c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

malloc-fail: Fix null deref after xmlSchemaCompareDates

Browse Source 
Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer 2023-03-05 14:10:56 +01:00
parent 961a4f35bf
commit 19b197b616
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
xmlschemastypes.c
View File

@ -4148,9 +4148,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
if (!y->value.date.tz_flag) { if (!y->value.date.tz_flag) {
p1 = xmlSchemaDateNormalize(x, 0); p1 = xmlSchemaDateNormalize(x, 0);
if (p1 == NULL)
return -2;
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day; p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
/* normalize y + 14:00 */ /* normalize y + 14:00 */
q1 = xmlSchemaDateNormalize(y, (14 * SECS_PER_HOUR)); q1 = xmlSchemaDateNormalize(y, (14 * SECS_PER_HOUR));
if (q1 == NULL) {
xmlSchemaFreeValue(p1);
return -2;
}
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day; q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
if (p1d < q1d) { if (p1d < q1d) {
@ -4169,6 +4175,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
int ret = 0; int ret = 0;
/* normalize y - 14:00 */ /* normalize y - 14:00 */
q2 = xmlSchemaDateNormalize(y, -(14 * SECS_PER_HOUR)); q2 = xmlSchemaDateNormalize(y, -(14 * SECS_PER_HOUR));
if (q2 == NULL) {
xmlSchemaFreeValue(p1);
xmlSchemaFreeValue(q1);
return -2;
}
q2d = _xmlSchemaDateCastYMToDays(q2) + q2->value.date.day; q2d = _xmlSchemaDateCastYMToDays(q2) + q2->value.date.day;
if (p1d > q2d) if (p1d > q2d)
ret = 1; ret = 1;
@ -4192,10 +4203,16 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
} }
} else if (y->value.date.tz_flag) { } else if (y->value.date.tz_flag) {
q1 = xmlSchemaDateNormalize(y, 0); q1 = xmlSchemaDateNormalize(y, 0);
if (q1 == NULL)
return -2;
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day; q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
/* normalize x - 14:00 */ /* normalize x - 14:00 */
p1 = xmlSchemaDateNormalize(x, -(14 * SECS_PER_HOUR)); p1 = xmlSchemaDateNormalize(x, -(14 * SECS_PER_HOUR));
if (p1 == NULL) {
xmlSchemaFreeValue(q1);
return -2;
}
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day; p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
if (p1d < q1d) { if (p1d < q1d) {
@ -4214,6 +4231,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
int ret = 0; int ret = 0;
/* normalize x + 14:00 */ /* normalize x + 14:00 */
p2 = xmlSchemaDateNormalize(x, (14 * SECS_PER_HOUR)); p2 = xmlSchemaDateNormalize(x, (14 * SECS_PER_HOUR));
if (p2 == NULL) {
xmlSchemaFreeValue(p1);
xmlSchemaFreeValue(q1);
return -2;
}
p2d = _xmlSchemaDateCastYMToDays(p2) + p2->value.date.day; p2d = _xmlSchemaDateCastYMToDays(p2) + p2->value.date.day;
if (p2d > q1d) { if (p2d > q1d) {
@ -4243,9 +4265,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
if (x->type == y->type) { if (x->type == y->type) {
int ret = 0; int ret = 0;
q1 = xmlSchemaDateNormalize(y, 0); q1 = xmlSchemaDateNormalize(y, 0);
if (q1 == NULL)
return -2;
q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day; q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day;
p1 = xmlSchemaDateNormalize(x, 0); p1 = xmlSchemaDateNormalize(x, 0);
if (p1 == NULL) {
xmlSchemaFreeValue(q1);
return -2;
}
p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day; p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day;
if (p1d < q1d) { if (p1d < q1d) {