commit 257f1d3777240016d3ccd74a61cd7d0e0efcaae3
author Sadaf Ebrahimi <sadafebrahimi@google.com> Fri Jun 03 03:40:21 2022 +0000
committer Sadaf Ebrahimi <sadafebrahimi@google.com> Fri Jun 03 03:41:57 2022 +0000
tree 2518cf0d5bdde6cc4a92f664852776bc61de33c4
parent 3c8c2304206e5e6f917b3919bea9d10ea37830a0

Prevent integer overflow in function doProlog

Bug: http://b/221256678
Change-Id: I6fe381103f4eb287726d1ccb5bfec99db160ffe4

lib/xmlparse.c

diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index c4f3ffc..c7fe872 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -5205,23 +5205,29 @@
       if (dtd->in_eldecl) {
         ELEMENT_TYPE *el;
         const XML_Char *name;
-        int nameLen;
-        const char *nxt = (quant == XML_CQUANT_NONE
-                           ? next
-                           : next - enc->minBytesPerChar);
+        size_t nameLen;
+        const char *nxt
+            = (quant == XML_CQUANT_NONE ? next : next - enc->minBytesPerChar);
         int myindex = nextScaffoldPart(parser);
         if (myindex < 0)
           return XML_ERROR_NO_MEMORY;
         dtd->scaffold[myindex].type = XML_CTYPE_NAME;
         dtd->scaffold[myindex].quant = quant;
         el = getElementType(parser, enc, s, nxt);
-        if (!el)
+        if (! el)
           return XML_ERROR_NO_MEMORY;
         name = el->name;
         dtd->scaffold[myindex].name = name;
         nameLen = 0;
-        for (; name[nameLen++]; );
-        dtd->contentStringLen +=  nameLen;
+        for (; name[nameLen++];)
+          ;
+
+        /* Detect and prevent integer overflow */
+        if (nameLen > UINT_MAX - dtd->contentStringLen) {
+          return XML_ERROR_NO_MEMORY;
+        }
+
+        dtd->contentStringLen += (unsigned)nameLen;
         if (parser->m_elementDeclHandler)
           handleDefault = XML_FALSE;
       }