Re: [PATCH] Check hex or decimal entity for overflow

Updated patch with XML_ERR_INVALID_CHAR.

On Tue, Jan 9, 2018 at 5:55 AM, Nick Wellnhofer <[email protected]> wrote:

> On 08/01/2018 02:06, Joel Hockey wrote:
>
>> The entity parsing code in tree.c is getting integer overflow when a very
>> long, invalid hex (or decimal) entity is used:  e.g. #xabcdefabcdef;
>>
>
> This is probably the same issue as
>
>     https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3874
>
> Also see
>
>     https://bugzilla.gnome.org/show_bug.cgi?id=783052
>
> The issue only arises in "recovery" mode (XML_PARSE_RECOVER). In the past,
> I tried to fix similar issues by not adding nodes containing invalid
> character references at all in an earlier stage of the parsing code, but
> I'm fine with your approach.
>
> For these cases, I am setting the error to XML_TREE_UNTERMINATED_ENTITY.
>> The other 2 existing codes are XML_TREE_INVALID_HEX, XML_TREE_INVALID_DEC.
>> I thought unterminated is the better choice, but maybe a new code such as
>> XML_TREE_INVALID_CHAR could be used.
>>
>
> Regarding the error code, we could simply use XML_ERR_INVALID_CHAR or not
> report an error at all since invalid numeric character references are
> already detected and reported earlier.
>
> Nick
>

_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
[email protected]
https://mail.gnome.org/mailman/listinfo/xml

From 0382b8a9754b4a9d8e4edffabf916f071b3806fc Mon Sep 17 00:00:00 2001
From: Joel Hockey <[email protected]>
Date: Wed, 3 Jan 2018 18:52:36 -0800
Subject: [PATCH] Check hex or decimal entity for overflow

---
 tree.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tree.c b/tree.c
index 959421bd..2089a932 100644
--- a/tree.c
+++ b/tree.c
@@ -1527,6 +1527,12 @@ xmlStringGetNodeList(const xmlDoc *doc, const xmlChar *value) {
 			charval = 0;
 			break;
 		    }
+		    if (charval > 0x10FFFF) {
+			xmlTreeErr(XML_ERR_INVALID_CHAR, (xmlNodePtr) doc,
+			           NULL);
+			charval = 0;
+			break;
+		    }
 		    cur++;
 		    tmp = *cur;
 		}
@@ -1545,6 +1551,12 @@ xmlStringGetNodeList(const xmlDoc *doc, const xmlChar *value) {
 			charval = 0;
 			break;
 		    }
+		    if (charval > 0x10FFFF) {
+			xmlTreeErr(XML_ERR_INVALID_CHAR, (xmlNodePtr) doc,
+			           NULL);
+			charval = 0;
+			break;
+		    }
 		    cur++;
 		    tmp = *cur;
 		}
-- 
2.16.0.rc0.223.g4a4ac83678-goog