c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

SAX2: Fix xmlSAX2ResolveEntity if systemId is NULL

Browse Source 
Passing a NULL systemId results in snprintf("%s", NULL) which crashes on
some platforms. Regressed with commit 4ff2dccf.

Note that systemId should never be NULL during normal parsing. It can
only be NULL if API functions are called with a NULL systemId.

Should fix #825.
This commit is contained in:
Nick Wellnhofer 2024-12-11 22:43:27 +01:00
parent 2b542ee990
commit 110e44ec9c
1 changed files with 36 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
SAX2.c
View File

@ -404,42 +404,48 @@ xmlSAX2ResolveEntity(void *ctx, const xmlChar *publicId, const xmlChar *systemId
{
xmlParserCtxtPtr ctxt = (xmlParserCtxtPtr) ctx;
xmlParserInputPtr ret = NULL;
xmlChar *URI;
const xmlChar *base = NULL;
int res;
xmlChar *URI = NULL;
if (ctx == NULL) return(NULL);
if (ctxt->input != NULL)
base = BAD_CAST ctxt->input->filename;
/*
* We don't really need the 'directory' struct member, but some
* users set it manually to a base URI for memory streams.
*/
if (base == NULL)
base = BAD_CAST ctxt->directory;
if (systemId != NULL) {
const xmlChar *base = NULL;
int res;
if ((xmlStrlen(systemId) > XML_MAX_URI_LENGTH) ||
(xmlStrlen(base) > XML_MAX_URI_LENGTH)) {
xmlFatalErr(ctxt, XML_ERR_RESOURCE_LIMIT, "URI too long");
return(NULL);
}
res = xmlBuildURISafe(systemId, base, &URI);
if (URI == NULL) {
if (res < 0)
xmlSAX2ErrMemory(ctxt);
else
xmlWarnMsg(ctxt, XML_ERR_INVALID_URI,
"Can't resolve URI: %s\n", systemId);
return(NULL);
}
if (xmlStrlen(URI) > XML_MAX_URI_LENGTH) {
xmlFatalErr(ctxt, XML_ERR_RESOURCE_LIMIT, "URI too long");
} else {
ret = xmlLoadExternalEntity((const char *) URI,
(const char *) publicId, ctxt);
if (ctxt->input != NULL)
base = BAD_CAST ctxt->input->filename;
/*
* We don't really need the 'directory' struct member, but some
* users set it manually to a base URI for memory streams.
*/
if (base == NULL)
base = BAD_CAST ctxt->directory;
if ((xmlStrlen(systemId) > XML_MAX_URI_LENGTH) ||
(xmlStrlen(base) > XML_MAX_URI_LENGTH)) {
xmlFatalErr(ctxt, XML_ERR_RESOURCE_LIMIT, "URI too long");
return(NULL);
}
res = xmlBuildURISafe(systemId, base, &URI);
if (URI == NULL) {
if (res < 0)
xmlSAX2ErrMemory(ctxt);
else
xmlWarnMsg(ctxt, XML_ERR_INVALID_URI,
"Can't resolve URI: %s\n", systemId);
return(NULL);
}
if (xmlStrlen(URI) > XML_MAX_URI_LENGTH) {
xmlFatalErr(ctxt, XML_ERR_RESOURCE_LIMIT, "URI too long");
xmlFree(URI);
return(NULL);
}
}
ret = xmlLoadExternalEntity((const char *) URI,
(const char *) publicId, ctxt);
xmlFree(URI);
return(ret);
}