organicmaps/libexpat
13
Fork 0
mirror of https://github.com/libexpat/libexpat.git synced 2025-04-07 06:04:59 +00:00
Code Issues 1 Projects Releases Wiki Activity Actions

Prevent out-of-bounds access in text conversion

Browse source 
* big2_toUtf8
* little2_toUtf8
* utf8_toUtf8
* utf8_toUtf16
This commit is contained in:
Sebastian Pipping 2016-05-01 23:40:05 +02:00
parent 2cac066cf6
commit e18829b4ff
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
expat/lib/xmltok.c
View file

@ -342,7 +342,7 @@ utf8_toUtf8(const ENCODING *enc,
if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
break;
}
for (to = *toP, from = *fromP; from < fromLim; from++, to++)
for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++)
*to = *from;
*fromP = from;
*toP = to;
@ -358,10 +358,14 @@ utf8_toUtf16(const ENCODING *enc,
while (from < fromLim && to < toLim) {
switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
case BT_LEAD2:
if (from + 2 > fromLim)
break;
*to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
from += 2;
break;
case BT_LEAD3:
if (from + 3 > fromLim)
break;
*to++ = (unsigned short)(((from[0] & 0xf) << 12)
| ((from[1] & 0x3f) << 6) | (from[2] & 0x3f));
from += 3;
@ -371,6 +375,8 @@ utf8_toUtf16(const ENCODING *enc,
unsigned long n;
if (to + 1 == toLim)
goto after;
if (from + 4 > fromLim)
goto after;
n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12)
| ((from[2] & 0x3f) << 6) | (from[3] & 0x3f);
n -= 0x10000;
@ -590,7 +596,7 @@ E ## toUtf8(const ENCODING *enc, \
*(*toP)++ = ((lo & 0x3f) | 0x80); \
break; \
case 0xD8: case 0xD9: case 0xDA: case 0xDB: \
if (toLim - *toP < 4) { \
if ((toLim - *toP < 4) || (from + 4 > fromLim)) { \
*fromP = from; \
return; \
} \