From 09957b8ced725b96a95acff150facda93f03afe1 Mon Sep 17 00:00:00 2001 From: Snild Dolkow Date: Thu, 26 Oct 2023 10:41:00 +0200 Subject: [PATCH] Allow XML_GetBuffer() with len=0 on a fresh parser len=0 was previously OK if there had previously been a non-zero call. It makes sense to allow an application to work the same way on a newly-created parser, and not have to care if its incoming buffer happens to be 0. CVE: CVE-2023-52425 Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/09957b8ced725b96a95acff150facda93f03afe1] Signed-off-by: Meenali Gupta --- lib/xmlparse.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 5c66f54..5b112c6 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -2095,7 +2095,8 @@ XML_GetBuffer(XML_Parser parser, int len) { default:; } - if (len > EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd)) { + if (len > EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd) + || parser->m_buffer == NULL) { #ifdef XML_CONTEXT_BYTES int keep; #endif /* defined XML_CONTEXT_BYTES */ @@ -2118,8 +2119,9 @@ XML_GetBuffer(XML_Parser parser, int len) { } neededSize += keep; #endif /* defined XML_CONTEXT_BYTES */ - if (neededSize - <= EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_buffer)) { + if (parser->m_buffer && parser->m_bufferPtr + && neededSize + <= EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_buffer)) { #ifdef XML_CONTEXT_BYTES if (keep < EXPAT_SAFE_PTR_DIFF(parser->m_bufferPtr, parser->m_buffer)) { int offset @@ -2133,14 +2135,12 @@ XML_GetBuffer(XML_Parser parser, int len) { parser->m_bufferPtr -= offset; } #else - if (parser->m_buffer && parser->m_bufferPtr) { - memmove(parser->m_buffer, parser->m_bufferPtr, - EXPAT_SAFE_PTR_DIFF(parser->m_bufferEnd, parser->m_bufferPtr)); - parser->m_bufferEnd - = parser->m_buffer - + EXPAT_SAFE_PTR_DIFF(parser->m_bufferEnd, parser->m_bufferPtr); - parser->m_bufferPtr = parser->m_buffer; - } + memmove(parser->m_buffer, parser->m_bufferPtr, + EXPAT_SAFE_PTR_DIFF(parser->m_bufferEnd, parser->m_bufferPtr)); + parser->m_bufferEnd + = parser->m_buffer + + EXPAT_SAFE_PTR_DIFF(parser->m_bufferEnd, parser->m_bufferPtr); + parser->m_bufferPtr = parser->m_buffer; #endif /* not defined XML_CONTEXT_BYTES */ } else { char *newBuf; -- 2.40.0