diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2019-06-03 13:14:45 +0200 |
|---|---|---|
| committer | Hyunjee Kim <hj0426.kim@samsung.com> | 2019-07-16 14:53:17 +0900 |
| commit | f993ce00538dfaecc3fcfa270f7661a89d98e051 (patch) | |
| tree | 481b5951e7f5065989d95f8f63f954fc15bb36aa | |
| parent | 36f68f1ac0b954ebabfb1b506df53691f7434ba4 (diff) | |
| download | libxslt-accepted/tizen/5.5/base/20191030.081732.tar.gz libxslt-accepted/tizen/5.5/base/20191030.081732.tar.bz2 libxslt-accepted/tizen/5.5/base/20191030.081732.zip | |
Fix uninitialized read with UTF-8 grouping charstizen_5.5.m2_releasesubmit/tizen_base/20190716.074853submit/tizen_5.5_base_mobile_hotfix/20201023.171501submit/tizen_5.5_base/20191030.000001accepted/tizen/base/20190721.082429accepted/tizen/5.5/base/mobile/hotfix/20201023.084245accepted/tizen/5.5/base/20191030.081732tizen_5.5_base_mobile_hotfixaccepted/tizen_5.5_base_mobile_hotfix
The character type in xsltFormatNumberConversion was too narrow and
an invalid character/length combination could be passed to
xsltNumberFormatDecimal, resulting in an uninitialized read.
Found by OSS-Fuzz.
Change-Id: Ib12c3fa39fd4d83325307b7c4b692ecb0d83c724
Signed-off-by: Hyunjee Kim <hj0426.kim@samsung.com>
| -rw-r--r-- | libxslt/numbers.c | 5 | ||||
| -rw-r--r-- | tests/docs/bug-222.xml | 1 | ||||
| -rw-r--r-- | tests/general/bug-222.out | 2 | ||||
| -rw-r--r-- | tests/general/bug-222.xsl | 6 |
4 files changed, 12 insertions, 2 deletions
diff --git a/libxslt/numbers.c b/libxslt/numbers.c index 38bc70a8..7004eeb5 100644 --- a/libxslt/numbers.c +++ b/libxslt/numbers.c @@ -1277,13 +1277,14 @@ OUTPUT_NUMBER: number = floor((scale * number + 0.5)) / scale; if ((self->grouping != NULL) && (self->grouping[0] != 0)) { + int gchar; len = xmlStrlen(self->grouping); - pchar = xsltGetUTF8Char(self->grouping, &len); + gchar = xsltGetUTF8Char(self->grouping, &len); xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0], format_info.integer_digits, format_info.group, - pchar, len); + gchar, len); } else xsltNumberFormatDecimal(buffer, floor(number), self->zeroDigit[0], format_info.integer_digits, diff --git a/tests/docs/bug-222.xml b/tests/docs/bug-222.xml new file mode 100644 index 00000000..69d62f2c --- /dev/null +++ b/tests/docs/bug-222.xml @@ -0,0 +1 @@ +<doc/> diff --git a/tests/general/bug-222.out b/tests/general/bug-222.out new file mode 100644 index 00000000..e3139698 --- /dev/null +++ b/tests/general/bug-222.out @@ -0,0 +1,2 @@ +<?xml version="1.0"?> +1⠢0 diff --git a/tests/general/bug-222.xsl b/tests/general/bug-222.xsl new file mode 100644 index 00000000..e32dc473 --- /dev/null +++ b/tests/general/bug-222.xsl @@ -0,0 +1,6 @@ +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:decimal-format name="f" grouping-separator="⠢"/> + <xsl:template match="/"> + <xsl:value-of select="format-number(10,'#⠢0','f')"/> + </xsl:template> +</xsl:stylesheet> |