[libxml2] Fix undefined behavior in UTF16LEToUTF8
- From: Nick Wellnhofer <nwellnhof src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [libxml2] Fix undefined behavior in UTF16LEToUTF8
- Date: Tue, 16 Jun 2020 17:48:22 +0000 (UTC)
commit 2f9382033e4c398dd1c9aae4d24fa9f649fbf23d
Author: Nick Wellnhofer <wellnhofer aevum de>
Date: Mon Jun 15 15:45:47 2020 +0200
Fix undefined behavior in UTF16LEToUTF8
Don't perform arithmetic on null pointer.
Found with libFuzzer and UBSan.
encoding.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
---
diff --git a/encoding.c b/encoding.c
index 8b6f349c..1a6386a4 100644
--- a/encoding.c
+++ b/encoding.c
@@ -496,13 +496,18 @@ UTF16LEToUTF8(unsigned char* out, int *outlen,
{
unsigned char* outstart = out;
const unsigned char* processed = inb;
- unsigned char* outend = out + *outlen;
+ unsigned char* outend;
unsigned short* in = (unsigned short*) inb;
unsigned short* inend;
unsigned int c, d, inlen;
unsigned char *tmp;
int bits;
+ if (*outlen == 0) {
+ *inlenb = 0;
+ return(0);
+ }
+ outend = out + *outlen;
if ((*inlenb % 2) == 1)
(*inlenb)--;
inlen = *inlenb / 2;
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]