153aa9179Sopenharmony_ciFrom 85057e513111f69f5a8af94f3a82899d23d4c057 Mon Sep 17 00:00:00 2001 253aa9179Sopenharmony_ciFrom: Nick Wellnhofer <wellnhofer@aevum.de> 353aa9179Sopenharmony_ciDate: Tue, 21 Feb 2023 15:24:19 +0100 453aa9179Sopenharmony_ciSubject: [PATCH] regexp: Add sanity check in xmlRegCalloc2 553aa9179Sopenharmony_ci 653aa9179Sopenharmony_ciThese arguments should be non-zero, but add a sanity check to avoid 753aa9179Sopenharmony_cidivision by zero. 853aa9179Sopenharmony_ci 953aa9179Sopenharmony_ciFixes #450. 1053aa9179Sopenharmony_ci 1153aa9179Sopenharmony_ciReference:https://github.com/GNOME/libxml2/commit/85057e513111f69f5a8af94f3a82899d23d4c057 1253aa9179Sopenharmony_ciConflict:NA 1353aa9179Sopenharmony_ci--- 1453aa9179Sopenharmony_ci xmlregexp.c | 3 ++- 1553aa9179Sopenharmony_ci 1 file changed, 2 insertions(+), 1 deletion(-) 1653aa9179Sopenharmony_ci 1753aa9179Sopenharmony_cidiff --git a/xmlregexp.c b/xmlregexp.c 1853aa9179Sopenharmony_ciindex e7c48a4..cc4ae6f 100644 1953aa9179Sopenharmony_ci--- a/xmlregexp.c 2053aa9179Sopenharmony_ci+++ b/xmlregexp.c 2153aa9179Sopenharmony_ci@@ -443,7 +443,8 @@ xmlRegCalloc2(size_t dim1, size_t dim2, size_t elemSize) { 2253aa9179Sopenharmony_ci void *ret; 2353aa9179Sopenharmony_ci 2453aa9179Sopenharmony_ci /* Check for overflow */ 2553aa9179Sopenharmony_ci- if (dim1 > SIZE_MAX / dim2 / elemSize) 2653aa9179Sopenharmony_ci+ if ((dim2 == 0) || (elemSize == 0) || 2753aa9179Sopenharmony_ci+ (dim1 > SIZE_MAX / dim2 / elemSize)) 2853aa9179Sopenharmony_ci return (NULL); 2953aa9179Sopenharmony_ci totalSize = dim1 * dim2 * elemSize; 3053aa9179Sopenharmony_ci ret = xmlMalloc(totalSize); 3153aa9179Sopenharmony_ci-- 3253aa9179Sopenharmony_ci2.27.0 3353aa9179Sopenharmony_ci 34