diff options
| author | Daniel Veillard <veillard@redhat.com> | 2015-10-30 21:14:55 +0800 |
|---|---|---|
| committer | Daniel Veillard <veillard@redhat.com> | 2015-10-30 21:14:55 +0800 |
| commit | e724879d964d774df9b7969fc846605aa1bac54c (patch) | |
| tree | 2dfa58dfc9e932ce1a6fbf93c17ef24bad5aeb58 | |
| parent | 41ac9049a27f52e7a1f3b341f8714149fc88d450 (diff) | |
| download | android_external_libxml2-e724879d964d774df9b7969fc846605aa1bac54c.tar.gz android_external_libxml2-e724879d964d774df9b7969fc846605aa1bac54c.tar.bz2 android_external_libxml2-e724879d964d774df9b7969fc846605aa1bac54c.zip | |
Fix parsing short unclosed comment uninitialized access
For https://bugzilla.gnome.org/show_bug.cgi?id=746048
The HTML parser was too optimistic when processing comments and
didn't check for the end of the stream on the first 2 characters
| -rw-r--r-- | HTMLparser.c | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/HTMLparser.c b/HTMLparser.c index 19c10c3f..bdf78071 100644 --- a/HTMLparser.c +++ b/HTMLparser.c @@ -3264,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { ctxt->instate = state; return; } + len = 0; + buf[len] = 0; q = CUR_CHAR(ql); + if (!IS_CHAR(q)) + goto unfinished; NEXTL(ql); r = CUR_CHAR(rl); + if (!IS_CHAR(r)) + goto unfinished; NEXTL(rl); cur = CUR_CHAR(l); - len = 0; while (IS_CHAR(cur) && ((cur != '>') || (r != '-') || (q != '-'))) { @@ -3300,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) { } } buf[len] = 0; - if (!IS_CHAR(cur)) { - htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, - "Comment not terminated \n<!--%.50s\n", buf, NULL); - xmlFree(buf); - } else { + if (IS_CHAR(cur)) { NEXT; if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) && (!ctxt->disableSAX)) ctxt->sax->comment(ctxt->userData, buf); xmlFree(buf); + ctxt->instate = state; + return; } - ctxt->instate = state; + +unfinished: + htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED, + "Comment not terminated \n<!--%.50s\n", buf, NULL); + xmlFree(buf); } /** |