diff options
author | Xin Li <delphij@google.com> | 2016-07-26 14:22:54 -0700 |
---|---|---|
committer | Xin Li <delphij@google.com> | 2016-08-15 22:30:45 +0000 |
commit | a136fc2e5a8893a02b0912862d26a575fcbd641a (patch) | |
tree | 341dc6790424526b424173dc7bc5a1165db7de10 /xmlstring.c | |
parent | edb5870767fed8712a9b77ef34097209b61ab2db (diff) | |
download | android_external_libxml2-a136fc2e5a8893a02b0912862d26a575fcbd641a.tar.gz android_external_libxml2-a136fc2e5a8893a02b0912862d26a575fcbd641a.tar.bz2 android_external_libxml2-a136fc2e5a8893a02b0912862d26a575fcbd641a.zip |
Merge remote-tracking branch 'goog/upstream-master' into mymerge
BUG: 29834751
Change-Id: I88fc1d4f86bcbd0ac0fe9acdbe764f3d738c5f32
(cherry picked from commit e3d78e1fe0669e9c7083a4de19f1e06171849b28)
Diffstat (limited to 'xmlstring.c')
-rw-r--r-- | xmlstring.c | 70 |
1 files changed, 66 insertions, 4 deletions
diff --git a/xmlstring.c b/xmlstring.c index a37220d7..cc85777e 100644 --- a/xmlstring.c +++ b/xmlstring.c @@ -457,6 +457,8 @@ xmlStrncat(xmlChar *cur, const xmlChar *add, int len) { return(xmlStrndup(add, len)); size = xmlStrlen(cur); + if (size < 0) + return(NULL); ret = (xmlChar *) xmlRealloc(cur, (size + len + 1) * sizeof(xmlChar)); if (ret == NULL) { xmlErrMemory(NULL, NULL); @@ -484,14 +486,19 @@ xmlStrncatNew(const xmlChar *str1, const xmlChar *str2, int len) { int size; xmlChar *ret; - if (len < 0) + if (len < 0) { len = xmlStrlen(str2); + if (len < 0) + return(NULL); + } if ((str2 == NULL) || (len == 0)) return(xmlStrdup(str1)); if (str1 == NULL) return(xmlStrndup(str2, len)); size = xmlStrlen(str1); + if (size < 0) + return(NULL); ret = (xmlChar *) xmlMalloc((size + len + 1) * sizeof(xmlChar)); if (ret == NULL) { xmlErrMemory(NULL, NULL); @@ -538,7 +545,7 @@ xmlStrcat(xmlChar *cur, const xmlChar *add) { * Returns the number of characters written to @buf or -1 if an error occurs. */ int XMLCDECL -xmlStrPrintf(xmlChar *buf, int len, const xmlChar *msg, ...) { +xmlStrPrintf(xmlChar *buf, int len, const char *msg, ...) { va_list args; int ret; @@ -566,7 +573,7 @@ xmlStrPrintf(xmlChar *buf, int len, const xmlChar *msg, ...) { * Returns the number of characters written to @buf or -1 if an error occurs. */ int -xmlStrVPrintf(xmlChar *buf, int len, const xmlChar *msg, va_list ap) { +xmlStrVPrintf(xmlChar *buf, int len, const char *msg, va_list ap) { int ret; if((buf == NULL) || (msg == NULL)) { @@ -837,8 +844,8 @@ xmlUTF8Strsize(const xmlChar *utf, int len) { break; if ( (ch = *ptr++) & 0x80) while ((ch<<=1) & 0x80 ) { - ptr++; if (*ptr == 0) break; + ptr++; } } return (ptr - utf); @@ -980,5 +987,60 @@ xmlUTF8Strsub(const xmlChar *utf, int start, int len) { return(xmlUTF8Strndup(utf, len)); } +/** + * xmlEscapeFormatString: + * @msg: a pointer to the string in which to escape '%' characters. + * Must be a heap-allocated buffer created by libxml2 that may be + * returned, or that may be freed and replaced. + * + * Replaces the string pointed to by 'msg' with an escaped string. + * Returns the same string with all '%' characters escaped. + */ +xmlChar * +xmlEscapeFormatString(xmlChar **msg) +{ + xmlChar *msgPtr = NULL; + xmlChar *result = NULL; + xmlChar *resultPtr = NULL; + size_t count = 0; + size_t msgLen = 0; + size_t resultLen = 0; + + if (!msg || !*msg) + return(NULL); + + for (msgPtr = *msg; *msgPtr != '\0'; ++msgPtr) { + ++msgLen; + if (*msgPtr == '%') + ++count; + } + + if (count == 0) + return(*msg); + + resultLen = msgLen + count + 1; + result = (xmlChar *) xmlMallocAtomic(resultLen * sizeof(xmlChar)); + if (result == NULL) { + /* Clear *msg to prevent format string vulnerabilities in + out-of-memory situations. */ + xmlFree(*msg); + *msg = NULL; + xmlErrMemory(NULL, NULL); + return(NULL); + } + + for (msgPtr = *msg, resultPtr = result; *msgPtr != '\0'; ++msgPtr, ++resultPtr) { + *resultPtr = *msgPtr; + if (*msgPtr == '%') + *(++resultPtr) = '%'; + } + result[resultLen - 1] = '\0'; + + xmlFree(*msg); + *msg = result; + + return *msg; +} + #define bottom_xmlstring #include "elfgcchack.h" |