Skip to content

[libxml] Fix integer overflows with XML_PARSE_HUGE - #4989

Merged
dahlstrom-g merged 2 commits into
youtube:25.lts.1+from
dahlstrom-g:CVE-2022-40303
Mar 13, 2025
Merged

dahlstrom-g merged 2 commits into
youtube:25.lts.1+from
dahlstrom-g:CVE-2022-40303

Conversation

@dahlstrom-g

Copy link
Copy Markdown
Contributor

Issue: 398872877

@kaidokert kaidokert changed the title Fix integer overflows with XML_PARSE_HUGE [libxml] Fix integer overflows with XML_PARSE_HUGE Mar 5, 2025
nwellnhof and others added 2 commits March 13, 2025 15:00
Also impose size limits when XML_PARSE_HUGE is set. Limit size of names
to XML_MAX_TEXT_LENGTH (10 million bytes) and other content to
XML_MAX_HUGE_LENGTH (1 billion bytes).

Move some the length checks to the end of the respective loop to make
them strict.

xmlParseEntityValue didn't have a length limitation at all. But without
XML_PARSE_HUGE, this should eventually trigger an error in xmlGROW.

Thanks to Maddie Stone working with Google Project Zero for the report!

(cherry picked from commit c846986356fc149915a74972bf198abc266bc2c0)
… by commit 04a4b26.

Issue: 398872877
Reviewed-on: youtube#4989
@dahlstrom-g
dahlstrom-g merged commit 6455c41 into youtube:25.lts.1+ Mar 13, 2025
@dahlstrom-g
dahlstrom-g deleted the CVE-2022-40303 branch March 13, 2025 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants