Skip to content

Commit

Permalink
Fix integer overflows with XML_PARSE_HUGE
Browse files Browse the repository at this point in the history
Also impose size limits when XML_PARSE_HUGE is set. Limit size of names
to XML_MAX_TEXT_LENGTH (10 million bytes) and other content to
XML_MAX_HUGE_LENGTH (1 billion bytes).

Move some the length checks to the end of the respective loop to make
them strict.

xmlParseEntityValue didn't have a length limitation at all. But without
XML_PARSE_HUGE, this should eventually trigger an error in xmlGROW.

Thanks to Maddie Stone working with Google Project Zero for the report!
  • Loading branch information
nwellnhof committed Oct 14, 2022
1 parent 1a2d8dd commit ffaec75
Showing 1 changed file with 121 additions and 112 deletions.

0 comments on commit ffaec75

Please sign in to comment.