105 lines
4.6 KiB
Diff
105 lines
4.6 KiB
Diff
|
From a7ce80a013f2a08cb1ac4aac368f2250eea03ebf Mon Sep 17 00:00:00 2001
|
||
|
|
From: Sebastian Pipping <sebastian@pipping.org>
|
||
|
|
Date: Sun, 11 Sep 2022 19:34:33 +0200
|
||
|
|
Subject: [PATCH] tests: Cover heap use-after-free issue in doContent
|
||
|
|
|
||
|
|
---
|
||
|
|
tests/runtests.c | 74 ++++++++++++++++++++++++++++++++++++++++++
|
||
|
|
1 file changed, 74 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/tests/runtests.c b/tests/runtests.c
|
||
|
|
index ea371b42..ab3aff65 100644
|
||
|
|
--- a/tests/runtests.c
|
||
|
|
+++ b/tests/runtests.c
|
||
|
|
@@ -4990,6 +4990,78 @@ START_TEST(test_suspend_resume_internal_entity) {
|
||
|
|
}
|
||
|
|
END_TEST
|
||
|
|
|
||
|
|
+void
|
||
|
|
+suspending_comment_handler(void *userData, const XML_Char *data) {
|
||
|
|
+ UNUSED_P(data);
|
||
|
|
+ XML_Parser parser = (XML_Parser)userData;
|
||
|
|
+ XML_StopParser(parser, XML_TRUE);
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
+START_TEST(test_suspend_resume_internal_entity_issue_629) {
|
||
|
|
+ const char *const text
|
||
|
|
+ = "<!DOCTYPE a [<!ENTITY e '<!--COMMENT-->a'>]><a>&e;<b>\n"
|
||
|
|
+ "<"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||
|
|
+ "/>"
|
||
|
|
+ "</b></a>";
|
||
|
|
+ const size_t firstChunkSizeBytes = 54;
|
||
|
|
+
|
||
|
|
+ XML_Parser parser = XML_ParserCreate(NULL);
|
||
|
|
+ XML_SetUserData(parser, parser);
|
||
|
|
+ XML_SetCommentHandler(parser, suspending_comment_handler);
|
||
|
|
+
|
||
|
|
+ if (XML_Parse(parser, text, (int)firstChunkSizeBytes, XML_FALSE)
|
||
|
|
+ != XML_STATUS_SUSPENDED)
|
||
|
|
+ xml_failure(parser);
|
||
|
|
+ if (XML_ResumeParser(parser) != XML_STATUS_OK)
|
||
|
|
+ xml_failure(parser);
|
||
|
|
+ if (XML_Parse(parser, text + firstChunkSizeBytes,
|
||
|
|
+ (int)(strlen(text) - firstChunkSizeBytes), XML_TRUE)
|
||
|
|
+ != XML_STATUS_OK)
|
||
|
|
+ xml_failure(parser);
|
||
|
|
+ XML_ParserFree(parser);
|
||
|
|
+}
|
||
|
|
+END_TEST
|
||
|
|
+
|
||
|
|
/* Test syntax error is caught at parse resumption */
|
||
|
|
START_TEST(test_resume_entity_with_syntax_error) {
|
||
|
|
const char *text = "<!DOCTYPE doc [\n"
|
||
|
|
@@ -12016,6 +12088,8 @@ make_suite(void) {
|
||
|
|
tcase_add_test(tc_basic, test_partial_char_in_epilog);
|
||
|
|
tcase_add_test(tc_basic, test_hash_collision);
|
||
|
|
tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_internal_entity);
|
||
|
|
+ tcase_add_test__ifdef_xml_dtd(tc_basic,
|
||
|
|
+ test_suspend_resume_internal_entity_issue_629);
|
||
|
|
tcase_add_test__ifdef_xml_dtd(tc_basic, test_resume_entity_with_syntax_error);
|
||
|
|
tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_parameter_entity);
|
||
|
|
tcase_add_test(tc_basic, test_restart_on_error);
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|