mirror of
https://gitee.com/openharmony/third_party_libxml2
synced 2024-11-26 17:42:39 +00:00
94 lines
3.3 KiB
Diff
94 lines
3.3 KiB
Diff
From 19b197b61646fd2ad7e584b739500876681c4e3d Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Sun, 5 Mar 2023 14:10:56 +0100
|
|
Subject: [PATCH] malloc-fail: Fix null deref after xmlSchemaCompareDates
|
|
|
|
Found with libFuzzer, see #344.
|
|
|
|
Reference:https://github.com/GNOME/libxml2/commit/19b197b61646fd2ad7e584b739500876681c4e3d
|
|
Conflict:NA
|
|
---
|
|
xmlschemastypes.c | 28 ++++++++++++++++++++++++++++
|
|
1 file changed, 28 insertions(+)
|
|
|
|
diff --git a/xmlschemastypes.c b/xmlschemastypes.c
|
|
index 160777f..d5c7790 100644
|
|
--- a/xmlschemastypes.c
|
|
+++ b/xmlschemastypes.c
|
|
@@ -4146,9 +4146,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
|
|
|
|
if (!y->value.date.tz_flag) {
|
|
p1 = xmlSchemaDateNormalize(x, 0);
|
|
+ if (p1 == NULL)
|
|
+ return -2;
|
|
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
|
|
/* normalize y + 14:00 */
|
|
q1 = xmlSchemaDateNormalize(y, (14 * SECS_PER_HOUR));
|
|
+ if (q1 == NULL) {
|
|
+ xmlSchemaFreeValue(p1);
|
|
+ return -2;
|
|
+ }
|
|
|
|
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
|
|
if (p1d < q1d) {
|
|
@@ -4167,6 +4173,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
|
|
int ret = 0;
|
|
/* normalize y - 14:00 */
|
|
q2 = xmlSchemaDateNormalize(y, -(14 * SECS_PER_HOUR));
|
|
+ if (q2 == NULL) {
|
|
+ xmlSchemaFreeValue(p1);
|
|
+ xmlSchemaFreeValue(q1);
|
|
+ return -2;
|
|
+ }
|
|
q2d = _xmlSchemaDateCastYMToDays(q2) + q2->value.date.day;
|
|
if (p1d > q2d)
|
|
ret = 1;
|
|
@@ -4190,10 +4201,16 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
|
|
}
|
|
} else if (y->value.date.tz_flag) {
|
|
q1 = xmlSchemaDateNormalize(y, 0);
|
|
+ if (q1 == NULL)
|
|
+ return -2;
|
|
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
|
|
|
|
/* normalize x - 14:00 */
|
|
p1 = xmlSchemaDateNormalize(x, -(14 * SECS_PER_HOUR));
|
|
+ if (p1 == NULL) {
|
|
+ xmlSchemaFreeValue(q1);
|
|
+ return -2;
|
|
+ }
|
|
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
|
|
|
|
if (p1d < q1d) {
|
|
@@ -4212,6 +4229,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
|
|
int ret = 0;
|
|
/* normalize x + 14:00 */
|
|
p2 = xmlSchemaDateNormalize(x, (14 * SECS_PER_HOUR));
|
|
+ if (p2 == NULL) {
|
|
+ xmlSchemaFreeValue(p1);
|
|
+ xmlSchemaFreeValue(q1);
|
|
+ return -2;
|
|
+ }
|
|
p2d = _xmlSchemaDateCastYMToDays(p2) + p2->value.date.day;
|
|
|
|
if (p2d > q1d) {
|
|
@@ -4241,9 +4263,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
|
|
if (x->type == y->type) {
|
|
int ret = 0;
|
|
q1 = xmlSchemaDateNormalize(y, 0);
|
|
+ if (q1 == NULL)
|
|
+ return -2;
|
|
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
|
|
|
|
p1 = xmlSchemaDateNormalize(x, 0);
|
|
+ if (p1 == NULL) {
|
|
+ xmlSchemaFreeValue(q1);
|
|
+ return -2;
|
|
+ }
|
|
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
|
|
|
|
if (p1d < q1d) {
|
|
--
|
|
2.27.0
|
|
|