27 lines
792 B
Diff
27 lines
792 B
Diff
|
From 2876ac5392a4e891b81e40e592c3ac6cb46016ce Mon Sep 17 00:00:00 2001
|
||
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
||
|
|
Date: Fri, 17 May 2024 08:50:50 +0800
|
||
|
|
Subject: [PATCH] [CVE-2024-34459] Fix buffer overread with `xmllint --htmlout`
|
||
|
|
|
||
|
|
Add a missing bounds check.
|
||
|
|
---
|
||
|
|
xmllint.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/xmllint.c b/xmllint.c
|
||
|
|
index 398670b..3f4bfb2 100644
|
||
|
|
--- a/xmllint.c
|
||
|
|
+++ b/xmllint.c
|
||
|
|
@@ -559,7 +559,7 @@ xmlHTMLPrintFileContext(xmlParserInputPtr input) {
|
||
|
|
len = strlen(buffer);
|
||
|
|
snprintf(&buffer[len], sizeof(buffer) - len, "\n");
|
||
|
|
cur = input->cur;
|
||
|
|
- while ((*cur == '\n') || (*cur == '\r'))
|
||
|
|
+ while ((cur > base) && ((*cur == '\n') || (*cur == '\r')))
|
||
|
|
cur--;
|
||
|
|
n = 0;
|
||
|
|
while ((cur != base) && (n++ < 80)) {
|
||
|
|
--
|
||
|
|
2.33.0
|
||
|
|
|