[PR] XERCESC-2188 - Use-after-free on external DTD scan [xer ces-c]

boris-kolpackov opened a new pull request, #54:
URL: https://github.com/apache/xerces-c/pull/54

   These are the instructions for observing the bug (before this commit):
   
   ````
   $ git clone https://github.com/apache/xerces-c.git $ cd xerces-c
   $ mkdir build
   $ cd build
   $ cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Debug .. $ make -j8
   $ cp ../samples/data/personal.xml .
   
   $ cat <<EOF >personal.dtd
   <?xml encoding="ISO-8859-1"?>
   <!ENTITY % nonExistentEntity SYSTEM "non-existent.ent"> %nonExistentEntity;
   EOF
   
   $ gdb samples/StdInParse
   (gdb) b IGXMLScanner.cpp:1544
   (gdb) run <personal.xml
   1544	            fReaderMgr.pushReader(reader, declDTD);
   (gdb) p declDTD
   $1 = (xercesc_4_0::DTDEntityDecl *) 0x49ac68
   (gdb) n
   1547	            dtdScanner.scanExtSubsetDecl(false, true);
   (gdb) n
   1548	        }
   (gdb) s
   ...
   (gdb) s                     # The Janitor is about to delete the above declDTD.
   90	        delete fData;
   (gdb) p fData
   $1 = (xercesc_4_0::DTDEntityDecl *) 0x49ac68
   (gdb) b ReaderMgr.cpp:1024
   (gdb) n
   ...
   (gdb) n                     # Now we about to dereference the deleted declDTD.
   1024	    if (curEntity && !curEntity->isExternal())
   (gdb) p curEntity
   $2 = (const xercesc_4_0::XMLEntityDecl *) 0x49ac68
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]