Gutyina Gergő
41 lines
1.2 KiB
Diff
41 lines
1.2 KiB
Diff
diff --git a/tree.c b/tree.c
|
|
index f097cf87..4d966ec9 100644
|
|
--- a/tree.c
|
|
+++ b/tree.c
|
|
@@ -47,6 +47,10 @@
|
|
#include "private/error.h"
|
|
#include "private/tree.h"
|
|
|
|
+#ifndef SIZE_MAX
|
|
+ #define SIZE_MAX ((size_t) -1)
|
|
+#endif
|
|
+
|
|
int __xmlRegisterCallbacks = 0;
|
|
|
|
/************************************************************************
|
|
@@ -167,10 +168,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
|
|
xmlChar *
|
|
xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
|
|
xmlChar *memory, int len) {
|
|
- int lenn, lenp;
|
|
+ size_t lenn, lenp;
|
|
xmlChar *ret;
|
|
|
|
- if (ncname == NULL) return(NULL);
|
|
+ if ((ncname == NULL) || (len < 0)) return(NULL);
|
|
if (prefix == NULL) return((xmlChar *) ncname);
|
|
|
|
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
|
|
@@ -181,8 +182,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
|
|
|
|
lenn = strlen((char *) ncname);
|
|
lenp = strlen((char *) prefix);
|
|
+ if (lenn >= SIZE_MAX - lenp - 1)
|
|
+ return(NULL);
|
|
|
|
- if ((memory == NULL) || (len < lenn + lenp + 2)) {
|
|
+ if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
|
|
ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
|
|
if (ret == NULL)
|
|
return(NULL);
|