Re: [PATCH] Check hex or decimal entity for overflow
Nick Wellnhofer <[email protected]>
| Newsgroups | gmane.comp.gnome.lib.xml.general |
|---|---|
| Message-ID | <[email protected]> |
On 08/01/2018 02:06, Joel Hockey wrote:
> The entity parsing code in tree.c is getting integer overflow when a very
> long, invalid hex (or decimal) entity is used: e.g. #xabcdefabcdef;
This is probably the same issue as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3874
Also see
https://bugzilla.gnome.org/show_bug.cgi?id=783052
The issue only arises in "recovery" mode (XML_PARSE_RECOVER). In the past, I
tried to fix similar issues by not adding nodes containing invalid character
references at all in an earlier stage of the parsing code, but I'm fine with
your approach.
> For these cases, I am setting the error to XML_TREE_UNTERMINATED_ENTITY. The
> other 2 existing codes are XML_TREE_INVALID_HEX, XML_TREE_INVALID_DEC. I
> thought unterminated is the better choice, but maybe a new code such as
> XML_TREE_INVALID_CHAR could be used.
Regarding the error code, we could simply use XML_ERR_INVALID_CHAR or not
report an error at all since invalid numeric character references are already
detected and reported earlier.
Nick
_______________________________________________
xml mailing list, project page http://xmlsoft.org/
[email protected]
https://mail.gnome.org/mailman/listinfo/xml