diff options
| author | Moritz Muehlenhoff <jmm@debian.org> | 2008-01-11 21:10:20 +0000 |
|---|---|---|
| committer | Mike Hommey <glandium@debian.org> | 2008-09-19 21:38:33 +0200 |
| commit | 86a01ff28cbe9bc4bb5f567544c9c3bc2d32169c (patch) | |
| tree | 83ecaaa94ba42089b3179c508003bce6af915376 /parserInternals.c | |
| parent | b745d983af6f2b06e5fd5641acf3caccb6683695 (diff) | |
| download | libxml2-debian/2.6.27.dfsg-2.tar.gz | |
* Fix CVE-2007-6284debian/2.6.27.dfsg-2
Diffstat (limited to 'parserInternals.c')
| -rw-r--r-- | parserInternals.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/parserInternals.c b/parserInternals.c index f4da58d..3560f50 100644 --- a/parserInternals.c +++ b/parserInternals.c @@ -638,14 +638,13 @@ xmlCurrentChar(xmlParserCtxtPtr ctxt, int *len) { c = *cur; if (c & 0x80) { - if (c == 0xC0) + if (((c & 0x40) == 0) || (c == 0xC0)) goto encoding_error; if (cur[1] == 0) xmlParserInputGrow(ctxt->input, INPUT_CHUNK); if ((cur[1] & 0xc0) != 0x80) goto encoding_error; if ((c & 0xe0) == 0xe0) { - if (cur[2] == 0) xmlParserInputGrow(ctxt->input, INPUT_CHUNK); if ((cur[2] & 0xc0) != 0x80) @@ -662,18 +661,24 @@ xmlCurrentChar(xmlParserCtxtPtr ctxt, int *len) { val |= (cur[1] & 0x3f) << 12; val |= (cur[2] & 0x3f) << 6; val |= cur[3] & 0x3f; + if (val < 0x10000) + goto encoding_error; } else { /* 3-byte code */ *len = 3; val = (cur[0] & 0xf) << 12; val |= (cur[1] & 0x3f) << 6; val |= cur[2] & 0x3f; + if (val < 0x800) + goto encoding_error; } } else { /* 2-byte code */ *len = 2; val = (cur[0] & 0x1f) << 6; val |= cur[1] & 0x3f; + if (val < 0x80) + goto encoding_error; } if (!IS_CHAR(val)) { xmlErrEncodingInt(ctxt, XML_ERR_INVALID_CHAR, @@ -683,6 +688,13 @@ xmlCurrentChar(xmlParserCtxtPtr ctxt, int *len) { } else { /* 1-byte code */ *len = 1; + if (*ctxt->input->cur == 0) + xmlParserInputGrow(ctxt->input, INPUT_CHUNK); + if ((*ctxt->input->cur == 0) && + (ctxt->input->end > ctxt->input->cur)) { + xmlErrEncodingInt(ctxt, XML_ERR_INVALID_CHAR, + "Char 0x%X out of allowed range\n", val); + } if (*ctxt->input->cur == 0xD) { if (ctxt->input->cur[1] == 0xA) { ctxt->nbChars++; |