libxml2/758605.html.sax at a820dbeac29d330bae4be05d9ecd939ad6b4aa33 - libxml2 - Gitea: Git with a cup of tea

c/libxml2

mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00

Pranjal Jumde a820dbeac2 Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605 >

Reviewed by David Kilzer.

* HTMLparser.c:
(htmlParseName): Add bounds check.
(htmlParseNameComplex): Ditto.
* result/HTML/758605.html: Added.
* result/HTML/758605.html.err: Added.
* result/HTML/758605.html.sax: Added.
* runtest.c:
(pushParseTest): The input for the new test case was so small
(4 bytes) that htmlParseChunk() was never called after
htmlCreatePushParserCtxt(), thereby creating a false positive
test failure.  Fixed by using a do-while loop so we always call
htmlParseChunk() at least once.
* test/HTML/758605.html: Added.

2016-05-23 15:01:07 +08:00

14 lines

283 B

Plaintext

Raw Blame History

 SAX.setDocumentLocator()
 SAX.startDocument()
 SAX.error: htmlParseEntityRef: no name
 SAX.startElement(html)
 SAX.startElement(body)
 SAX.startElement(p)
 SAX.characters(&amp;, 1)
 SAX.ignorableWhitespace(
 , 1)
 SAX.endElement(p)
 SAX.endElement(body)
 SAX.endElement(html)
 SAX.endDocument()