Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix overflow (v2)

Browse Source 
(Some post-processing by Sebastian Pipping)
This commit is contained in:
Karl Waclawek
2016-05-02 00:02:44 +02:00
committed by Vadim Zeitlin
parent 088b79bd88
commit af6ef9555a
3 changed files with 47 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/expat/lib/xmlparse.c
View File

@@ -5372,7 +5372,7 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
*eventEndPP = s; *eventEndPP = s;
defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf)); defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf));
*eventPP = s; *eventPP = s;
} while (s != end); } while (s < end);
} }
else else
defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s)); defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s));
@@ -6174,12 +6174,15 @@ static XML_Char *
poolAppend(STRING_POOL *pool, const ENCODING *enc, poolAppend(STRING_POOL *pool, const ENCODING *enc,
const char *ptr, const char *end) const char *ptr, const char *end)
{ {
ICHAR* poolPtrPrev = NULL;
if (!pool->ptr && !poolGrow(pool)) if (!pool->ptr && !poolGrow(pool))
return NULL; return NULL;
for (;;) { for (;;) {
XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
if (ptr == end) /* complete or zero progress? */
if (ptr == end || pool->ptr == poolPtrPrev)
break; break;
poolPtrPrev = pool->ptr;
if (!poolGrow(pool)) if (!poolGrow(pool))
return NULL; return NULL;
} }

20
src/expat/lib/xmltok.c
View File

@@ -335,7 +335,7 @@ utf8_toUtf8(const ENCODING *enc,
if (((unsigned char)fromLim[-1] & 0xc0) != 0x80) if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
break; break;
} }
for (to = *toP, from = *fromP; from != fromLim; from++, to++) for (to = *toP, from = *fromP; from < fromLim; from++, to++)
*to = *from; *to = *from;
*fromP = from; *fromP = from;
*toP = to; *toP = to;
@@ -348,7 +348,7 @@ utf8_toUtf16(const ENCODING *enc,
{ {
unsigned short *to = *toP; unsigned short *to = *toP;
const char *from = *fromP; const char *from = *fromP;
while (from != fromLim && to != toLim) { while (from < fromLim && to < toLim) {
switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) { switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
case BT_LEAD2: case BT_LEAD2:
*to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f)); *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
@@ -459,7 +459,7 @@ latin1_toUtf16(const ENCODING *enc,
const char **fromP, const char *fromLim, const char **fromP, const char *fromLim,
unsigned short **toP, const unsigned short *toLim) unsigned short **toP, const unsigned short *toLim)
{ {
while (*fromP != fromLim && *toP != toLim) while (*fromP < fromLim && *toP < toLim)
*(*toP)++ = (unsigned char)*(*fromP)++; *(*toP)++ = (unsigned char)*(*fromP)++;
} }
@@ -492,7 +492,7 @@ ascii_toUtf8(const ENCODING *enc,
const char **fromP, const char *fromLim, const char **fromP, const char *fromLim,
char **toP, const char *toLim) char **toP, const char *toLim)
{ {
while (*fromP != fromLim && *toP != toLim) while (*fromP < fromLim && *toP < toLim)
*(*toP)++ = *(*fromP)++; *(*toP)++ = *(*fromP)++;
} }
@@ -545,8 +545,9 @@ E ## toUtf8(const ENCODING *enc, \
const char **fromP, const char *fromLim, \ const char **fromP, const char *fromLim, \
char **toP, const char *toLim) \ char **toP, const char *toLim) \
{ \ { \
const char *from; \ const char *from = *fromP; \
for (from = *fromP; from != fromLim; from += 2) { \ fromLim = from + (((fromLim - from) >> 1) << 1); /* shrink to even */ \
for (; from < fromLim; from += 2) { \
int plane; \ int plane; \
unsigned char lo2; \ unsigned char lo2; \
unsigned char lo = GET_LO(from); \ unsigned char lo = GET_LO(from); \
@@ -608,11 +609,12 @@ E ## toUtf16(const ENCODING *enc, \
const char **fromP, const char *fromLim, \ const char **fromP, const char *fromLim, \
unsigned short **toP, const unsigned short *toLim) \ unsigned short **toP, const unsigned short *toLim) \
{ \ { \
fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \
/* Avoid copying first half only of surrogate */ \ /* Avoid copying first half only of surrogate */ \
if (fromLim - *fromP > ((toLim - *toP) << 1) \ if (fromLim - *fromP > ((toLim - *toP) << 1) \
&& (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \ && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
fromLim -= 2; \ fromLim -= 2; \
for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \ for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \
*(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \ *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
} }
@@ -1332,7 +1334,7 @@ unknown_toUtf16(const ENCODING *enc,
unsigned short **toP, const unsigned short *toLim) unsigned short **toP, const unsigned short *toLim)
{ {
const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc); const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
while (*fromP != fromLim && *toP != toLim) { while (*fromP < fromLim && *toP < toLim) {
unsigned short c = uenc->utf16[(unsigned char)**fromP]; unsigned short c = uenc->utf16[(unsigned char)**fromP];
if (c == 0) { if (c == 0) {
c = (unsigned short) c = (unsigned short)
@@ -1507,7 +1509,7 @@ initScan(const ENCODING * const *encodingTable,
{ {
const ENCODING **encPtr; const ENCODING **encPtr;
if (ptr == end) if (ptr >= end)
return XML_TOK_NONE; return XML_TOK_NONE;
encPtr = enc->encPtr; encPtr = enc->encPtr;
if (ptr + 1 == end) { if (ptr + 1 == end) {

62
src/expat/lib/xmltok_impl.c
View File

@@ -93,13 +93,13 @@ static int PTRCALL
PREFIX(scanComment)(const ENCODING *enc, const char *ptr, PREFIX(scanComment)(const ENCODING *enc, const char *ptr,
const char *end, const char **nextTokPtr) const char *end, const char **nextTokPtr)
{ {
if (ptr != end) { if (ptr < end) {
if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) { if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
ptr += MINBPC(enc); ptr += MINBPC(enc);
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
INVALID_CASES(ptr, nextTokPtr) INVALID_CASES(ptr, nextTokPtr)
case BT_MINUS: case BT_MINUS:
@@ -147,7 +147,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
case BT_PERCNT: case BT_PERCNT:
if (ptr + MINBPC(enc) == end) if (ptr + MINBPC(enc) == end)
@@ -233,7 +233,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
case BT_S: case BT_CR: case BT_LF: case BT_S: case BT_CR: case BT_LF:
@@ -242,7 +242,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
ptr += MINBPC(enc); ptr += MINBPC(enc);
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
INVALID_CASES(ptr, nextTokPtr) INVALID_CASES(ptr, nextTokPtr)
case BT_QUEST: case BT_QUEST:
@@ -305,7 +305,7 @@ static int PTRCALL
PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr, PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
const char *end, const char **nextTokPtr) const char *end, const char **nextTokPtr)
{ {
if (ptr == end) if (ptr >= end)
return XML_TOK_NONE; return XML_TOK_NONE;
if (MINBPC(enc) > 1) { if (MINBPC(enc) > 1) {
size_t n = end - ptr; size_t n = end - ptr;
@@ -348,7 +348,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
ptr += MINBPC(enc); ptr += MINBPC(enc);
break; break;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
#define LEAD_CASE(n) \ #define LEAD_CASE(n) \
case BT_LEAD ## n: \ case BT_LEAD ## n: \
@@ -391,11 +391,11 @@ PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
case BT_S: case BT_CR: case BT_LF: case BT_S: case BT_CR: case BT_LF:
for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
case BT_S: case BT_CR: case BT_LF: case BT_S: case BT_CR: case BT_LF:
break; break;
@@ -432,7 +432,7 @@ static int PTRCALL
PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr, PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
const char *end, const char **nextTokPtr) const char *end, const char **nextTokPtr)
{ {
if (ptr != end) { if (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
case BT_DIGIT: case BT_DIGIT:
case BT_HEX: case BT_HEX:
@@ -441,7 +441,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
case BT_DIGIT: case BT_DIGIT:
case BT_HEX: case BT_HEX:
@@ -464,7 +464,7 @@ static int PTRCALL
PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr, PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
const char *end, const char **nextTokPtr) const char *end, const char **nextTokPtr)
{ {
if (ptr != end) { if (ptr < end) {
if (CHAR_MATCHES(enc, ptr, ASCII_x)) if (CHAR_MATCHES(enc, ptr, ASCII_x))
return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr); return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
@@ -474,7 +474,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) { for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
case BT_DIGIT: case BT_DIGIT:
break; break;
@@ -506,7 +506,7 @@ PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
case BT_SEMI: case BT_SEMI:
@@ -529,7 +529,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
#ifdef XML_NS #ifdef XML_NS
int hadColon = 0; int hadColon = 0;
#endif #endif
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
#ifdef XML_NS #ifdef XML_NS
@@ -716,7 +716,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
hadColon = 0; hadColon = 0;
#endif #endif
/* we have a start-tag */ /* we have a start-tag */
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
#ifdef XML_NS #ifdef XML_NS
@@ -740,7 +740,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
case BT_S: case BT_CR: case BT_LF: case BT_S: case BT_CR: case BT_LF:
{ {
ptr += MINBPC(enc); ptr += MINBPC(enc);
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr) CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
case BT_GT: case BT_GT:
@@ -785,7 +785,7 @@ static int PTRCALL
PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end, PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
const char **nextTokPtr) const char **nextTokPtr)
{ {
if (ptr == end) if (ptr >= end)
return XML_TOK_NONE; return XML_TOK_NONE;
if (MINBPC(enc) > 1) { if (MINBPC(enc) > 1) {
size_t n = end - ptr; size_t n = end - ptr;
@@ -832,7 +832,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
ptr += MINBPC(enc); ptr += MINBPC(enc);
break; break;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
#define LEAD_CASE(n) \ #define LEAD_CASE(n) \
case BT_LEAD ## n: \ case BT_LEAD ## n: \
@@ -895,7 +895,7 @@ PREFIX(scanPercent)(const ENCODING *enc, const char *ptr, const char *end,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
case BT_SEMI: case BT_SEMI:
@@ -921,7 +921,7 @@ PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
case BT_CR: case BT_LF: case BT_S: case BT_CR: case BT_LF: case BT_S:
@@ -941,7 +941,7 @@ PREFIX(scanLit)(int open, const ENCODING *enc,
const char *ptr, const char *end, const char *ptr, const char *end,
const char **nextTokPtr) const char **nextTokPtr)
{ {
while (ptr != end) { while (ptr < end) {
int t = BYTE_TYPE(enc, ptr); int t = BYTE_TYPE(enc, ptr);
switch (t) { switch (t) {
INVALID_CASES(ptr, nextTokPtr) INVALID_CASES(ptr, nextTokPtr)
@@ -973,7 +973,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
const char **nextTokPtr) const char **nextTokPtr)
{ {
int tok; int tok;
if (ptr == end) if (ptr >= end)
return XML_TOK_NONE; return XML_TOK_NONE;
if (MINBPC(enc) > 1) { if (MINBPC(enc) > 1) {
size_t n = end - ptr; size_t n = end - ptr;
@@ -1141,7 +1141,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
*nextTokPtr = ptr; *nextTokPtr = ptr;
return XML_TOK_INVALID; return XML_TOK_INVALID;
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
CHECK_NAME_CASES(enc, ptr, end, nextTokPtr) CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
case BT_GT: case BT_RPAR: case BT_COMMA: case BT_GT: case BT_RPAR: case BT_COMMA:
@@ -1204,10 +1204,10 @@ PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr,
const char *end, const char **nextTokPtr) const char *end, const char **nextTokPtr)
{ {
const char *start; const char *start;
if (ptr == end) if (ptr >= end)
return XML_TOK_NONE; return XML_TOK_NONE;
start = ptr; start = ptr;
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
#define LEAD_CASE(n) \ #define LEAD_CASE(n) \
case BT_LEAD ## n: ptr += n; break; case BT_LEAD ## n: ptr += n; break;
@@ -1262,10 +1262,10 @@ PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr,
const char *end, const char **nextTokPtr) const char *end, const char **nextTokPtr)
{ {
const char *start; const char *start;
if (ptr == end) if (ptr >= end)
return XML_TOK_NONE; return XML_TOK_NONE;
start = ptr; start = ptr;
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
#define LEAD_CASE(n) \ #define LEAD_CASE(n) \
case BT_LEAD ## n: ptr += n; break; case BT_LEAD ## n: ptr += n; break;
@@ -1326,7 +1326,7 @@ PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr,
end = ptr + n; end = ptr + n;
} }
} }
while (ptr != end) { while (ptr < end) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
INVALID_CASES(ptr, nextTokPtr) INVALID_CASES(ptr, nextTokPtr)
case BT_LT: case BT_LT:
@@ -1373,7 +1373,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
{ {
ptr += MINBPC(enc); ptr += MINBPC(enc);
end -= MINBPC(enc); end -= MINBPC(enc);
for (; ptr != end; ptr += MINBPC(enc)) { for (; ptr < end; ptr += MINBPC(enc)) {
switch (BYTE_TYPE(enc, ptr)) { switch (BYTE_TYPE(enc, ptr)) {
case BT_DIGIT: case BT_DIGIT:
case BT_HEX: case BT_HEX:
@@ -1760,7 +1760,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
case BT_CR: case BT_CR:
pos->lineNumber++; pos->lineNumber++;
ptr += MINBPC(enc); ptr += MINBPC(enc);
if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF) if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF)
ptr += MINBPC(enc); ptr += MINBPC(enc);
pos->columnNumber = (XML_Size)-1; pos->columnNumber = (XML_Size)-1;
break; break;