From 19b197b61646fd2ad7e584b739500876681c4e3d Mon Sep 17 00:00:00 2001 From: Nick Wellnhofer Date: Sun, 5 Mar 2023 14:10:56 +0100 Subject: [PATCH] malloc-fail: Fix null deref after xmlSchemaCompareDates Found with libFuzzer, see #344. Reference:https://github.com/GNOME/libxml2/commit/19b197b61646fd2ad7e584b739500876681c4e3d Conflict:NA --- xmlschemastypes.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/xmlschemastypes.c b/xmlschemastypes.c index 160777f..d5c7790 100644 --- a/xmlschemastypes.c +++ b/xmlschemastypes.c @@ -4146,9 +4146,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y) if (!y->value.date.tz_flag) { p1 = xmlSchemaDateNormalize(x, 0); + if (p1 == NULL) + return -2; p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day; /* normalize y + 14:00 */ q1 = xmlSchemaDateNormalize(y, (14 * SECS_PER_HOUR)); + if (q1 == NULL) { + xmlSchemaFreeValue(p1); + return -2; + } q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day; if (p1d < q1d) { @@ -4167,6 +4173,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y) int ret = 0; /* normalize y - 14:00 */ q2 = xmlSchemaDateNormalize(y, -(14 * SECS_PER_HOUR)); + if (q2 == NULL) { + xmlSchemaFreeValue(p1); + xmlSchemaFreeValue(q1); + return -2; + } q2d = _xmlSchemaDateCastYMToDays(q2) + q2->value.date.day; if (p1d > q2d) ret = 1; @@ -4190,10 +4201,16 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y) } } else if (y->value.date.tz_flag) { q1 = xmlSchemaDateNormalize(y, 0); + if (q1 == NULL) + return -2; q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day; /* normalize x - 14:00 */ p1 = xmlSchemaDateNormalize(x, -(14 * SECS_PER_HOUR)); + if (p1 == NULL) { + xmlSchemaFreeValue(q1); + return -2; + } p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day; if (p1d < q1d) { @@ -4212,6 +4229,11 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y) int ret = 0; /* normalize x + 14:00 */ p2 = xmlSchemaDateNormalize(x, (14 * SECS_PER_HOUR)); + if (p2 == NULL) { + xmlSchemaFreeValue(p1); + xmlSchemaFreeValue(q1); + return -2; + } p2d = _xmlSchemaDateCastYMToDays(p2) + p2->value.date.day; if (p2d > q1d) { @@ -4241,9 +4263,15 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y) if (x->type == y->type) { int ret = 0; q1 = xmlSchemaDateNormalize(y, 0); + if (q1 == NULL) + return -2; q1d = _xmlSchemaDateCastYMToDays(q1) + q1->value.date.day; p1 = xmlSchemaDateNormalize(x, 0); + if (p1 == NULL) { + xmlSchemaFreeValue(q1); + return -2; + } p1d = _xmlSchemaDateCastYMToDays(p1) + p1->value.date.day; if (p1d < q1d) { -- 2.27.0