From 897dffbae322b46b83f99a607d527058a72c51ed Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer Date: Tue, 6 Jun 2017 13:21:14 +0200 Subject: [PATCH] Check for integer overflow in memory debug code Fixes bug 783026. Thanks to Pranjal Jumde for the report. CVE: CVE-2017-5130 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/897dffbae322b46b83f99a607d527058a72c51ed] Signed-off-by: Andreas Wellving --- xmlmemory.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/xmlmemory.c b/xmlmemory.c index f08c8c3..c53141f 100644 --- a/xmlmemory.c +++ b/xmlmemory.c @@ -172,6 +172,13 @@ xmlMallocLoc(size_t size, const char * file, int line) TEST_POINT + if (size > (MAX_SIZE_T - RESERVE_SIZE)) { + xmlGenericError(xmlGenericErrorContext, + "xmlMallocLoc : Unsigned overflow\n"); + xmlMemoryDump(); + return(NULL); + } + p = (MEMHDR *) malloc(RESERVE_SIZE+size); if (!p) { @@ -352,6 +359,13 @@ xmlReallocLoc(void *ptr,size_t size, const char * file, int line) #endif xmlMutexUnlock(xmlMemMutex); + if (size > (MAX_SIZE_T - RESERVE_SIZE)) { + xmlGenericError(xmlGenericErrorContext, + "xmlMallocLoc : Unsigned overflow\n"); + xmlMemoryDump(); + return(NULL); + } + tmp = (MEMHDR *) realloc(p,RESERVE_SIZE+size); if (!tmp) { free(p); @@ -499,6 +513,13 @@ xmlMemStrdupLoc(const char *str, const char *file, int line) if (!xmlMemInitialized) xmlInitMemory(); TEST_POINT + if (size > (MAX_SIZE_T - RESERVE_SIZE)) { + xmlGenericError(xmlGenericErrorContext, + "xmlMallocLoc : Unsigned overflow\n"); + xmlMemoryDump(); + return(NULL); + } + p = (MEMHDR *) malloc(RESERVE_SIZE+size); if (!p) { goto error; -- 2.7.4