|
| 1 | +From 1a09ad6433f9f8fd70c515cde7792ae12e3ce61a Mon Sep 17 00:00:00 2001 |
| 2 | +From: Matthew Fernandez <matthew.fernandez@gmail.com> |
| 3 | +Date: Thu, 2 Oct 2025 17:15:15 -0700 |
| 4 | +Subject: [PATCH 1/3] lib: Make a doubling more readable |
| 5 | + |
| 6 | +Suggested-by: Sebastian Pipping <sebastian@pipping.org> |
| 7 | +--- |
| 8 | + lib/xmlparse.c | 2 +- |
| 9 | + 1 file changed, 1 insertion(+), 1 deletion(-) |
| 10 | + |
| 11 | +diff --git a/lib/xmlparse.c b/lib/xmlparse.c |
| 12 | +index d804753..a48acd2 100644 |
| 13 | +--- a/lib/xmlparse.c |
| 14 | ++++ b/lib/xmlparse.c |
| 15 | +@@ -3492,7 +3492,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, |
| 16 | + tag->name.strLen = convLen; |
| 17 | + break; |
| 18 | + } |
| 19 | +- bufSize = (int)(tag->bufEnd - tag->buf) << 1; |
| 20 | ++ bufSize = (int)(tag->bufEnd - tag->buf) * 2; |
| 21 | + { |
| 22 | + char *temp = (char *)REALLOC(parser, tag->buf, bufSize); |
| 23 | + if (temp == NULL) |
| 24 | +-- |
| 25 | +2.45.4 |
| 26 | + |
| 27 | + |
| 28 | +From b74fa4400eb8a3a177a95ffbc9c27e61fdd3db6d Mon Sep 17 00:00:00 2001 |
| 29 | +From: Matthew Fernandez <matthew.fernandez@gmail.com> |
| 30 | +Date: Thu, 2 Oct 2025 17:15:15 -0700 |
| 31 | +Subject: [PATCH 2/3] lib: Realign a size with the `REALLOC` type signature it |
| 32 | + is passed into |
| 33 | + |
| 34 | +Note that this implicitly assumes `tag->bufEnd >= tag->buf`, which should |
| 35 | +already be guaranteed true. |
| 36 | +--- |
| 37 | + lib/xmlparse.c | 3 +-- |
| 38 | + 1 file changed, 1 insertion(+), 2 deletions(-) |
| 39 | + |
| 40 | +diff --git a/lib/xmlparse.c b/lib/xmlparse.c |
| 41 | +index a48acd2..ed505b7 100644 |
| 42 | +--- a/lib/xmlparse.c |
| 43 | ++++ b/lib/xmlparse.c |
| 44 | +@@ -3481,7 +3481,6 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, |
| 45 | + const char *fromPtr = tag->rawName; |
| 46 | + toPtr = (XML_Char *)tag->buf; |
| 47 | + for (;;) { |
| 48 | +- int bufSize; |
| 49 | + int convLen; |
| 50 | + const enum XML_Convert_Result convert_res |
| 51 | + = XmlConvert(enc, &fromPtr, rawNameEnd, (ICHAR **)&toPtr, |
| 52 | +@@ -3492,7 +3491,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, |
| 53 | + tag->name.strLen = convLen; |
| 54 | + break; |
| 55 | + } |
| 56 | +- bufSize = (int)(tag->bufEnd - tag->buf) * 2; |
| 57 | ++ const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2; |
| 58 | + { |
| 59 | + char *temp = (char *)REALLOC(parser, tag->buf, bufSize); |
| 60 | + if (temp == NULL) |
| 61 | +-- |
| 62 | +2.45.4 |
| 63 | + |
| 64 | + |
| 65 | +From 73d9f24f8815d46005bd3c5334f668a53c8957a2 Mon Sep 17 00:00:00 2001 |
| 66 | +From: Matthew Fernandez <matthew.fernandez@gmail.com> |
| 67 | +Date: Thu, 2 Oct 2025 17:15:15 -0700 |
| 68 | +Subject: [PATCH 3/3] lib: Introduce an integer overflow check for tag buffer |
| 69 | + reallocation |
| 70 | + |
| 71 | +Suggested-by: Sebastian Pipping <sebastian@pipping.org> |
| 72 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 73 | +Upstream-reference: https://github.com/libexpat/libexpat/pull/1075.patch |
| 74 | +--- |
| 75 | + lib/xmlparse.c | 2 ++ |
| 76 | + 1 file changed, 2 insertions(+) |
| 77 | + |
| 78 | +diff --git a/lib/xmlparse.c b/lib/xmlparse.c |
| 79 | +index ed505b7..0bf913c 100644 |
| 80 | +--- a/lib/xmlparse.c |
| 81 | ++++ b/lib/xmlparse.c |
| 82 | +@@ -3491,6 +3491,8 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, |
| 83 | + tag->name.strLen = convLen; |
| 84 | + break; |
| 85 | + } |
| 86 | ++ if (SIZE_MAX / 2 < (size_t)(tag->bufEnd - tag->buf)) |
| 87 | ++ return XML_ERROR_NO_MEMORY; |
| 88 | + const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2; |
| 89 | + { |
| 90 | + char *temp = (char *)REALLOC(parser, tag->buf, bufSize); |
| 91 | +-- |
| 92 | +2.45.4 |
| 93 | + |
0 commit comments