From 5ae51be57ed0ca1e87582881d07ea9c29c4f7c05 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Wed, 3 Sep 2025 17:06:41 +0200 Subject: [PATCH] fuzz: Be robust towards NULL return from XML_ExternalEntityParserCreate CVE: CVE-2025-59375 Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/5ae51be57ed0ca1e87582881d07ea9c29c4f7c05] Signed-off-by: Peter Marko --- fuzz/xml_parse_fuzzer.c | 14 ++++++++------ fuzz/xml_parsebuffer_fuzzer.c | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/fuzz/xml_parse_fuzzer.c b/fuzz/xml_parse_fuzzer.c index 90c38549..29ab33ff 100644 --- a/fuzz/xml_parse_fuzzer.c +++ b/fuzz/xml_parse_fuzzer.c @@ -89,15 +89,17 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { XML_Parser externalEntityParser = XML_ExternalEntityParserCreate(parentParser, "e1", NULL); - assert(externalEntityParser); - ParseOneInput(externalEntityParser, data, size); - XML_ParserFree(externalEntityParser); + if (externalEntityParser != NULL) { + ParseOneInput(externalEntityParser, data, size); + XML_ParserFree(externalEntityParser); + } XML_Parser externalDtdParser = XML_ExternalEntityParserCreate(parentParser, NULL, NULL); - assert(externalDtdParser); - ParseOneInput(externalDtdParser, data, size); - XML_ParserFree(externalDtdParser); + if (externalDtdParser != NULL) { + ParseOneInput(externalDtdParser, data, size); + XML_ParserFree(externalDtdParser); + } // finally frees this parser which served as parent XML_ParserFree(parentParser); diff --git a/fuzz/xml_parsebuffer_fuzzer.c b/fuzz/xml_parsebuffer_fuzzer.c index 0db67dce..38b9981b 100644 --- a/fuzz/xml_parsebuffer_fuzzer.c +++ b/fuzz/xml_parsebuffer_fuzzer.c @@ -101,15 +101,17 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { XML_Parser externalEntityParser = XML_ExternalEntityParserCreate(parentParser, "e1", NULL); - assert(externalEntityParser); - ParseOneInput(externalEntityParser, data, size); - XML_ParserFree(externalEntityParser); + if (externalEntityParser != NULL) { + ParseOneInput(externalEntityParser, data, size); + XML_ParserFree(externalEntityParser); + } XML_Parser externalDtdParser = XML_ExternalEntityParserCreate(parentParser, NULL, NULL); - assert(externalDtdParser); - ParseOneInput(externalDtdParser, data, size); - XML_ParserFree(externalDtdParser); + if (externalDtdParser != NULL) { + ParseOneInput(externalDtdParser, data, size); + XML_ParserFree(externalDtdParser); + } // finally frees this parser which served as parent XML_ParserFree(parentParser);