After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 783052 - Integer-overflow in xmlStringGetNodeList and xmlStringLenGetNodeList
Integer-overflow in xmlStringGetNodeList and xmlStringLenGetNodeList
Status: RESOLVED FIXED
Product: libxml2
Classification: Platform
Component: parser
git master
Other All
: Normal normal
: ---
Assigned To: Daniel Veillard
https://bugs.chromium.org/p/oss-fuzz/...
Depends on:
Blocks:
 
 
Reported: 2017-05-24 17:14 UTC by David Kilzer
Modified: 2017-09-13 17:07 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description David Kilzer 2017-05-24 17:14:02 UTC 
Both xmlStringGetNodeList() and xmlStringLenGetNodeList() contain code that converts characters to a signed integer ('charval'), but doesn't check for overflow:

                while (tmp != ';') { /* Non input consuming loops */
                    if ((tmp >= '0') && (tmp <= '9'))
                        charval = charval * 10 + (tmp - '0');
                    else {
                        xmlTreeErr(XML_TREE_INVALID_DEC, (xmlNodePtr) doc,
                                   NULL);
                        charval = 0;
                        break;
                    }
                    [...]
                }

Imported from:  <https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=592>
Comment 1 Nick Wellnhofer 2017-09-08 12:47:47 UTC 
Fixed with https://git.gnome.org/browse/libxml2/commit/?id=0fcab658a27c3f0759b89809da1015f9bcbd999a

The problem was limited to recovery mode. xmlStringGetNodeList() should have never seen invalid character references in the first place.
Comment 3 Daniel Veillard 2017-09-13 17:07:22 UTC 
and remember, the recover option is for manual one time intervention only
I never intended that to be used by default at least in XML parsing mode
as it's a clear violation of the XML specification.

Daniel