openharmony/third_party_expat
1
0
Fork 0
mirror of https://github.com/openharmony/third_party_expat.git synced 2026-07-01 08:12:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

!5 fix cve-2021-46143

Browse Source 
Merge pull request !5 from lushi1202/master
This commit is contained in:
openharmony_ci
2022-01-13 09:43:25 +00:00
committed by Gitee
parent 73488a3e3f f6665328c9
commit 5ddbd7758a
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/xmlparse.c
+15
View File
@@ -5045,6 +5045,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
if (parser->m_prologState.level >= parser->m_groupSize) {
if (parser->m_groupSize) {
{
/* Detect and prevent integer overflow */
if (parser->m_groupSize > (unsigned int)(-1) / 2u) {
return XML_ERROR_NO_MEMORY;
}
char *const new_connector = (char *)REALLOC(
parser, parser->m_groupConnector, parser->m_groupSize *= 2);
if (new_connector == NULL) {
@@ -5055,6 +5060,16 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
}
if (dtd->scaffIndex) {
/* Detect and prevent integer overflow.
* The preprocessor guard addresses the "always false" warning
* from -Wtype-limits on platforms where
* sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
#if UINT_MAX >= SIZE_MAX
if (parser->m_groupSize > (size_t)(-1) / sizeof(int)) {
return XML_ERROR_NO_MEMORY;
}
#endif
int *const new_scaff_index = (int *)REALLOC(
parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int));
if (new_scaff_index == NULL)