Heap-based buffer-underreads due to xmlParseName
For https://bugzilla.gnome.org/show_bug.cgi?id=759573
* parser.c:
(xmlParseElementDecl): Return early on invalid input to fix
non-minimized test case (759573-2.xml). Otherwise the parser
gets into a bad state in SKIP(3) at the end of the function.
(xmlParseConditionalSections): Halt parsing when hitting invalid
input that would otherwise caused xmlParserHandlePEReference()
to recurse unexpectedly. This fixes the minimized test case
(759573.xml).
* result/errors/759573-2.xml: Add.
* result/errors/759573-2.xml.err: Add.
* result/errors/759573-2.xml.str: Add.
* result/errors/759573.xml: Add.
* result/errors/759573.xml.err: Add.
* result/errors/759573.xml.str: Add.
* test/errors/759573-2.xml: Add.
* test/errors/759573.xml: Add.
diff --git a/parser.c b/parser.c
index 7aba6a9..ea0e89e 100644
--- a/parser.c
+++ b/parser.c
@@ -6708,6 +6708,7 @@
if (!IS_BLANK_CH(CUR)) {
xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
"Space required after 'ELEMENT'\n");
+ return(-1);
}
SKIP_BLANKS;
name = xmlParseName(ctxt);
@@ -6859,6 +6860,7 @@
if ((CUR_PTR == check) && (cons == ctxt->input->consumed)) {
xmlFatalErr(ctxt, XML_ERR_EXT_SUBSET_NOT_FINISHED, NULL);
+ xmlHaltParser(ctxt);
break;
}
}
diff --git a/result/errors/759573-2.xml b/result/errors/759573-2.xml
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/result/errors/759573-2.xml
diff --git a/result/errors/759573-2.xml.err b/result/errors/759573-2.xml.err
new file mode 100644
index 0000000..d8773d8
--- /dev/null
+++ b/result/errors/759573-2.xml.err
@@ -0,0 +1,58 @@
+Entity: line 1: parser error : Space required after '<!ENTITY'
+ %zz;
+ ^
+Entity: line 1:
+<!ENTITY<?xDOCTYPEm~?>
+ ^
+Entity: line 1: parser error : xmlParseEntityDecl: no name
+ %zz;
+ ^
+Entity: line 1:
+<!ENTITY<?xDOCTYPEm~?>
+ ^
+Entity: line 1: parser error : ParsePI: PI xDOCTYPEm space expected
+ %zz;
+ ^
+Entity: line 1:
+<!ENTITY<?xDOCTYPEm~?>
+ ^
+Entity: line 1: parser error : Space required after '<!ENTITY'
+ %zz;
+ ^
+Entity: line 1:
+<!ENTITY<?xDOCTYPEm~?>
+ ^
+Entity: line 1: parser error : xmlParseEntityDecl: no name
+ %zz;
+ ^
+Entity: line 1:
+<!ENTITY<?xDOCTYPEm~?>
+ ^
+Entity: line 1: parser error : ParsePI: PI xDOCTYPEm space expected
+ %zz;
+ ^
+Entity: line 1:
+<!ENTITY<?xDOCTYPEm~?>
+ ^
+Entity: line 1: parser error : Space required after 'ELEMENT'
+ %xx;
+ ^
+Entity: line 3:
+%zz;<!ELEMENTD(%MENT%MENTDŹMENTD%zNMT9KENSMYSYSTEM;MENT9%zz;
+ ^
+Entity: line 1: parser error : Content error in the external subset
+ %xx;
+ ^
+Entity: line 3:
+%zz;<!ELEMENTD(%MENT%MENTDŹMENTD%zNMT9KENSMYSYSTEM;MENT9%zz;
+ ^
+./test/errors/759573-2.xml:6: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration
+
+%xx;ÿggKENSMYNT#MENTDŴzz;'>
+ ^
+./test/errors/759573-2.xml:6: parser error : DOCTYPE improperly terminated
+%xx;ÿggKENSMYNT#MENTDŴzz;'>
+ ^
+./test/errors/759573-2.xml:6: parser error : Start tag expected, '<' not found
+%xx;ÿggKENSMYNT#MENTDŴzz;'>
+ ^
diff --git a/result/errors/759573-2.xml.str b/result/errors/759573-2.xml.str
new file mode 100644
index 0000000..baac164
--- /dev/null
+++ b/result/errors/759573-2.xml.str
@@ -0,0 +1,4 @@
+./test/errors/759573-2.xml:2: parser error : Extra content at the end of the document
+<!DOCTYPE test [
+ ^
+./test/errors/759573-2.xml : failed to parse
diff --git a/result/errors/759573.xml b/result/errors/759573.xml
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/result/errors/759573.xml
diff --git a/result/errors/759573.xml.err b/result/errors/759573.xml.err
new file mode 100644
index 0000000..2c21e9a
--- /dev/null
+++ b/result/errors/759573.xml.err
@@ -0,0 +1,31 @@
+./test/errors/759573.xml:1: parser error : Space required after '<!ENTITY'
+ELEMENT t (A)><!ENTITY % xx '%<