[jira] [Resolved] (XERCESC-2241) Integer overflows in DFAContentModel class

     [ https://issues.apache.org/jira/browse/XERCESC-2241?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved XERCESC-2241.
-----------------------------------
    Resolution: Fixed

Applied to both branches.

> Integer overflows in DFAContentModel class
> ------------------------------------------
>
>                 Key: XERCESC-2241
>                 URL: https://issues.apache.org/jira/browse/XERCESC-2241
>             Project: Xerces-C++
>          Issue Type: Bug
>          Components: Validating Parser (XML Schema)
>    Affects Versions: 3.2.3
>            Reporter: Even Rouault
>            Assignee: Scott Cantor
>            Priority: Major
>             Fix For: 4.0.0, 3.2.4
>
>
> On .xsd files like the following ones (generated by ossfuzz, so broken), integer overflows can happen in DFAContentModel::countLeafNodes() and DFAContentModel::buildDFA() which can later cause out-of-bounds access.
> Found in [https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52025]
>  
> ```
> <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
>            xmlns:myns="http://myns"
>            targetNamespace="http://myns"
>            elementFormDefault="qualified" attributeFormDefault="unqualified">
> <xs:element name="main_elt">
>   <xs:complexType>
>      <xs:sequence>
>         <xs:group ref="myns:mygroup" minOccurs="32767" maxOccurs="1"/>
>       </xs:sequence>
>   </xs:complexType>
> </xs:element>
> <xs:group name="mygroup">
>   <xs:sequence>
>       <!-- related to https://issues.apache.org/jira/browse/XERCESC-1051 -->
>       <xs:element name="elt" maxOccurs="33333">
>         <xs:complexType>
>             <xs:sequence>
>  ame="x" type="xs:int" maxOccurs="1"/>
>             </xs:sequence>
>         </xs:complexType>
>       </xs:element>
>   </xs:sequence>
> </xs:group>
> </xs:schema>
> ```



--
This message was sent by Atlassian Jira
(v8.20.10#820010)