153aa9179Sopenharmony_ciFrom 7ec314efcd8b3df1d05d793812e54656bf539af8 Mon Sep 17 00:00:00 2001 253aa9179Sopenharmony_ciFrom: Nick Wellnhofer <wellnhofer@aevum.de> 353aa9179Sopenharmony_ciDate: Mon, 30 Jan 2023 15:59:55 +0100 453aa9179Sopenharmony_ciSubject: [PATCH] malloc-fail: Add error checks in xmlXPathEqualValuesCommon 553aa9179Sopenharmony_ci 653aa9179Sopenharmony_ciAvoid null deref. 753aa9179Sopenharmony_ci 853aa9179Sopenharmony_ciFound with libFuzzer, see #344. 953aa9179Sopenharmony_ci 1053aa9179Sopenharmony_ciReference:https://github.com/GNOME/libxml2/commit/7ec314efcd8b3df1d05d793812e54656bf539af8 1153aa9179Sopenharmony_ciConflict:NA 1253aa9179Sopenharmony_ci--- 1353aa9179Sopenharmony_ci xpath.c | 2 ++ 1453aa9179Sopenharmony_ci 1 file changed, 2 insertions(+) 1553aa9179Sopenharmony_ci 1653aa9179Sopenharmony_cidiff --git a/xpath.c b/xpath.c 1753aa9179Sopenharmony_ciindex fbec21b..6d76e43 100644 1853aa9179Sopenharmony_ci--- a/xpath.c 1953aa9179Sopenharmony_ci+++ b/xpath.c 2053aa9179Sopenharmony_ci@@ -7011,6 +7011,7 @@ xmlXPathEqualValuesCommon(xmlXPathParserContextPtr ctxt, 2153aa9179Sopenharmony_ci valuePush(ctxt, arg2); 2253aa9179Sopenharmony_ci xmlXPathNumberFunction(ctxt, 1); 2353aa9179Sopenharmony_ci arg2 = valuePop(ctxt); 2453aa9179Sopenharmony_ci+ CHECK_ERROR0; 2553aa9179Sopenharmony_ci /* Falls through. */ 2653aa9179Sopenharmony_ci case XPATH_NUMBER: 2753aa9179Sopenharmony_ci /* Hand check NaN and Infinity equalities */ 2853aa9179Sopenharmony_ci@@ -7074,6 +7075,7 @@ xmlXPathEqualValuesCommon(xmlXPathParserContextPtr ctxt, 2953aa9179Sopenharmony_ci valuePush(ctxt, arg1); 3053aa9179Sopenharmony_ci xmlXPathNumberFunction(ctxt, 1); 3153aa9179Sopenharmony_ci arg1 = valuePop(ctxt); 3253aa9179Sopenharmony_ci+ CHECK_ERROR0; 3353aa9179Sopenharmony_ci /* Hand check NaN and Infinity equalities */ 3453aa9179Sopenharmony_ci if (xmlXPathIsNaN(arg1->floatval) || 3553aa9179Sopenharmony_ci xmlXPathIsNaN(arg2->floatval)) { 3653aa9179Sopenharmony_ci-- 3753aa9179Sopenharmony_ci2.27.0 3853aa9179Sopenharmony_ci 39