Heap-based buffer overread in xmlNextChar

For https://bugzilla.gnome.org/show_bug.cgi?id=759671 when the end of the internal subset isn't properly detected xmlParseInternalSubset should just return instead of trying to process input further.
jorgo512 · Feb 9, 2016 · a7a9461 · a7a9461
1 parent 6657afe
commit a7a9461
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 8 deletions.
diff --git a/parser.c b/parser.c
@@ -8468,6 +8468,7 @@ xmlParseInternalSubset(xmlParserCtxtPtr ctxt) {
      */
     if (RAW != '>') {
 	xmlFatalErr(ctxt, XML_ERR_DOCTYPE_NOT_FINISHED, NULL);
+	return;
     }
     NEXT;
 }

diff --git a/result/errors/754946.xml.err b/result/errors/754946.xml.err
@@ -11,9 +11,9 @@ Entity: line 1: parser error : DOCTYPE improperly terminated
 Entity: line 1: 
 A<lbbbbbbbbbbbbbbbbbbb_
 ^
-./test/errors/754946.xml:1: parser error : Start tag doesn't start and stop in the same entity
->%SYSTEM;<![
-         ^
-./test/errors/754946.xml:1: parser error : Extra content at the end of the document
->%SYSTEM;<![
+Entity: line 1: parser error : Start tag expected, '<' not found
+ %SYSTEM; 
          ^
+Entity: line 1: 
+A<lbbbbbbbbbbbbbbbbbbb_
+^
diff --git a/result/errors/content1.xml.err b/result/errors/content1.xml.err
@@ -13,4 +13,4 @@
                          ^
 ./test/errors/content1.xml:7: parser error : Start tag expected, '<' not found
 <!ELEMENT aElement (a |b * >
-                           ^
+                         ^
diff --git a/result/valid/t8.xml.err b/result/valid/t8.xml.err
@@ -16,4 +16,4 @@ Entity: line 1: parser error : Start tag expected, '<' not found
           ^
 Entity: line 1: 
 &lt;!ELEMENT root (middle) >
- ^
+^
diff --git a/result/valid/t8a.xml.err b/result/valid/t8a.xml.err
@@ -16,4 +16,4 @@ Entity: line 1: parser error : Start tag expected, '<' not found
           ^
 Entity: line 1: 
 &lt;!ELEMENT root (middle) >
- ^
+^
-Original file line number
+Diff line change
@@ Expand Up / @@ -8468,6 +8468,7 @@ xmlParseInternalSubset(xmlParserCtxtPtr ctxt) { @@
          */
         if (RAW != '>') {
     	xmlFatalErr(ctxt, XML_ERR_DOCTYPE_NOT_FINISHED, NULL);
+    	return;
         }
         NEXT;
     }
@@ Expand Down @@