--- xerces/c/branches/xerces-3.1/src/xercesc/internal/XMLReader.cpp 2015/03/02 18:07:34 1663380
+++ xerces/c/branches/xerces-3.1/src/xercesc/internal/XMLReader.cpp 2015/03/19 20:56:46 1667870
@@ -1459,6 +1459,17 @@
while (fRawBufIndex < fRawBytesAvail)
{
+ // Security fix: make sure there are at least sizeof(UCS4Ch) bytes to consume.
+ if (fRawBufIndex + sizeof(UCS4Ch) > fRawBytesAvail) {
+ ThrowXMLwithMemMgr1
+ (
+ TranscodingException
+ , XMLExcepts::Reader_CouldNotDecodeFirstLine
+ , fSystemId
+ , fMemoryManager
+ );
+ }
+
// Get out the current 4 byte value and inc our raw buf index
UCS4Ch curVal = *asUCS++;
fRawBufIndex += sizeof(UCS4Ch);
@@ -1618,6 +1629,17 @@
while (fRawBufIndex < fRawBytesAvail)
{
+ // Security fix: make sure there are at least sizeof(UTF16Ch) bytes to consume.
+ if (fRawBufIndex + sizeof(UTF16Ch) > fRawBytesAvail) {
+ ThrowXMLwithMemMgr1
+ (
+ TranscodingException
+ , XMLExcepts::Reader_CouldNotDecodeFirstLine
+ , fSystemId
+ , fMemoryManager
+ );
+ }
+
// Get out the current 2 byte value
UTF16Ch curVal = *asUTF16++;
fRawBufIndex += sizeof(UTF16Ch);
@@ -1707,6 +1729,17 @@
//
void XMLReader::refreshRawBuffer()
{
+ // Security fix: make sure we don't underflow on the subtraction.
+ if (fRawBufIndex > fRawBytesAvail) {
+ ThrowXMLwithMemMgr1
+ (
+ RuntimeException
+ , XMLExcepts::Str_StartIndexPastEnd
+ , fSystemId
+ , fMemoryManager
+ );
+ }
+
//
// If there are any bytes left, move them down to the start. There
// should only ever be (max bytes per char - 1) at the most.