blob: d9eeb45c73b5a1bad5392703b876778f98f7f004 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
Description: In stamp always advance the pointer if *p= 0xef
.
The current implementation only advanced if 0xef is followed
by two non-zero bytes. In case of malformed input (0xef should be
the start byte of a three byte character) this leads to an infinite
loop. (CVE-2021-42260)
Origin: https://sourceforge.net/p/tinyxml/git/merge-requests/1/
--- a/tinyxmlparser.cpp
+++ b/tinyxmlparser.cpp
@@ -274,6 +274,12 @@ void TiXmlParsingData::Stamp( const char* now, TiXmlEncoding encoding )
else
{ p +=3; ++col; } // A normal character.
}
+ else
+ {
+ // TIXML_UTF_LEAD_0 (239) is the start character of a 3 byte sequence, so
+ // there is something wrong here. Just advance the pointer to evade infinite loops
+ ++p;
+ }
}
else
{
|
GitWeb
