This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch tor-browser-91.8.0esr-11.0-1 in repository tor-browser.
commit 1bb582673437dae86254e1326fe21262b0412881 Author: Peter Van der Beken peterv@propagandism.org AuthorDate: Wed Mar 2 22:18:23 2022 +0000
Bug 1754724 - Clear up some computations in expat code. r=farre, a=tritter
Differential Revision: https://phabricator.services.mozilla.com/D140165 --- parser/expat/lib/xmlparse.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/lib/xmlparse.c index 295030c37a048..52ea1cf413a93 100644 --- a/parser/expat/lib/xmlparse.c +++ b/parser/expat/lib/xmlparse.c @@ -3371,10 +3371,17 @@ storeAtts(XML_Parser parser, const ENCODING *enc, /* END MOZILLA CHANGE */ int j; /* hash table index */ unsigned long version = nsAttsVersion; - int nsAttsSize = (int)1 << nsAttsPower; + + /* Detect and prevent invalid shift */ + if (parser->m_nsAttsPower >= sizeof(unsigned int) * 8 /* bits per byte */) { + return XML_ERROR_NO_MEMORY; + } + + unsigned int nsAttsSize = 1u << nsAttsPower; /* BEGIN MOZILLA CHANGE (Include xmlns attributes in attributes array) */ if (nPrefixes) { /* END MOZILLA CHANGE */ + unsigned char oldNsAttsPower = parser->m_nsAttsPower; /* size of hash table must be at least 2 * (# of prefixed attributes) */ if ((nPrefixes << 1) >> nsAttsPower) { /* true for nsAttsPower = 0 */ NS_ATT *temp; @@ -3382,7 +3389,28 @@ storeAtts(XML_Parser parser, const ENCODING *enc, while (nPrefixes >> nsAttsPower++); if (nsAttsPower < 3) nsAttsPower = 3; - nsAttsSize = (int)1 << nsAttsPower; + + /* Detect and prevent invalid shift */ + if (parser->m_nsAttsPower >= sizeof(nsAttsSize) * 8 /* bits per byte */) { + /* Restore actual size of memory in m_nsAtts */ + parser->m_nsAttsPower = oldNsAttsPower; + return XML_ERROR_NO_MEMORY; + } + + nsAttsSize = 1u << parser->m_nsAttsPower; + + /* Detect and prevent integer overflow. + * The preprocessor guard addresses the "always false" warning + * from -Wtype-limits on platforms where + * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */ +#if UINT_MAX >= SIZE_MAX + if (nsAttsSize > (size_t)(-1) / sizeof(NS_ATT)) { + /* Restore actual size of memory in m_nsAtts */ + parser->m_nsAttsPower = oldNsAttsPower; + return XML_ERROR_NO_MEMORY; + } +#endif + temp = (NS_ATT *)REALLOC(nsAtts, nsAttsSize * sizeof(NS_ATT)); if (!temp) return XML_ERROR_NO_MEMORY;