Attachment 306233 Details for Bug 447719 – Add some error checking and fix a buffer overflow

Add some error checking and fix a buffer overflow

xgrep-0.06-segfaults.patch (text/plain), 2.77 KB, created by Lubomir Rintel on 2008-05-21 11:55:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Rintel

Created: 2008-05-21 11:55:26 UTC

Size: 2.77 KB

patch

obsolete

>A couple of checks to prevent NULL dereferences in case of wrongly
>constructed XPath, and one to prevent a sprintf-based buffer overflow.
>
>This is definitely by no means complete, the error handling needs
>to be dealt with more systematically -- this is just that I don't have
>millions of core dumps around my ~, for I mistype XPaths often :)
>
>Lubomir Rintel <lkundrak@v3.sk>
>
>diff -urp xgrep-0.06.orig/find.c xgrep-0.06/find.c
>--- xgrep-0.06.orig/find.c	2006-03-17 04:26:05.000000000 +0100
>+++ xgrep-0.06/find.c	2008-05-21 13:32:46.000000000 +0200
>@@ -420,26 +420,44 @@ int AppendToNodeSet(xmlNodeSetPtr nodese
> }
> 
> 
>-void PrintXPathNodes(xmlDocPtr doc, xmlChar* xpathtxt) {
>+int PrintXPathNodes(xmlDocPtr doc, xmlChar* xpathtxt) {
>   xmlXPathContextPtr xpcntxt = 0;
>   xmlXPathObjectPtr xpobj = 0;
>   xmlNodeSetPtr nodeset = 0;
>-  char note[256];
>+  char *note;
> 
>   if (doc && xpathtxt) {
>     xpcntxt = xmlXPathNewContext(doc);
>+    if (xpcntxt == NULL) {
>+        return 0;
>+    }
>+
>     xpcntxt->node = xmlDocGetRootElement(doc);
>     xpobj = xmlXPathEval(xpathtxt, xpcntxt);
>+    if (xpobj == NULL) {
>+        xmlFree (xpcntxt);
>+        return 0;
>+    }
>     nodeset = xpobj->nodesetval;
>-    
>-    /* Should use snprintf here. Portability? */
>-    sprintf(note, "(XPath: %s)", xpathtxt);
> 
>+    note = malloc(strlen((char *)xpathtxt) + 9);
>+    if (note == NULL) {
>+        fprintf (stderr, "Out of Memory\n");
>+        xmlXPathFreeObject(xpobj);
>+        xmlXPathFreeContext(xpcntxt);
>+        return 0;
>+    }
>+
>+    sprintf(note, "(XPath: %s)", xpathtxt);
>     PrintNodeSet(nodeset, note);
> 
>+    free (note);
>     xmlXPathFreeObject(xpobj);
>     xmlXPathFreeContext(xpcntxt);
>+    return 1;
>   }
>+
>+  return 0;
> }
> 
> 
>diff -urp xgrep-0.06.orig/find.h xgrep-0.06/find.h
>--- xgrep-0.06.orig/find.h	2006-03-17 04:26:32.000000000 +0100
>+++ xgrep-0.06/find.h	2008-05-21 13:29:50.000000000 +0200
>@@ -86,7 +86,7 @@ int AppendToNodeSet(xmlNodeSetPtr nodese
> 
> 
> /* Print subtrees from doc selected by the XPath xpathtxt */
>-void PrintXPathNodes(xmlDocPtr doc, xmlChar* xpathtxt);
>+int PrintXPathNodes(xmlDocPtr doc, xmlChar* xpathtxt);
> 
> /* Print subtrees from doc selected by the search string srchstr */
> int PrintSearchStrNodes(xmlDocPtr doc, char* srchstr, RegexType rt);
>diff -urp xgrep-0.06.orig/xgrep.c xgrep-0.06/xgrep.c
>--- xgrep-0.06.orig/xgrep.c	2006-03-17 04:25:39.000000000 +0100
>+++ xgrep-0.06/xgrep.c	2008-05-21 13:33:01.000000000 +0200
>@@ -138,7 +138,9 @@ int main (int argc, char* argv[]) {
> 
>     /* Print matching nodes if an XPath string was specified */
>     if (xpathtxt)
>-      PrintXPathNodes(doc, (xmlChar*)xpathtxt);
>+      if (PrintXPathNodes(doc, (xmlChar*)xpathtxt) == 0) {
>+        exit (1);
>+      }
> 
>     /* Print matching nodes for each regex string specified */
>     for (k = 0; k < nsrchstr; k++) {

Actions: View

Attachments on bug 447719: 306233