c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK

Browse Source 
Found by OSS-Fuzz.
This commit is contained in:
Nick Wellnhofer 2022-09-13 16:40:31 +02:00
parent f2392dc464
commit 1d4f5d24ac
4 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
result/schemas/oss-fuzz-51295_0_0.err Normal file
View File

@ -0,0 +1,2 @@
./test/schemas/oss-fuzz-51295_0.xsd:2: element element: Schemas parser error : element decl. 'e': The element declaration 'e' defines a circular substitution group to element declaration 'e'.
./test/schemas/oss-fuzz-51295_0.xsd:2: element element: Schemas parser error : element decl. 'e': The element declaration 'e' defines a circular substitution group to element declaration 'e'.

1
test/schemas/oss-fuzz-51295_0.xml Normal file
View File

@ -0,0 +1 @@
<e/>

4
test/schemas/oss-fuzz-51295_0.xsd Normal file
View File

@ -0,0 +1,4 @@
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="e" substitutionGroup="e"/>
<xs:element name="t" substitutionGroup="e" type='xs:decimal'/>
</xs:schema>

15
xmlschemas.c
View File

@ -13348,8 +13348,19 @@ xmlSchemaResolveElementReferences(xmlSchemaElementPtr elemDecl,
* declaration `resolved` to by the `actual value`
* of the substitutionGroup [attribute], if present"
*/
if (elemDecl->subtypes == NULL)
elemDecl->subtypes = substHead->subtypes;
if (elemDecl->subtypes == NULL) {
if (substHead->subtypes == NULL) {
/*
* This can happen with self-referencing substitution
* groups. The cycle will be detected later, but we have
* to set subtypes to avoid null-pointer dereferences.
*/
elemDecl->subtypes = xmlSchemaGetBuiltInType(
XML_SCHEMAS_ANYTYPE);
} else {
elemDecl->subtypes = substHead->subtypes;
}
}
}
}
/*