From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Mon, 19 Aug 2024 22:34:13 +0200 Subject: [PATCH 2/3] lib: Detect integer overflow in dtdCopy Reported by TaiYou --- lib/xmlparse.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/lib/xmlparse.c b/lib/xmlparse.c index f4e3d2a..a6d92f4 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -6639,6 +6639,16 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd, const XML_Memory_H if (!newE) return 0; if (oldE->nDefaultAtts) { + /* Detect and prevent integer overflow. + * The preprocessor guard addresses the "always false" warning + * from -Wtype-limits on platforms where + * sizeof(int) < sizeof(size_t), e.g. on x86_64. */ +#if UINT_MAX >= SIZE_MAX + if ((size_t)oldE->nDefaultAtts + > ((size_t)(-1) / sizeof(DEFAULT_ATTRIBUTE))) { + return 0; + } +#endif newE->defaultAtts = (DEFAULT_ATTRIBUTE *) ms->malloc_fcn(oldE->nDefaultAtts * sizeof(DEFAULT_ATTRIBUTE)); if (!newE->defaultAtts) {