|
 |
1c8959 |
commit 3018042fd3c11c3d6cda36b3cbae4f7bb4f20c3d
|
|
|
1c8959 |
Author: Pranjal Jumde <pjumde@apple.com>
|
|
|
1c8959 |
Date: Tue Mar 1 11:34:04 2016 -0800
|
|
|
1c8959 |
|
|
|
1c8959 |
Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605>
|
|
|
1c8959 |
|
|
|
1c8959 |
Reviewed by David Kilzer.
|
|
|
1c8959 |
|
|
|
1c8959 |
* HTMLparser.c:
|
|
|
1c8959 |
(htmlParseName): Add bounds check.
|
|
|
1c8959 |
(htmlParseNameComplex): Ditto.
|
|
|
1c8959 |
* result/HTML/758605.html: Added.
|
|
|
1c8959 |
* result/HTML/758605.html.err: Added.
|
|
|
1c8959 |
* result/HTML/758605.html.sax: Added.
|
|
|
1c8959 |
* runtest.c:
|
|
|
1c8959 |
(pushParseTest): The input for the new test case was so small
|
|
|
1c8959 |
(4 bytes) that htmlParseChunk() was never called after
|
|
|
1c8959 |
htmlCreatePushParserCtxt(), thereby creating a false positive
|
|
|
1c8959 |
test failure. Fixed by using a do-while loop so we always call
|
|
|
1c8959 |
htmlParseChunk() at least once.
|
|
|
1c8959 |
* test/HTML/758605.html: Added.
|
|
|
1c8959 |
|
|
|
1c8959 |
diff --git a/HTMLparser.c b/HTMLparser.c
|
|
|
1c8959 |
index 4331d53..a897cb0 100644
|
|
|
1c8959 |
--- a/HTMLparser.c
|
|
|
1c8959 |
+++ b/HTMLparser.c
|
|
|
1c8959 |
@@ -2471,6 +2471,10 @@ htmlParseName(htmlParserCtxtPtr ctxt) {
|
|
|
1c8959 |
(*in == '_') || (*in == '-') ||
|
|
|
1c8959 |
(*in == ':') || (*in == '.'))
|
|
|
1c8959 |
in++;
|
|
|
1c8959 |
+
|
|
|
1c8959 |
+ if (in == ctxt->input->end)
|
|
|
1c8959 |
+ return(NULL);
|
|
|
1c8959 |
+
|
|
|
1c8959 |
if ((*in > 0) && (*in < 0x80)) {
|
|
|
1c8959 |
count = in - ctxt->input->cur;
|
|
|
1c8959 |
ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count);
|
|
|
1c8959 |
@@ -2514,6 +2518,10 @@ htmlParseNameComplex(xmlParserCtxtPtr ctxt) {
|
|
|
1c8959 |
NEXTL(l);
|
|
|
1c8959 |
c = CUR_CHAR(l);
|
|
|
1c8959 |
}
|
|
|
1c8959 |
+
|
|
|
1c8959 |
+ if (ctxt->input->base > ctxt->input->cur - len)
|
|
|
1c8959 |
+ return(NULL);
|
|
|
1c8959 |
+
|
|
|
1c8959 |
return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
|
|
|
1c8959 |
}
|
|
|
1c8959 |
|
|
|
1c8959 |
diff --git a/result/HTML/758605.html b/result/HTML/758605.html
|
|
|
1c8959 |
new file mode 100644
|
|
|
1c8959 |
index 0000000..a085cce
|
|
|
1c8959 |
--- /dev/null
|
|
|
1c8959 |
+++ b/result/HTML/758605.html
|
|
|
1c8959 |
@@ -0,0 +1,3 @@
|
|
|
1c8959 |
+
|
|
|
1c8959 |
+<html><body>&
|
|
|
1c8959 |
+</body></html>
|
|
|
1c8959 |
diff --git a/result/HTML/758605.html.err b/result/HTML/758605.html.err
|
|
|
1c8959 |
new file mode 100644
|
|
|
1c8959 |
index 0000000..2b82be6
|
|
|
1c8959 |
--- /dev/null
|
|
|
1c8959 |
+++ b/result/HTML/758605.html.err
|
|
|
1c8959 |
@@ -0,0 +1,3 @@
|
|
|
1c8959 |
+./test/HTML/758605.html:1: HTML parser error : htmlParseEntityRef: no name
|
|
|
1c8959 |
+ê
|
|
|
1c8959 |
+ ^
|
|
|
1c8959 |
diff --git a/result/HTML/758605.html.sax b/result/HTML/758605.html.sax
|
|
|
1c8959 |
new file mode 100644
|
|
|
1c8959 |
index 0000000..1f5cd32
|
|
|
1c8959 |
--- /dev/null
|
|
|
1c8959 |
+++ b/result/HTML/758605.html.sax
|
|
|
1c8959 |
@@ -0,0 +1,13 @@
|
|
|
1c8959 |
+SAX.setDocumentLocator()
|
|
|
1c8959 |
+SAX.startDocument()
|
|
|
1c8959 |
+SAX.error: htmlParseEntityRef: no name
|
|
|
1c8959 |
+SAX.startElement(html)
|
|
|
1c8959 |
+SAX.startElement(body)
|
|
|
1c8959 |
+SAX.startElement(p)
|
|
|
1c8959 |
+SAX.characters(&, 1)
|
|
|
1c8959 |
+SAX.ignorableWhitespace(
|
|
|
1c8959 |
+, 1)
|
|
|
1c8959 |
+SAX.endElement(p)
|
|
|
1c8959 |
+SAX.endElement(body)
|
|
|
1c8959 |
+SAX.endElement(html)
|
|
|
1c8959 |
+SAX.endDocument()
|
|
|
1c8959 |
diff --git a/runtest.c b/runtest.c
|
|
|
1c8959 |
index ccdd49b..0afa788 100644
|
|
|
1c8959 |
--- a/runtest.c
|
|
|
1c8959 |
+++ b/runtest.c
|
|
|
1c8959 |
@@ -1824,7 +1824,7 @@ pushParseTest(const char *filename, const char *result,
|
|
|
1c8959 |
ctxt = xmlCreatePushParserCtxt(NULL, NULL, base + cur, 4, filename);
|
|
|
1c8959 |
xmlCtxtUseOptions(ctxt, options);
|
|
|
1c8959 |
cur += 4;
|
|
|
1c8959 |
- while (cur < size) {
|
|
|
1c8959 |
+ do {
|
|
|
1c8959 |
if (cur + 1024 >= size) {
|
|
|
1c8959 |
#ifdef LIBXML_HTML_ENABLED
|
|
|
1c8959 |
if (options & XML_PARSE_HTML)
|
|
|
1c8959 |
@@ -1842,7 +1842,7 @@ pushParseTest(const char *filename, const char *result,
|
|
|
1c8959 |
xmlParseChunk(ctxt, base + cur, 1024, 0);
|
|
|
1c8959 |
cur += 1024;
|
|
|
1c8959 |
}
|
|
|
1c8959 |
- }
|
|
|
1c8959 |
+ } while (cur < size);
|
|
|
1c8959 |
doc = ctxt->myDoc;
|
|
|
1c8959 |
#ifdef LIBXML_HTML_ENABLED
|
|
|
1c8959 |
if (options & XML_PARSE_HTML)
|
|
|
1c8959 |
diff --git a/test/HTML/758605.html b/test/HTML/758605.html
|
|
|
1c8959 |
new file mode 100644
|
|
|
1c8959 |
index 0000000..9b1b3c2
|
|
|
1c8959 |
--- /dev/null
|
|
|
1c8959 |
+++ b/test/HTML/758605.html
|
|
|
1c8959 |
@@ -0,0 +1 @@
|
|
|
1c8959 |
+&:ê
|