organicmaps/libexpat
13
Fork 0
mirror of https://github.com/libexpat/libexpat.git synced 2025-04-15 00:38:15 +00:00
Code Issues 1 Projects Releases Wiki Activity Actions 19

lib: Detect and prevent integer overflow in XML_GetBuffer (CVE-2022-23852)

Browse source
This commit is contained in:
Samanta Navarro 2022-01-22 17:48:00 +01:00 • committed by Sebastian Pipping
parent 8fb2211e99
commit 847a645152
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
expat/lib/xmlparse.c
View file

@ -2067,6 +2067,11 @@ XML_GetBuffer(XML_Parser parser, int len) {
keep = (int)EXPAT_SAFE_PTR_DIFF(parser->m_bufferPtr, parser->m_buffer);
if (keep > XML_CONTEXT_BYTES)
keep = XML_CONTEXT_BYTES;
/* Detect and prevent integer overflow */
if (keep > INT_MAX - neededSize) {
parser->m_errorCode = XML_ERROR_NO_MEMORY;
return NULL;
}
neededSize += keep;
#endif /* defined XML_CONTEXT_BYTES */
if (neededSize