39 lines
1004 B
Diff
39 lines
1004 B
Diff
From 384cc7c182fc00c6d5e2ab4b5e3671b2e3f93c84 Mon Sep 17 00:00:00 2001
|
|
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
|
Date: Sun, 6 Apr 2025 12:41:11 +0200
|
|
Subject: [PATCH] [CVE-2025-32415] schemas: Fix heap buffer overflow in
|
|
xmlSchemaIDCFillNodeTables
|
|
|
|
Don't use local variable which could contain a stale value.
|
|
|
|
Fixes #890.
|
|
---
|
|
xmlschemas.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/xmlschemas.c b/xmlschemas.c
|
|
index e35c117ef..4bdabd129 100644
|
|
--- a/xmlschemas.c
|
|
+++ b/xmlschemas.c
|
|
@@ -23324,7 +23324,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
|
|
j++;
|
|
} while (j < nbDupls);
|
|
}
|
|
- if (nbNodeTable) {
|
|
+ if (bind->nbNodes) {
|
|
j = 0;
|
|
do {
|
|
if (nbFields == 1) {
|
|
@@ -23375,7 +23375,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
|
|
|
|
next_node_table_entry:
|
|
j++;
|
|
- } while (j < nbNodeTable);
|
|
+ } while (j < bind->nbNodes);
|
|
}
|
|
/*
|
|
* If everything is fine, then add the IDC target-node to
|
|
--
|
|
GitLab
|
|
|