|
 |
267d54 |
From 466ef17b8cf8d68393f3a56cda8e7a5504aacf98 Mon Sep 17 00:00:00 2001
|
|
|
267d54 |
From: Daniel Veillard <veillard@redhat.com>
|
|
|
267d54 |
Date: Fri, 30 Oct 2015 21:14:55 +0800
|
|
|
267d54 |
Subject: [PATCH] Fix parsing short unclosed comment uninitialized access
|
|
|
267d54 |
To: libvir-list@redhat.com
|
|
|
267d54 |
|
|
|
267d54 |
For https://bugzilla.gnome.org/show_bug.cgi?id=746048
|
|
|
267d54 |
The HTML parser was too optimistic when processing comments and
|
|
|
267d54 |
didn't check for the end of the stream on the first 2 characters
|
|
|
267d54 |
|
|
|
267d54 |
Signed-off-by: Daniel Veillard <veillard@redhat.com>
|
|
|
267d54 |
---
|
|
|
267d54 |
HTMLparser.c | 21 ++++++++++++++-------
|
|
|
267d54 |
1 file changed, 14 insertions(+), 7 deletions(-)
|
|
|
267d54 |
|
|
|
267d54 |
diff --git a/HTMLparser.c b/HTMLparser.c
|
|
|
267d54 |
index dd0c1ea..cab499a 100644
|
|
|
267d54 |
--- a/HTMLparser.c
|
|
|
267d54 |
+++ b/HTMLparser.c
|
|
|
267d54 |
@@ -3245,12 +3245,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
|
|
|
267d54 |
ctxt->instate = state;
|
|
|
267d54 |
return;
|
|
|
267d54 |
}
|
|
|
267d54 |
+ len = 0;
|
|
|
267d54 |
+ buf[len] = 0;
|
|
|
267d54 |
q = CUR_CHAR(ql);
|
|
|
267d54 |
+ if (!IS_CHAR(q))
|
|
|
267d54 |
+ goto unfinished;
|
|
|
267d54 |
NEXTL(ql);
|
|
|
267d54 |
r = CUR_CHAR(rl);
|
|
|
267d54 |
+ if (!IS_CHAR(r))
|
|
|
267d54 |
+ goto unfinished;
|
|
|
267d54 |
NEXTL(rl);
|
|
|
267d54 |
cur = CUR_CHAR(l);
|
|
|
267d54 |
- len = 0;
|
|
|
267d54 |
while (IS_CHAR(cur) &&
|
|
|
267d54 |
((cur != '>') ||
|
|
|
267d54 |
(r != '-') || (q != '-'))) {
|
|
|
267d54 |
@@ -3281,18 +3286,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
|
|
|
267d54 |
}
|
|
|
267d54 |
}
|
|
|
267d54 |
buf[len] = 0;
|
|
|
267d54 |
- if (!IS_CHAR(cur)) {
|
|
|
267d54 |
- htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
|
|
|
267d54 |
- "Comment not terminated \n
|
|
|
267d54 |
- xmlFree(buf);
|
|
|
267d54 |
- } else {
|
|
|
267d54 |
+ if (IS_CHAR(cur)) {
|
|
|
267d54 |
NEXT;
|
|
|
267d54 |
if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
|
|
|
267d54 |
(!ctxt->disableSAX))
|
|
|
267d54 |
ctxt->sax->comment(ctxt->userData, buf);
|
|
|
267d54 |
xmlFree(buf);
|
|
|
267d54 |
+ ctxt->instate = state;
|
|
|
267d54 |
+ return;
|
|
|
267d54 |
}
|
|
|
267d54 |
- ctxt->instate = state;
|
|
|
267d54 |
+
|
|
|
267d54 |
+unfinished:
|
|
|
267d54 |
+ htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
|
|
|
267d54 |
+ "Comment not terminated \n
|
|
|
267d54 |
+ xmlFree(buf);
|
|
|
267d54 |
}
|
|
|
267d54 |
|
|
|
267d54 |
/**
|
|
|
267d54 |
--
|
|
|
267d54 |
2.5.0
|
|
|
267d54 |
|