mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-06-26 14:42:13 +00:00
202033c013
This adds 3 expat patches for n-asb-2022-09 from https://github.com/syphyr/android_external_expat/commits/cm-14.1 and also applies 2 of them to 15.1 Signed-off-by: Tad <tad@spotco.us>
55 lines
1.9 KiB
Diff
55 lines
1.9 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Sadaf Ebrahimi <sadafebrahimi@google.com>
|
|
Date: Fri, 3 Jun 2022 03:40:21 +0000
|
|
Subject: [PATCH] Prevent integer overflow in function doProlog
|
|
|
|
Bug: http://b/221256678
|
|
Change-Id: I6fe381103f4eb287726d1ccb5bfec99db160ffe4
|
|
(cherry picked from commit 257f1d3777240016d3ccd74a61cd7d0e0efcaae3)
|
|
Merged-In: I6fe381103f4eb287726d1ccb5bfec99db160ffe4
|
|
---
|
|
lib/xmlparse.c | 20 +++++++++++++-------
|
|
1 file changed, 13 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
|
|
index ee4de203..6c8a3a57 100644
|
|
--- a/lib/xmlparse.c
|
|
+++ b/lib/xmlparse.c
|
|
@@ -4667,23 +4667,29 @@ doProlog(XML_Parser parser,
|
|
if (dtd->in_eldecl) {
|
|
ELEMENT_TYPE *el;
|
|
const XML_Char *name;
|
|
- int nameLen;
|
|
- const char *nxt = (quant == XML_CQUANT_NONE
|
|
- ? next
|
|
- : next - enc->minBytesPerChar);
|
|
+ size_t nameLen;
|
|
+ const char *nxt
|
|
+ = (quant == XML_CQUANT_NONE ? next : next - enc->minBytesPerChar);
|
|
int myindex = nextScaffoldPart(parser);
|
|
if (myindex < 0)
|
|
return XML_ERROR_NO_MEMORY;
|
|
dtd->scaffold[myindex].type = XML_CTYPE_NAME;
|
|
dtd->scaffold[myindex].quant = quant;
|
|
el = getElementType(parser, enc, s, nxt);
|
|
- if (!el)
|
|
+ if (! el)
|
|
return XML_ERROR_NO_MEMORY;
|
|
name = el->name;
|
|
dtd->scaffold[myindex].name = name;
|
|
nameLen = 0;
|
|
- for (; name[nameLen++]; );
|
|
- dtd->contentStringLen += nameLen;
|
|
+ for (; name[nameLen++];)
|
|
+ ;
|
|
+
|
|
+ /* Detect and prevent integer overflow */
|
|
+ if (nameLen > UINT_MAX - dtd->contentStringLen) {
|
|
+ return XML_ERROR_NO_MEMORY;
|
|
+ }
|
|
+
|
|
+ dtd->contentStringLen += (unsigned)nameLen;
|
|
if (elementDeclHandler)
|
|
handleDefault = XML_FALSE;
|
|
}
|