diff options
| author | Philip Withnall <philip.withnall@collabora.co.uk> | 2014-06-20 21:37:21 +0100 |
|---|---|---|
| committer | Daniel Veillard <veillard@redhat.com> | 2014-07-26 20:20:11 +0800 |
| commit | 4ba5d3176938d3435ddc7347cdc904658e2999ee (patch) | |
| tree | e1e3a173708befa941de27def300b10cfa46839a | |
| parent | 5777ae75ee0382149971a5bc2094f9d14e7e11f8 (diff) | |
| download | libxml2-4ba5d3176938d3435ddc7347cdc904658e2999ee.tar.gz | |
xmlschemastypes: Fix potential array overflow
The year and month need validating before being put into the
MAX_DAYINMONTH macro.
Coverity issue: #60436
https://bugzilla.gnome.org/show_bug.cgi?id=731990
| -rw-r--r-- | xmlschemastypes.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/xmlschemastypes.c b/xmlschemastypes.c index 7a56267c..ff64f50a 100644 --- a/xmlschemastypes.c +++ b/xmlschemastypes.c @@ -3854,7 +3854,8 @@ _xmlSchemaDateAdd (xmlSchemaValPtr dt, xmlSchemaValPtr dur) tmon = 12; tempdays += MAX_DAYINMONTH(tyr, tmon); carry = -1; - } else if (tempdays > (long) MAX_DAYINMONTH(r->year, r->mon)) { + } else if (VALID_YEAR(r->year) && VALID_MONTH(r->mon) && + tempdays > (long) MAX_DAYINMONTH(r->year, r->mon)) { tempdays = tempdays - MAX_DAYINMONTH(r->year, r->mon); carry = 1; } else |