lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2026-10-25 13:19:21 +03:00
Code Activity

uri: fix signed integer overflow in xmlBuildRelativeURISafe

Browse Source 
This patch changes the types of ix, nbslash, len, and pos from int to
size_t in xmlBuildRelativeURISafe. These variables are used to index
and measure path strings that can exceed INT_MAX bytes (~2.14 GB),
causing two independent signed integer overflow vulnerabilities.

1. The loop counter ix can overflow from INT_MAX to INT_MIN when
   traversing a base path longer than INT_MAX bytes, leading to an
   out-of-bounds read (CWE-125).

2. The expression 3 * nbslash in the xmlMalloc size argument can
   overflow int, resulting in an undersized allocation followed by
   a heap buffer overflow in the write loop (CWE-122).

An overflow check is also added before the xmlMalloc call to handle
the case where the size_t arithmetic would itself overflow.

Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1062
This commit is contained in:
ylwango613
2026-02-20 17:12:42 +08:00
parent e334a9d661
commit 538b2e38a6
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
uri.c
View File

@@ -2491,9 +2491,9 @@ xmlBuildRelativeURISafe(const xmlChar * URI, const xmlChar * base,
{
xmlChar *val = NULL;
int ret = 0;
int ix;
int nbslash = 0;
int len;
size_t ix = 0;
size_t nbslash = 0;
size_t len = 0;
xmlURIPtr ref = NULL;
xmlURIPtr bas = NULL;
const xmlChar *bptr, *uptr, *rptr;
@@ -2574,7 +2574,7 @@ xmlBuildRelativeURISafe(const xmlChar * URI, const xmlChar * base,
* At this point we can compare the two paths
*/
{
int pos = 0;
size_t pos = 0;
/*
* Next we compare the two strings and find where they first differ
@@ -2618,7 +2618,7 @@ xmlBuildRelativeURISafe(const xmlChar * URI, const xmlChar * base,
goto done;
}
len = xmlStrlen (uptr) + 1;
len = (size_t) xmlStrlen (uptr) + 1;
}
if (nbslash == 0) {
@@ -2636,6 +2636,10 @@ xmlBuildRelativeURISafe(const xmlChar * URI, const xmlChar * base,
* length of the remainder of the URI, plus enough space
* for the "../" groups, plus one for the terminator
*/
if (len + 3 * nbslash > SIZE_MAX) {
ret = -1;
goto done;
}
val = (xmlChar *) xmlMalloc (len + 3 * nbslash);
if (val == NULL) {
ret = -1;