c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

regexp: Report malloc failures

Browse Source 
Fix places where malloc failures aren't reported.
This commit is contained in:
Nick Wellnhofer 2023-12-10 17:09:45 +01:00
parent e632d9f02e
commit 1a354d5b30
3 changed files with 59 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fuzz/regexp.c
View File

@ -28,7 +28,7 @@ LLVMFuzzerTestOneInput(const char *data, size_t size) {
return(0); return(0);
xmlFuzzDataInit(data, size); xmlFuzzDataInit(data, size);
maxAlloc = xmlFuzzReadInt(4) % (size * 8 + 1); maxAlloc = xmlFuzzReadInt(4) % (size * 8 + 100);
str1 = xmlFuzzReadString(NULL); str1 = xmlFuzzReadString(NULL);
xmlFuzzMemSetLimit(maxAlloc); xmlFuzzMemSetLimit(maxAlloc);

14
include/private/regexp.h
View File

@ -3,7 +3,21 @@
#include <libxml/xmlautomata.h> #include <libxml/xmlautomata.h>
#ifdef LIBXML_REGEXP_ENABLED
/*
* -2 and -3 are used by xmlValidateElementType for other things.
*/
#define XML_REGEXP_OK 0
#define XML_REGEXP_NOT_FOUND (-1)
#define XML_REGEXP_INTERNAL_ERROR (-4)
#define XML_REGEXP_OUT_OF_MEMORY (-5)
#define XML_REGEXP_INTERNAL_LIMIT (-6)
#define XML_REGEXP_INVALID_UTF8 (-7)
XML_HIDDEN void XML_HIDDEN void
xmlAutomataSetFlags(xmlAutomataPtr am, int flags); xmlAutomataSetFlags(xmlAutomataPtr am, int flags);
#endif /* LIBXML_REGEXP_ENABLED */
#endif /* XML_REGEXP_H_PRIVATE__ */ #endif /* XML_REGEXP_H_PRIVATE__ */

76
xmlregexp.c
View File

@ -38,16 +38,6 @@
#define MAX_PUSH 10000000 #define MAX_PUSH 10000000
/*
* -2 and -3 are used by xmlValidateElementType for other things.
*/
#define XML_REGEXP_OK 0
#define XML_REGEXP_NOT_FOUND (-1)
#define XML_REGEXP_INTERNAL_ERROR (-4)
#define XML_REGEXP_OUT_OF_MEMORY (-5)
#define XML_REGEXP_INTERNAL_LIMIT (-6)
#define XML_REGEXP_INVALID_UTF8 (-7)
#ifdef ERROR #ifdef ERROR
#undef ERROR #undef ERROR
#endif #endif
@ -698,8 +688,13 @@ xmlRegNewParserCtxt(const xmlChar *string) {
if (ret == NULL) if (ret == NULL)
return(NULL); return(NULL);
memset(ret, 0, sizeof(xmlRegParserCtxt)); memset(ret, 0, sizeof(xmlRegParserCtxt));
if (string != NULL) if (string != NULL) {
ret->string = xmlStrdup(string); ret->string = xmlStrdup(string);
if (ret->string == NULL) {
xmlFree(ret);
return(NULL);
}
}
ret->cur = ret->string; ret->cur = ret->string;
ret->neg = 0; ret->neg = 0;
ret->negs = 0; ret->negs = 0;
@ -3060,7 +3055,6 @@ xmlFARegExecSave(xmlRegExecCtxtPtr exec) {
exec->rollbacks = (xmlRegExecRollback *) xmlMalloc(exec->maxRollbacks * exec->rollbacks = (xmlRegExecRollback *) xmlMalloc(exec->maxRollbacks *
sizeof(xmlRegExecRollback)); sizeof(xmlRegExecRollback));
if (exec->rollbacks == NULL) { if (exec->rollbacks == NULL) {
xmlRegexpErrMemory(NULL, "saving regexp");
exec->maxRollbacks = 0; exec->maxRollbacks = 0;
exec->status = XML_REGEXP_OUT_OF_MEMORY; exec->status = XML_REGEXP_OUT_OF_MEMORY;
return; return;
@ -3075,7 +3069,6 @@ xmlFARegExecSave(xmlRegExecCtxtPtr exec) {
tmp = (xmlRegExecRollback *) xmlRealloc(exec->rollbacks, tmp = (xmlRegExecRollback *) xmlRealloc(exec->rollbacks,
exec->maxRollbacks * sizeof(xmlRegExecRollback)); exec->maxRollbacks * sizeof(xmlRegExecRollback));
if (tmp == NULL) { if (tmp == NULL) {
xmlRegexpErrMemory(NULL, "saving regexp");
exec->maxRollbacks /= 2; exec->maxRollbacks /= 2;
exec->status = XML_REGEXP_OUT_OF_MEMORY; exec->status = XML_REGEXP_OUT_OF_MEMORY;
return; return;
@ -3092,7 +3085,6 @@ xmlFARegExecSave(xmlRegExecCtxtPtr exec) {
exec->rollbacks[exec->nbRollbacks].counts = (int *) exec->rollbacks[exec->nbRollbacks].counts = (int *)
xmlMalloc(exec->comp->nbCounters * sizeof(int)); xmlMalloc(exec->comp->nbCounters * sizeof(int));
if (exec->rollbacks[exec->nbRollbacks].counts == NULL) { if (exec->rollbacks[exec->nbRollbacks].counts == NULL) {
xmlRegexpErrMemory(NULL, "saving regexp");
exec->status = XML_REGEXP_OUT_OF_MEMORY; exec->status = XML_REGEXP_OUT_OF_MEMORY;
return; return;
} }
@ -3157,7 +3149,6 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
if (comp->nbCounters > 0) { if (comp->nbCounters > 0) {
exec->counts = (int *) xmlMalloc(comp->nbCounters * sizeof(int)); exec->counts = (int *) xmlMalloc(comp->nbCounters * sizeof(int));
if (exec->counts == NULL) { if (exec->counts == NULL) {
xmlRegexpErrMemory(NULL, "running regexp");
return(XML_REGEXP_OUT_OF_MEMORY); return(XML_REGEXP_OUT_OF_MEMORY);
} }
memset(exec->counts, 0, comp->nbCounters * sizeof(int)); memset(exec->counts, 0, comp->nbCounters * sizeof(int));
@ -3440,10 +3431,8 @@ xmlRegNewExecCtxt(xmlRegexpPtr comp, xmlRegExecCallbacks callback, void *data) {
if ((comp->compact == NULL) && (comp->states == NULL)) if ((comp->compact == NULL) && (comp->states == NULL))
return(NULL); return(NULL);
exec = (xmlRegExecCtxtPtr) xmlMalloc(sizeof(xmlRegExecCtxt)); exec = (xmlRegExecCtxtPtr) xmlMalloc(sizeof(xmlRegExecCtxt));
if (exec == NULL) { if (exec == NULL)
xmlRegexpErrMemory(NULL, "creating execution context");
return(NULL); return(NULL);
}
memset(exec, 0, sizeof(xmlRegExecCtxt)); memset(exec, 0, sizeof(xmlRegExecCtxt));
exec->inputString = NULL; exec->inputString = NULL;
exec->index = 0; exec->index = 0;
@ -3467,7 +3456,6 @@ xmlRegNewExecCtxt(xmlRegexpPtr comp, xmlRegExecCallbacks callback, void *data) {
exec->counts = (int *) xmlMalloc(comp->nbCounters * sizeof(int) exec->counts = (int *) xmlMalloc(comp->nbCounters * sizeof(int)
* 2); * 2);
if (exec->counts == NULL) { if (exec->counts == NULL) {
xmlRegexpErrMemory(NULL, "creating execution context");
xmlFree(exec); xmlFree(exec);
return(NULL); return(NULL);
} }
@ -3523,6 +3511,19 @@ xmlRegFreeExecCtxt(xmlRegExecCtxtPtr exec) {
xmlFree(exec); xmlFree(exec);
} }
static void
xmlRegExecSetErrString(xmlRegExecCtxtPtr exec, const xmlChar *value) {
if (exec->errString != NULL)
xmlFree(exec->errString);
if (value == NULL) {
exec->errString = NULL;
} else {
exec->errString = xmlStrdup(value);
if (exec->errString == NULL)
exec->status = XML_REGEXP_OUT_OF_MEMORY;
}
}
static void static void
xmlFARegExecSaveInputString(xmlRegExecCtxtPtr exec, const xmlChar *value, xmlFARegExecSaveInputString(xmlRegExecCtxtPtr exec, const xmlChar *value,
void *data) { void *data) {
@ -3531,8 +3532,8 @@ xmlFARegExecSaveInputString(xmlRegExecCtxtPtr exec, const xmlChar *value,
exec->inputStack = (xmlRegInputTokenPtr) exec->inputStack = (xmlRegInputTokenPtr)
xmlMalloc(exec->inputStackMax * sizeof(xmlRegInputToken)); xmlMalloc(exec->inputStackMax * sizeof(xmlRegInputToken));
if (exec->inputStack == NULL) { if (exec->inputStack == NULL) {
xmlRegexpErrMemory(NULL, "pushing input string");
exec->inputStackMax = 0; exec->inputStackMax = 0;
exec->status = XML_REGEXP_OUT_OF_MEMORY;
return; return;
} }
} else if (exec->inputStackNr + 1 >= exec->inputStackMax) { } else if (exec->inputStackNr + 1 >= exec->inputStackMax) {
@ -3542,13 +3543,21 @@ xmlFARegExecSaveInputString(xmlRegExecCtxtPtr exec, const xmlChar *value,
tmp = (xmlRegInputTokenPtr) xmlRealloc(exec->inputStack, tmp = (xmlRegInputTokenPtr) xmlRealloc(exec->inputStack,
exec->inputStackMax * sizeof(xmlRegInputToken)); exec->inputStackMax * sizeof(xmlRegInputToken));
if (tmp == NULL) { if (tmp == NULL) {
xmlRegexpErrMemory(NULL, "pushing input string");
exec->inputStackMax /= 2; exec->inputStackMax /= 2;
exec->status = XML_REGEXP_OUT_OF_MEMORY;
return; return;
} }
exec->inputStack = tmp; exec->inputStack = tmp;
} }
exec->inputStack[exec->inputStackNr].value = xmlStrdup(value); if (value == NULL) {
exec->inputStack[exec->inputStackNr].value = NULL;
} else {
exec->inputStack[exec->inputStackNr].value = xmlStrdup(value);
if (exec->inputStack[exec->inputStackNr].value == NULL) {
exec->status = XML_REGEXP_OUT_OF_MEMORY;
return;
}
}
exec->inputStack[exec->inputStackNr].data = data; exec->inputStack[exec->inputStackNr].data = data;
exec->inputStackNr++; exec->inputStackNr++;
exec->inputStack[exec->inputStackNr].value = NULL; exec->inputStack[exec->inputStackNr].value = NULL;
@ -3667,12 +3676,10 @@ xmlRegCompactPushString(xmlRegExecCtxtPtr exec,
* current token * current token
*/ */
error: error:
if (exec->errString != NULL)
xmlFree(exec->errString);
exec->errString = xmlStrdup(value);
exec->errStateNo = state; exec->errStateNo = state;
exec->status = XML_REGEXP_NOT_FOUND; exec->status = XML_REGEXP_NOT_FOUND;
return(XML_REGEXP_NOT_FOUND); xmlRegExecSetErrString(exec, value);
return(exec->status);
} }
/** /**
@ -3921,9 +3928,7 @@ xmlRegExecPushStringInternal(xmlRegExecCtxtPtr exec, const xmlChar *value,
* entering a sink state, save the current state as error * entering a sink state, save the current state as error
* state. * state.
*/ */
if (exec->errString != NULL) xmlRegExecSetErrString(exec, value);
xmlFree(exec->errString);
exec->errString = xmlStrdup(value);
exec->errState = exec->state; exec->errState = exec->state;
memcpy(exec->errCounts, exec->counts, memcpy(exec->errCounts, exec->counts,
exec->comp->nbCounters * sizeof(int)); exec->comp->nbCounters * sizeof(int));
@ -3960,9 +3965,7 @@ rollback:
if ((progress) && (exec->state != NULL) && if ((progress) && (exec->state != NULL) &&
(exec->state->type != XML_REGEXP_SINK_STATE)) { (exec->state->type != XML_REGEXP_SINK_STATE)) {
progress = 0; progress = 0;
if (exec->errString != NULL) xmlRegExecSetErrString(exec, value);
xmlFree(exec->errString);
exec->errString = xmlStrdup(value);
exec->errState = exec->state; exec->errState = exec->state;
if (exec->comp->nbCounters) if (exec->comp->nbCounters)
memcpy(exec->errCounts, exec->counts, memcpy(exec->errCounts, exec->counts,
@ -4665,6 +4668,8 @@ xmlFAParseCharProp(xmlRegParserCtxtPtr ctxt) {
} }
type = XML_REGEXP_BLOCK_NAME; type = XML_REGEXP_BLOCK_NAME;
blockName = xmlStrndup(start, ctxt->cur - start); blockName = xmlStrndup(start, ctxt->cur - start);
if (blockName == NULL)
xmlRegexpErrMemory(ctxt, NULL);
} else { } else {
ERROR("Unknown char property"); ERROR("Unknown char property");
return; return;
@ -5676,6 +5681,11 @@ xmlAutomataNewTransition(xmlAutomataPtr am, xmlAutomataStatePtr from,
return(NULL); return(NULL);
atom->data = data; atom->data = data;
atom->valuep = xmlStrdup(token); atom->valuep = xmlStrdup(token);
if (atom->valuep == NULL) {
xmlRegFreeAtom(atom);
xmlRegexpErrMemory(am, NULL);
return(NULL);
}
if (xmlFAGenerateTransitions(am, from, to, atom) < 0) { if (xmlFAGenerateTransitions(am, from, to, atom) < 0) {
xmlRegFreeAtom(atom); xmlRegFreeAtom(atom);
@ -6287,6 +6297,8 @@ xmlAutomataCompile(xmlAutomataPtr am) {
if ((am == NULL) || (am->error != 0)) return(NULL); if ((am == NULL) || (am->error != 0)) return(NULL);
xmlFAEliminateEpsilonTransitions(am); xmlFAEliminateEpsilonTransitions(am);
if (am->error != 0)
return(NULL);
/* xmlFAComputesDeterminism(am); */ /* xmlFAComputesDeterminism(am); */
ret = xmlRegEpxFromParse(am); ret = xmlRegEpxFromParse(am);