61 lines
2.2 KiB
Diff
61 lines
2.2 KiB
Diff
From f0fd1b67fc883a24cdd039abb3d4fe4696104d72 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Wed, 26 Aug 2020 00:16:38 +0200
|
|
Subject: [PATCH 139/139] Limit size of free lists in XML reader when fuzzing
|
|
|
|
Keeping objects on a free list can hide memory errors. Only allow a
|
|
single node on free lists used by the XML reader when fuzzing. This
|
|
should hide fewer errors while still exercising the free list logic.
|
|
---
|
|
xmlreader.c | 13 ++++++++++---
|
|
1 file changed, 10 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/xmlreader.c b/xmlreader.c
|
|
index 1ab15ba..a9b9ef9 100644
|
|
--- a/xmlreader.c
|
|
+++ b/xmlreader.c
|
|
@@ -48,6 +48,13 @@
|
|
|
|
#define MAX_ERR_MSG_SIZE 64000
|
|
|
|
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
|
|
+/* Keeping free objects can hide memory errors. */
|
|
+#define MAX_FREE_NODES 1
|
|
+#else
|
|
+#define MAX_FREE_NODES 100
|
|
+#endif
|
|
+
|
|
/*
|
|
* The following VA_COPY was coded following an example in
|
|
* the Samba project. It may not be sufficient for some
|
|
@@ -365,7 +372,7 @@ xmlTextReaderFreeProp(xmlTextReaderPtr reader, xmlAttrPtr cur) {
|
|
|
|
DICT_FREE(cur->name);
|
|
if ((reader != NULL) && (reader->ctxt != NULL) &&
|
|
- (reader->ctxt->freeAttrsNr < 100)) {
|
|
+ (reader->ctxt->freeAttrsNr < MAX_FREE_NODES)) {
|
|
cur->next = reader->ctxt->freeAttrs;
|
|
reader->ctxt->freeAttrs = cur;
|
|
reader->ctxt->freeAttrsNr++;
|
|
@@ -466,7 +473,7 @@ xmlTextReaderFreeNodeList(xmlTextReaderPtr reader, xmlNodePtr cur) {
|
|
if (((cur->type == XML_ELEMENT_NODE) ||
|
|
(cur->type == XML_TEXT_NODE)) &&
|
|
(reader != NULL) && (reader->ctxt != NULL) &&
|
|
- (reader->ctxt->freeElemsNr < 100)) {
|
|
+ (reader->ctxt->freeElemsNr < MAX_FREE_NODES)) {
|
|
cur->next = reader->ctxt->freeElems;
|
|
reader->ctxt->freeElems = cur;
|
|
reader->ctxt->freeElemsNr++;
|
|
@@ -554,7 +561,7 @@ xmlTextReaderFreeNode(xmlTextReaderPtr reader, xmlNodePtr cur) {
|
|
if (((cur->type == XML_ELEMENT_NODE) ||
|
|
(cur->type == XML_TEXT_NODE)) &&
|
|
(reader != NULL) && (reader->ctxt != NULL) &&
|
|
- (reader->ctxt->freeElemsNr < 100)) {
|
|
+ (reader->ctxt->freeElemsNr < MAX_FREE_NODES)) {
|
|
cur->next = reader->ctxt->freeElems;
|
|
reader->ctxt->freeElems = cur;
|
|
reader->ctxt->freeElemsNr++;
|
|
--
|
|
1.8.3.1
|
|
|