Skip to content

Commit

Permalink
Calcualte max nspace declarations correctly for XML writer
Browse files Browse the repository at this point in the history 
(raptor_xml_writer_start_element_common): Calculate max including for
each attribute a potential name and value.

Fixes Issues #0000617 http://bugs.librdf.org/mantis/view.php?id=617
and #0000618 http://bugs.librdf.org/mantis/view.php?id=618
  • Loading branch information
@dajobe
dajobe committed Apr 16, 2017
1 parent 593f051 commit 590681e
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions src/raptor_xml_writer.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -181,9 +181,10 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer,
size_t nspace_declarations_count = 0;
unsigned int i;

/* max is 1 per element and 1 for each attribute + size of declared */
if(nstack) {
int nspace_max_count = element->attribute_count+1;
int nspace_max_count = element->attribute_count * 2; /* attr and value */
if(element->name->nspace)
nspace_max_count++;
if(element->declared_nspaces)
nspace_max_count += raptor_sequence_size(element->declared_nspaces);
if(element->xml_language)
Expand Down Expand Up @@ -237,7 +238,7 @@ raptor_xml_writer_start_element_common(raptor_xml_writer* xml_writer,
}
}

/* Add the attribute + value */
/* Add the attribute's value */
nspace_declarations[nspace_declarations_count].declaration=
raptor_qname_format_as_xml(element->attributes[i],
&nspace_declarations[nspace_declarations_count].length);
Expand Down

3 comments on commit 590681e

@erictapen
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @dajobe, this fixes CVE-2017-18926, right? Is there any possibility you could reference this commit on that CVE page, marking it as Patch? That would make closing the vulnerabilty for package maintainers easier.

@dajobe
Copy link
Owner Author

@dajobe dajobe commented on 590681e Sep 18, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@erictapen yes 590681e fixes that CVE. I don't know how to reference things on that NIST page.

@erictapen
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for answering. Unfortunately I don't know about the process either but I suppose it's a good start to have the relationship documented here.

Please sign in to comment.