From 1d4f03d21b4f42031716522a6b96346b7a60d4c4 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Mon, 19 Aug 2024 22:26:07 +0200 Subject: [PATCH] lib: Reject negative len for XML_ParseBuffer Reported by TaiYou CVE: CVE-2024-45490 Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/5c1a31642e243f4870c0bd1f2afc7597976521bf] Signed-off-by: Archana Polampalli --- lib/xmlparse.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 9984d02..6f0440b 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -1996,6 +1996,12 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { if (parser == NULL) return XML_STATUS_ERROR; + + if (len < 0) { + parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT; + return XML_STATUS_ERROR; + } + switch (parser->m_parsingStatus.parsing) { case XML_SUSPENDED: parser->m_errorCode = XML_ERROR_SUSPENDED; -- 2.40.0