lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2026-10-24 01:09:01 +03:00
Code Activity

fix: add bounds checks to xmlSnprintfElements in valid.c

Browse Source 
CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat()
writes, but the sibling function xmlSnprintfElements has the identical
unfixed pattern. The strcat(buf, "(") before the while loop and
strcat(buf, ")") after the loop exit have no bounds checks.

Add remaining-space checks before both strcat calls, with early return
and ellipsis when space is insufficient.
This commit is contained in:
mohammadmseet-hue
2026-04-16 02:54:37 +02:00
committed by Daniel Garcia Moreno
parent b9da8bcc78
commit 61e5f3ea97
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
valid.c
View File

@@ -4625,7 +4625,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
int len;
if (node == NULL) return;
if (glob) strcat(buf, "(");
len = strlen(buf);
if (glob) {
if (size - len < 50) {
if ((size - len > 4) && (buf[len - 1] != '.'))
strcat(buf, " ...");
return;
}
strcat(buf, "(");
}
cur = node;
while (cur != NULL) {
len = strlen(buf);
@@ -4689,7 +4697,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
}
cur = cur->next;
}
if (glob) strcat(buf, ")");
if (glob) {
len = strlen(buf);
if (size - len > 1)
strcat(buf, ")");
}
}
/**