diff options
| author | Arseny Kapoulkine <arseny.kapoulkine@gmail.com> | 2015-03-12 20:21:59 -0700 |
|---|---|---|
| committer | Arseny Kapoulkine <arseny.kapoulkine@gmail.com> | 2015-03-12 20:21:59 -0700 |
| commit | 0542b1869b6970003caa954ebc5f1dea41d48032 (patch) | |
| tree | b6845a48a40b9fd6a835e66b3c2a25807e08c1f1 | |
| parent | 604861e520d2d6579674a1c2bd5e59cb10f7ecd2 (diff) | |
Fix buffer overrun when parsing comments inside DOCTYPE
| -rw-r--r-- | src/pugixml.cpp | 2 | ||||
| -rw-r--r-- | tests/test_parse.cpp | 14 |
2 files changed, 15 insertions, 1 deletions
diff --git a/src/pugixml.cpp b/src/pugixml.cpp index ce8a79f..4269335 100644 --- a/src/pugixml.cpp +++ b/src/pugixml.cpp @@ -2352,7 +2352,7 @@ PUGI__NS_BEGIN PUGI__SCANFOR(s[0] == '-' && s[1] == '-' && s[2] == '>'); // no need for ENDSWITH because --> can't terminate proper doctype if (!*s) PUGI__THROW_ERROR(status_bad_doctype, s); - s += 4; + s += 3; } else PUGI__THROW_ERROR(status_bad_doctype, s); diff --git a/tests/test_parse.cpp b/tests/test_parse.cpp index 1b1e807..7bb2663 100644 --- a/tests/test_parse.cpp +++ b/tests/test_parse.cpp @@ -1091,3 +1091,17 @@ TEST(parse_close_tag_eof) CHECK(doc.load_buffer_inplace(test2, 12 * sizeof(char_t)).status == status_end_element_mismatch); CHECK_STRING(doc.first_child().name(), STR("node")); } + +TEST(parse_fuzz_doctype) +{ + unsigned char data[] = + { + 0x3b, 0x3c, 0x21, 0x44, 0x4f, 0x43, 0x54, 0x59, 0x50, 0x45, 0xef, 0xbb, 0xbf, 0x3c, 0x3f, 0x78, + 0x6d, 0x6c, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x31, 0x2e, 0x30, 0x22, + 0x3f, 0x3e, 0x3c, 0x21, 0x2d, 0x2d, 0x20, 0xe9, 0x80, 0xb1, 0xe5, 0xa0, 0xb1, 0xe3, 0x82, 0xb4, + 0xe3, 0x83, 0xb3, 0x20, 0xef, 0x83, 0x97, 0xe3, 0xa9, 0x2a, 0x20, 0x2d, 0x2d, 0x3e + }; + + xml_document doc; + CHECK(doc.load_buffer(data, sizeof(data)).status == status_bad_doctype); +} |