From 687a2b719e1252a9ca438460e727a4ca616b6c31 Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer Date: Mon, 8 May 2023 17:05:13 +0200 Subject: xinclude: Lower initial table size when fuzzing We don't have test cases with many documents, so set the initial table size to 1 when fuzzing, so there is a chance to detect reallocation issues. --- xinclude.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/xinclude.c b/xinclude.c index 949c768a..fadf4183 100644 --- a/xinclude.c +++ b/xinclude.c @@ -266,7 +266,11 @@ xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI, ret->inc = NULL; if (ctxt->incNr >= ctxt->incMax) { xmlXIncludeRefPtr *tmp; +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + size_t newSize = ctxt->incMax ? ctxt->incMax * 2 : 1; +#else size_t newSize = ctxt->incMax ? ctxt->incMax * 2 : 4; +#endif tmp = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab, newSize * sizeof(ctxt->incTab[0])); @@ -1344,7 +1348,11 @@ xmlXIncludeLoadDoc(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, /* Also cache NULL docs */ if (ctxt->urlNr >= ctxt->urlMax) { xmlXIncludeDoc *tmp; +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + size_t newSize = ctxt->urlMax ? ctxt->urlMax * 2 : 1; +#else size_t newSize = ctxt->urlMax ? ctxt->urlMax * 2 : 8; +#endif tmp = xmlRealloc(ctxt->urlTab, sizeof(xmlXIncludeDoc) * newSize); if (tmp == NULL) { @@ -1752,7 +1760,11 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, if (ctxt->txtNr >= ctxt->txtMax) { xmlXIncludeTxt *tmp; +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + size_t newSize = ctxt->txtMax ? ctxt->txtMax * 2 : 1; +#else size_t newSize = ctxt->txtMax ? ctxt->txtMax * 2 : 8; +#endif tmp = xmlRealloc(ctxt->txtTab, sizeof(xmlXIncludeTxt) * newSize); if (tmp == NULL) { -- cgit v1.2.1