• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1From ede41d1e186ed2aba88a06e84cac839b770af3a1 Mon Sep 17 00:00:00 2001
2From: Sebastian Pipping <sebastian@pipping.org>
3Date: Wed, 26 Jan 2022 02:36:43 +0100
4Subject: [PATCH] lib: Prevent integer overflow in doProlog
5 (CVE-2022-23990)
6
7The change from "int nameLen" to "size_t nameLen"
8addresses the overflow on "nameLen++" in code
9"for (; name[nameLen++];)" right above the second
10change in the patch.
11---
12 lib/xmlparse.c | 10 ++++++++--
13 1 file changed, 8 insertions(+), 2 deletions(-)
14
15diff --git a/lib/xmlparse.c b/lib/xmlparse.c
16index 5ce3140..d1d1700 100644
17--- a/lib/xmlparse.c
18+++ b/lib/xmlparse.c
19@@ -5372,7 +5372,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
20       if (dtd->in_eldecl) {
21         ELEMENT_TYPE *el;
22         const XML_Char *name;
23-        int nameLen;
24+        size_t nameLen;
25         const char *nxt
26             = (quant == XML_CQUANT_NONE ? next : next - enc->minBytesPerChar);
27         int myindex = nextScaffoldPart(parser);
28@@ -5388,7 +5388,13 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
29         nameLen = 0;
30         for (; name[nameLen++];)
31           ;
32-        dtd->contentStringLen += nameLen;
33+
34+        /* Detect and prevent integer overflow */
35+        if (nameLen > UINT_MAX - dtd->contentStringLen) {
36+          return XML_ERROR_NO_MEMORY;
37+        }
38+
39+        dtd->contentStringLen += (unsigned)nameLen;
40         if (parser->m_elementDeclHandler)
41           handleDefault = XML_FALSE;
42       }
43--
441.8.3.1
45
46