diff options
| author | Pranjal Jumde <pjumde@apple.com> | 2016-03-01 11:34:04 -0800 |
|---|---|---|
| committer | Daniel Veillard <veillard@redhat.com> | 2016-05-23 15:01:07 +0800 |
| commit | a820dbeac29d330bae4be05d9ecd939ad6b4aa33 (patch) | |
| tree | 1f027e11ed873ef1b0535af7e98f8c5fa0e3d73a /HTMLparser.c | |
| parent | db07dd613e461df93dde7902c6505629bf0734e9 (diff) | |
| download | libxml2-CVE-2016-1839.tar.gz | |
Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605>CVE-2016-1839
Reviewed by David Kilzer.
* HTMLparser.c:
(htmlParseName): Add bounds check.
(htmlParseNameComplex): Ditto.
* result/HTML/758605.html: Added.
* result/HTML/758605.html.err: Added.
* result/HTML/758605.html.sax: Added.
* runtest.c:
(pushParseTest): The input for the new test case was so small
(4 bytes) that htmlParseChunk() was never called after
htmlCreatePushParserCtxt(), thereby creating a false positive
test failure. Fixed by using a do-while loop so we always call
htmlParseChunk() at least once.
* test/HTML/758605.html: Added.
Diffstat (limited to 'HTMLparser.c')
| -rw-r--r-- | HTMLparser.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/HTMLparser.c b/HTMLparser.c index 69eed2bd..1c112cc9 100644 --- a/HTMLparser.c +++ b/HTMLparser.c @@ -2471,6 +2471,10 @@ htmlParseName(htmlParserCtxtPtr ctxt) { (*in == '_') || (*in == '-') || (*in == ':') || (*in == '.')) in++; + + if (in == ctxt->input->end) + return(NULL); + if ((*in > 0) && (*in < 0x80)) { count = in - ctxt->input->cur; ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count); @@ -2514,6 +2518,10 @@ htmlParseNameComplex(xmlParserCtxtPtr ctxt) { NEXTL(l); c = CUR_CHAR(l); } + + if (ctxt->input->base > ctxt->input->cur - len) + return(NULL); + return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len)); } |