5046,6 +5046,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, |
|
if (parser->m_prologState.level >= parser->m_groupSize) { |
|
if (parser->m_groupSize) { |
|
{ |
|
+ /* Detect and prevent integer overflow */ |
|
+ if (parser->m_groupSize > (unsigned int)(-1) / 2u) { |
|
+ return XML_ERROR_NO_MEMORY; |
|
+ } |
|
+ |
|
char *const new_connector = (char *)REALLOC( |
|
parser, parser->m_groupConnector, parser->m_groupSize *= 2); |
|
if (new_connector == NULL) { |
|
@@ -5056,6 +5061,16 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, |
|
} |
|
|
|
if (dtd->scaffIndex) { |
|
+ /* Detect and prevent integer overflow. |
|
+ * The preprocessor guard addresses the "always false" warning |
|
+ * from -Wtype-limits on platforms where |
|
+ * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */ |
|
+#if UINT_MAX >= SIZE_MAX |
|
+ if (parser->m_groupSize > (size_t)(-1) / sizeof(int)) { |
|
+ return XML_ERROR_NO_MEMORY; |
|
+ } |
|
+#endif |
|
+ |
|
int *const new_scaff_index = (int *)REALLOC( |
|
parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int)); |
|
if (new_scaff_index == NULL)
|
|
|