diff options
| author | Daniel Veillard <veillard@src.gnome.org> | 2004-10-26 21:53:55 +0000 |
|---|---|---|
| committer | Daniel Veillard <veillard@src.gnome.org> | 2004-10-26 21:53:55 +0000 |
| commit | 95ddcd326694de324a41a73d407d72604dd746d1 (patch) | |
| tree | e11a747dddd3f452dd28eb9d18b150adb6ceb419 /nanoftp.c | |
| parent | 03a53c34db279cbe4a305d58969beb1f26ff3d19 (diff) | |
| download | android_external_libxml2-95ddcd326694de324a41a73d407d72604dd746d1.tar.gz android_external_libxml2-95ddcd326694de324a41a73d407d72604dd746d1.tar.bz2 android_external_libxml2-95ddcd326694de324a41a73d407d72604dd746d1.zip | |
applied fixes for a couple of potential security problems more fixes on
* nanoftp.c: applied fixes for a couple of potential security problems
* tree.c valid.c xmllint.c: more fixes on the string interning checks
Daniel
Diffstat (limited to 'nanoftp.c')
| -rw-r--r-- | nanoftp.c | 15 |
1 files changed, 13 insertions, 2 deletions
@@ -355,8 +355,13 @@ xmlNanoFTPScanURL(void *ctx, const char *URL) { if (cur[0] == '[') { cur++; - while (cur[0] != ']') + while ((cur[0] != ']') && (indx < XML_NANO_MAX_URLBUF-1)) buf[indx++] = *cur++; + if (indx >= XML_NANO_MAX_URLBUF-1) { + xmlGenericError(xmlGenericErrorContext, + "\nxmlNanoFTPScanURL: %s", "Syntax Error\n"); + return; + } if (!strchr (buf, ':')) { xmlGenericError (xmlGenericErrorContext, "\nxmlNanoFTPScanURL: %s", @@ -604,8 +609,14 @@ xmlNanoFTPScanProxy(const char *URL) { if (cur[0] == '[') { cur++; - while (cur[0] != ']') + while ((cur[0] != ']') && (indx < XML_NANO_MAX_URLBUF-1)) buf[indx++] = *cur++; + if (indx >= XML_NANO_MAX_URLBUF-1) { + xmlGenericError (xmlGenericErrorContext, + "\nxmlNanoFTPScanProxy: %s", "Syntax error\n"); + return; + } + if (!strchr (buf, ':')) { xmlGenericError (xmlGenericErrorContext, "\nxmlNanoFTPScanProxy: %s", "Use [IPv6]/IPv4 format\n"); |